Law / United States / 
Connecticut
Protection of Social Security Numbers and Personal Information Act, safeguarding and destruction duty
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds any person in possession of another person's personal information (a Social Security number, driver's license or state identification card number, account number, credit or debit card number, passport number, alien registration number, health insurance identification number, or military identification information, combined with an identifier that associates it with the individual), except a state agency or political subdivision of the state.
- Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.NIST CSF 2.0PR.DS-01NIST CSF 2.0ID.AM-08
- If you collect Social Security numbers in the course of business, create a privacy protection policy, published or publicly displayed, that protects their confidentiality, prohibits their unlawful disclosure and limits access to them.NIST CSF 2.0GV.PO-01
- A financial institution whose safeguards comply with the standards under Section 501(b) of the Gramm-Leach-Bliley Act is deemed compliant with this section.
- There is no private right of action for a violation of this section. The Department of Consumer Protection may impose a civil penalty of up to $5,000 per violation after an administrative hearing, and a violation is treated as an unfair trade practice enforceable by the state rather than by a private plaintiff.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.DM-P5Data are destroyed according to policy.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil penalty under subsection (e)(2), imposed by the Department of Consumer Protection after an administrative hearing under chapter 54; the section states no aggregate cap for this penalty.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Department of Consumer Protection may conduct an administrative hearing under chapter 54 and impose a civil penalty of not more than $5,000 per violation (subsection (e)(2)). Where the person is licensed, registered, certified or chartered under the supervision of a different state agency, that agency enforces instead (subsection (d)). The Attorney General may apply to the Superior Court for an order restraining or enjoining a violation, at the Commissioner's request or, for a violation the statute assigns to another agency, at that agency's request (Sec. 42-472).
What this law does
Any person in possession of another person's personal information must safeguard the data, computer files and documents containing it from misuse by third parties, and destroy, erase or make it unreadable before disposal. Any person who collects Social Security numbers in the course of business must create and publish a privacy protection policy that protects their confidentiality, prohibits unlawful disclosure and limits access.
The section does not apply to a state agency or political subdivision of the state. A financial institution that has adopted safeguards complying with the Gramm-Leach-Bliley Act's Section 501(b) standards is deemed compliant with this section.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .