Sec. 42-471. Safeguarding of personal information. Social Security numbers. Privacy protection policy. Civil penalty.
Sec. 42-471. Safeguarding of personal information. Social Security numbers.
Privacy protection policy. Civil penalty. (a) Any person in possession of personal
information of another person shall safeguard the data, computer files and documents
containing the information from misuse by third parties, and shall destroy, erase or make
unreadable such data, computer files and documents prior to disposal.
(b) Any person who collects Social Security numbers in the course of business shall
create a privacy protection policy which shall be published or publicly displayed. For
purposes of this subsection, "publicly displayed" includes, but is not limited to, posting
on an Internet web page. Such policy shall: (1) Protect the confidentiality of Social
Security numbers, (2) prohibit unlawful disclosure of Social Security numbers, and (3)
limit access to Social Security numbers.
(c) As used in this section, "personal information" means information capable of
being associated with a particular individual through one or more identifiers, including,
but not limited to, a Social Security number, a driver's license number, a state identification card number, an account number, a credit or debit card number, a passport number,
an alien registration number or a health insurance identification number, and does not
include publicly available information that is lawfully made available to the general
public from federal, state or local government records or widely distributed media.
(d) For persons who hold a license, registration or certificate issued by a state agency
other than the Department of Consumer Protection, this section shall be enforceable
only by such other state agency pursuant to such other state agency's existing statutory
and regulatory authority.
(e) Any person or entity that violates the provisions of this section shall be subject
to a civil penalty of five hundred dollars for each violation, provided such civil penalty
shall not exceed five hundred thousand dollars for any single event. It shall not be a
violation of this section if such violation was unintentional.
(f) The provisions of this section shall not apply to any agency or political subdivision of the state.
(g) Any civil penalties received pursuant to this section shall be deposited into the
privacy protection guaranty and enforcement account established pursuant to section
19 of substitute senate bill 30 of the February 2008, regular session*.
(P.A. 08-167, S. 1.)
*Note: Substitute senate bill 30 of the February 2008, regular session did not become law.