OLR Bill Analysis

sSB 671



This bill:

1. requires government entities to make certain disclosures when requesting Social Security numbers;

2. requires people, businesses, and government entities that lose or cause the unauthorized disclosure of a person's Social Security number to notify him or her and pay for identity theft monitoring protection if requested; and

3. permits anyone harmed by an unauthorized disclosure to bring a civil action for damages.

EFFECTIVE DATE: October 1, 2008


The bill requires state government entities that request Social Security numbers to tell the people being asked (1) if the disclosure is mandatory or voluntary, (2) the legal authority for the request, and (3) how the numbers will be used. The requirement applies to state departments, boards, commissions, institutions, and other agencies, and political subdivisions.


Notice and Identity Theft Protection

The bill requires any person, entity, state agency, or political subdivision that loses or causes the unauthorized disclosure of a person's Social Security number to (1) notify the number's owner of the loss or disclosure within seven days after discovering it, (2) give the owner the option of at least two years of expense-paid commercially available identity theft monitoring protection, and (3) enroll or help to enroll anyone who asks in identity theft monitoring and protection.

Action for Damages

The bill permits anyone aggrieved by the unauthorized disclosure of personal identifying information to bring a civil action for damages in Superior Court. “Personal identifying information” means any name, number, or other information that may be used, alone or with any other information, to identify a specific individual. This information includes a person's:

1. name or date of birth;

2. mother's maiden name;

3. Social Security, employer or taxpayer identification, employee identification, alien registration, government passport, driver's license, health insurance identification, demand deposit, savings account, or debit or credit card number; or

4. unique biometric data, such as a fingerprint, voice print, retina or iris image, or other unique physical representation.

The person must prove by a preponderance of the evidence that the disclosure caused the alleged damages. Like victims of identity theft, a person aggrieved by an unauthorized disclosure must bring the action within two years after the date the disclosure is discovered or reasonably should have been discovered. Courts must award prevailing plaintiffs the greater of $ 1,000 or treble damages plus costs and reasonable attorney's fees.


Identity Theft Crimes

Under state law, it is a crime to steal someone's identity or traffic in identity theft. The penalties range from up to five years in prison, a $ 5,000 fine, or both to up to up to 20 years in prison, $ 15,000, or both, depending on the value of the money, credit, goods, property, or services involved.

Federal Privacy Act

Federal law requires federal agencies that maintain records and request information from individuals to tell them the agency's authority for requesting it, how the information will be used, and if the disclosure is mandatory or voluntary (5 USC 552a (e)).

Related Bills

The General Law Committee favorably reported three bills related to identity theft:

sSB 30 broadens the definition of “identity theft” as it is used under the state's penal code; allows identity theft victims to sue for damages traffickers in personal identifying information; requires, rather than allows, courts to issue orders to correct public records whenever a person is convicted of identity theft; prohibits employers from disclosing their employees' Social Security numbers without consent; makes the illegal proceeds of identity theft crimes subject to forfeiture; requires financial institutions to take steps to protect against identity theft; and creates an account to reimburse people hurt by the dissemination of their personal identifying information.

sHB 5658 prohibits people, businesses, and other organizations, other than the state and its political subdivisions, from requesting Social Security numbers as a condition of leasing, purchasing, or receiving products, goods, or services.

sHB 5760 makes a state agency, person, or business that loses or discloses an individual's personal identifying information responsible for identify theft monitoring and protection costs and any other costs or fees if the individual's identity is stolen.


Judiciary Committee

Joint Favorable Substitute