Legal advice on collecting tenant name address and phone
From the NPA attorney:
"I wanted to advise you about an issue that several members raised during the special meeting: whether requiring renters to provide their name, address and phone number would make NPA liable if someone hacked NPA’s website. My view is that NPA almost certainly would not be liable in that scenario. The members mentioned two possibilities: (1) that NPA would be liable if a hacker used the information – i.e., the home address of someone who’s on vacation and the dates of his vacation – to break into the renter’s home; and (2) that NPA would be liable based on identity theft.
First, NPA almost certainly has no legal duty to prevent a third party from breaking into a renter’s home and therefore no liability if that happens. Generally, the criminal act of a third party breaks the chain of causation between a negligent act and an injury, i.e., only the criminal is responsible for the harm caused by his crime. Even if we assume that NPA’s requirement, or lack of website security, is negligence that negligence would not be the cause of the renter’s house being broken into. There are a few narrow exceptions to the general rule – e.g., if you have control over the third party – but, in my view, none applies. This does not mean that a renter could not sue NPA if a hacker used information from NPA’s website to facilitate a burglary of the renter’s house – only that NPA almost certainly would prevail in the lawsuit.
Second, NPA is not collecting information that is covered by Connecticut’s identity theft statutes. The two principal statutes – CGS 36a-701b & CGS 42-471 – only require the safeguarding of “personal information,” and a renter’s name, address, and phone number are not “personal information” under either statute. Indeed, both statutes exempt “publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media[,]” a point you made about names and addresses at the special meeting. (Note that under CGS 36a-701b, a person’s name in combination withhis (a) Social Security number, (b) driver’s license number/state identification card number, or (c) account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account, is “personal information”. If NPA collects and stores (a), (b), or (c) on its website for renters, then it’s a different story.)
Please feel free to share this email as you see fit."
“Guidelines for bureaucrats: (1) When in charge, ponder. (2) When in trouble, delegate. (3) When in doubt, mumble.” – James Boren
Daniel J. Krisch
Halloran & Sage LLP
One Goodwin Square
225 Asylum Street
Hartford, CT 06103
Tel. (860) 297-4630
Fax (860) 548-0006