Last week, Rhode Island enacted a new law that prohibits businesses from requesting any part of a customer’s social security number during a sales transaction. Section 6-13-17 of the Rhode Island Consumer Empowerment and Identity Theft Prevention Act, which became effective immediately, modifies a previous state law provision that permitted businesses to request a portion of a consumer’s social security number — usually the last four digits — in connection with the purchase of a product or service. A violation of the law can result in a criminal misdemeanor, as well as a private right of action permitting an award of damages, attorney’s fees, costs, and injunctive relief.
The law has few exemptions: licensed insurance companies, certain financial and health care or pharmaceutical-related services, and credit card offerors, but not other types of businesses in which some form of credit may be extended to the consumer as part of the sale. For example, some companies before they sell subsidized equipment to the consumer, usually as part of a term-length service contract, will collect part of a consumer’s social security number to request a credit report with a permissible purpose. This new law appears to restrict that practice. Accordingly, companies that sell to consumers in Rhode Island and typically request any form of social security number information during the sales process should pay close attention to the new law.