Law / United States / Connecticut
Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 October 2008.
A security baseline statutes rule binding private bodies.
As of 12 September 2026.
What it requires
- This binds any person in possession of another person's personal information (a Social Security number, driver's license or state identification card number, account number, credit or debit card number, passport number, alien registration number, health insurance identification number, or military identification information, combined with an identifier that associates it with the individual), except a state agency or political subdivision of the state.
- Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.
- If you collect Social Security numbers in the course of business, create a privacy protection policy, published or publicly displayed, that protects their confidentiality, prohibits their unlawful disclosure and limits access to them.
- A financial institution whose safeguards comply with the standards under Section 501(b) of the Gramm-Leach-Bliley Act is deemed compliant with this section.
- There is no private right of action for a violation of this section. The Department of Consumer Protection may impose a civil penalty of up to $5,000 per violation after an administrative hearing, and a violation is treated as an unfair trade practice enforceable by the state rather than by a private plaintiff.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil penalty under subsection (e)(2), imposed by the Department of Consumer Protection after an administrative hearing under chapter 54; the section states no aggregate cap for this penalty.
- Rule
- Per violation only
- As of
- 12 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Department of Consumer Protection may conduct an administrative hearing under chapter 54 and impose a civil penalty of not more than $5,000 per violation (subsection (e)(2)). Where the person is licensed, registered, certified or chartered under the supervision of a different state agency, that agency enforces instead (subsection (d)). The Attorney General may apply to the Superior Court for an order restraining or enjoining a violation, at the Commissioner's request or, for a violation the statute assigns to another agency, at that agency's request (Sec. 42-472).
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Any person in possession of another person's personal information must safeguard the data, computer files and documents containing it from misuse by third parties, and destroy, erase or make it unreadable before disposal. Any person who collects Social Security numbers in the course of business must create and publish a privacy protection policy that protects their confidentiality, prohibits unlawful disclosure and limits access.
The section does not apply to a state agency or political subdivision of the state. A financial institution that has adopted safeguards complying with the Gramm-Leach-Bliley Act's Section 501(b) standards is deemed compliant with this section.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minorsoperates_social_platformships_mobile_appdistributes_software_product