A. Except as provided in Subsection B of this section, no business shall require a consumer's social security number as a condition for the consumer to lease or purchase products, goods or services from the business.
B. Nothing in this section prohibits a business from requiring or requesting a consumer's social security number if the number will be used in a manner consistent with state or federal law or as part of an application for credit or in connection with annuity or insurance transactions.
C. Nothing in this section prohibits a business from acquiring or using a consumer's social security number if the consumer consents to the acquisition or use.
D. A company acquiring or using social security numbers of consumers shall adopt internal policies that:
(1) limit access to the social security numbers to those employees authorized to have access to that information to perform their duties; and
(2) hold employees responsible if the social security numbers are released to unauthorized persons.