Connecticut Seal

General Assembly

 

Substitute Bill No. 671

    February Session, 2008

*_____SB00671JUD___031708____*

AN ACT CONCERNING IDENTITY THEFT.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. (NEW) (Effective October 1, 2008) Any department, board, commission, institution or other agency of the state or any political subdivision of the state that requests an individual to disclose such individual's Social Security number shall inform such individual: (1) Whether such disclosure is mandatory or voluntary, (2) by what statutory or other authority such number is requested, and (3) what uses will be made of such number.

Sec. 2. (NEW) (Effective October 1, 2008) Any person, entity, agency of the state or political subdivision of the state that loses custody of a record containing an individual's Social Security number or that causes the disclosure of an individual's Social Security number, unless such disclosure is authorized by the individual or required by law, shall (1) provide written notification of the loss or disclosure to the individual not later than seven business days after discovering the loss or disclosure, (2) provide the individual, at the individual's option, not less than two years of commercially available identity theft monitoring and protection at the cost of the person, entity, agency of the state or political subdivision of the state, and (3) upon the request of the individual, enroll the individual in such identity theft monitoring and protection or assist such individual in enrolling in such identity theft monitoring and protection.

Sec. 3. Section 52-571h of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2008):

(a) Any person aggrieved by an act constituting a violation of section 53a-129a of the general statutes, revision of 1958, revised to January 1, 2003, or section 53a-129b, 53a-129c or 53a-129d may bring a civil action in the Superior Court for damages against the person who committed the violation.

(b) Any individual aggrieved by the negligent, reckless or intentional disclosure of personal identifying information, as defined in section 53a-129a, by any person, entity, agency of the state or political subdivision of the state may bring a civil action in the Superior Court for damages against such person, entity, agency of the state or political subdivision of the state unless such disclosure was authorized by the individual or required by law. The individual shall have the burden of proving by a preponderance of the evidence that the disclosure by the person, entity, agency of the state or political subdivision of the state caused the damages alleged by the individual.

[(b)] (c) In any civil action brought under this section in which the plaintiff prevails, the court shall award the greater of one thousand dollars or treble damages, together with costs and a reasonable attorney's fee.

[(c)] (d) No action under this section shall be brought but within two years from the date when the violation is discovered or in the exercise of reasonable care should have been discovered.

This act shall take effect as follows and shall amend the following sections:

Section 1

October 1, 2008

New section

Sec. 2

October 1, 2008

New section

Sec. 3

October 1, 2008

52-571h

JUD

Joint Favorable Subst.