(a) A person may not require an individual to disclose the individual's social security number to obtain goods or services from or enter into a business transaction with the person unless the person:
(1) adopts a privacy policy as provided by Subsection (b);
(2) makes the privacy policy available to the individual; and
(3) maintains under the privacy policy the confidentiality and security of the social security number disclosed to the person.
(b) A privacy policy adopted under this section must include:
(1) how personal information is collected;
(2) how and when the personal information is used;
(3) how the personal information is protected;
(4) who has access to the personal information; and
(5) the method of disposal of the personal information.