AN ACT IMPOSING RESTRICTIONS ON REQUESTS CONCERNING SOCIAL SECURITY NUMBERS.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 42-470 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2007):

(a) For the purposes of this section, "person" means any individual, firm, partnership, association, corporation, limited liability company, organization or other entity, but does not include the state or any political subdivision of the state, or any agency thereof.

(b) Except as provided in subsection (c) of this section, [on and after January 1, 2005,] no person shall:

(1) Publicly post or publicly display in any manner an individual's Social Security number. For the purposes of this subdivision, "publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public;

(2) Print an individual's Social Security number on any card required for the individual to access products or services provided by such person;

(3) Require an individual to transmit such individual's Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted; [or]

(4) Require an individual to use such individual's Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site; or

(5) Require an individual to provide more than the last four digits of such individual's Social Security number when such number is requested for the purposes of verifying the individual's identity, unless such person's policies and procedures relative to the manner in which such number is required to be provided does not expose such number to unreasonable risk of disclosure to the general public.

(c) The provisions of subsection (b) of this section shall apply with respect to group and individual health insurance policies providing coverage of the type specified in subdivisions (1), (2), (4), (6), (10) and (12) of section 38a-469 that are delivered, issued for delivery, amended, renewed or continued on and after July 1, 2005.

(d) This section does not prevent the collection, use or release of a Social Security number as required by state or federal law or the collection, use or release of a Social Security number for [internal] verification or administrative purposes.

(e) Any person who wilfully violates the provisions of subsection (b) of this section shall be fined not more than one hundred dollars for a first offense and not more than five hundred dollars for a second offense, and shall be fined not more than one thousand dollars or be imprisoned not more than six months, or both, for each subsequent offense.

Statement of Purpose:

To require that banks and other entities may only request the last four digits of an individual's Social Security number when using such number to verify an individual's identity.

[Proposed deletions are enclosed in brackets. Proposed additions are indicated by underline, except that when the entire text of a bill or resolution or a section of a bill or resolution is new, it is not underlined.]