Privacy Law Library

Safeguarding of Personal Information; SSN Privacy Protection Policy; Secure Retention of Employment Applications

CT Data Safeguards & Disposal

Data security · Employees

Requires anyone holding personal information to protect it from misuse and to destroy or render it unreadable before disposal, and requires businesses that collect Social Security numbers to publish a privacy protection policy. Employers must keep job applications secure and shred them on disposal.

Where
Connecticut
Citation
Conn. Gen. Stat. 42-471, 42-471a
Status
In force
Last amended
2023-07-01
Enforced by
Connecticut Department of Consumer Protection and Attorney General; licensing agencies for their licensees (42-471(d))
People can sue
No
Penalties
Violations of 42-471 are CUTPA unfair trade practices without a private action (42-471(e)(1)); DCP may impose up to $5,000 per violation after a hearing (42-471(e)(2)).
Applies to
  • Any person in possession of another person's personal information, other than state agencies and political subdivisions (42-471(a), (f))
  • Any person that collects Social Security numbers in the course of business (42-471(b))
  • Employers, as defined in 31-128a, for employment applications (42-471a)

What a privacy notice must say

  • Businesses collecting SSNs must publish or publicly display (for example, online) a privacy protection policy that protects SSN confidentiality, prohibits unlawful disclosure and limits access.Conn. Gen. Stat. 42-471(b)

Security duties

  • Safeguard data, files and documents containing personal information from misuse by third parties.Conn. Gen. Stat. 42-471(a)
  • Destroy, erase or make unreadable personal information before disposal.Conn. Gen. Stat. 42-471(a)
  • Employers must obtain and retain employment applications securely and shred or otherwise permanently destroy them on disposal.Conn. Gen. Stat. 42-471a(a)

Other duties

  • Financial institutions complying with GLBA Safeguards standards are deemed compliant.Conn. Gen. Stat. 42-471(g)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Original effective date of P.A. 08-167 not confirmed; P.A. 23-98, s. 5 (effective 2023-07-01) verified, but the date of P.A. 23-99, s. 32 was not checked; 42-471a penalty amounts not reviewed.

Research reference, not legal advice.