Do You Have a Privacy Protection Policy?

Connecticut now has a law that mandates all businesses that collect "Social Security numbers in the course of business" to establish a policy that protects the confidentiality of social security numbers. Covered businesses must dispose of them properly. The law also requires all "persons" who get "personal information" on one person, to safeguard such information as well.

If you are just finding out about this now and are covered by the law, you must create a "Privacy Protection Policy" that ensures confidentiality of Social Security numbers, prohibits their unlawful disclosure, and limits access to them.

You must publish or post this policy and make sure you protect what the law calls “personal information” which is "information capable of being associated with a particular individual through one or more identifiers". It’s easy to see that credit card numbers, and bank account numbers would be ““personal information” but what about customer numbers that your business tie to a particular customer? Those are probably covered by the law, since the law says that “personal information” is not “publicly available information” that one can legally obtains from federal, state, or local government records or widely distributed media.

Connecticut’s Department of Consumer Protection has the power to enforce the statute. Don’t be too afraid if you make an innocent mistake in connection with the law, because only intentional violations result in a civil penalty, of $500 per violation, with a $500,000 cap on a single event. Unintentional violations are specifically excluded.

See our Privacy Policy.

Call Minchella & Associates now for a consultation concerning your business’s policies: (203) 758-1069.