Processes personal data, in Connecticut

Conn. Gen. Stat. § 38a-999a · Read the law's page

• Do not disclose individually identifiable medical record information, as section 38a-976(r) defines it, with the malicious intent to damage an individual's reputation or character (section 38a-999a(a)).

Conn. Gen. Stat. § 42-470 · Read the law's page

• Do not publicly post or publicly display an individual's Social Security number in any manner (section 42-470(b)(1)).
• Do not print an individual's Social Security number on any card the individual must use to access products or services you provide (section 42-470(b)(2)).
• Do not require an individual to transmit a Social Security number over the Internet unless the connection is secure or the number is encrypted, and do not require an individual to use one to access an Internet web site unless a password, unique personal identification number or other authentication device is also required (section 42-470(b)(3) and (4)).

Conn. Gen. Stat. sec. 42-471 · Read the law's page

• This binds any person in possession of another person's personal information (a Social Security number, driver's license or state identification card number, account number, credit or debit card number, passport number, alien registration number, health insurance identification number, or military identification information, combined with an identifier that associates it with the individual), except a state agency or political subdivision of the state.
• Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.
• If you collect Social Security numbers in the course of business, create a privacy protection policy, published or publicly displayed, that protects their confidentiality, prohibits their unlawful disclosure and limits access to them.
• A financial institution whose safeguards comply with the standards under Section 501(b) of the Gramm-Leach-Bliley Act is deemed compliant with this section.
• There is no private right of action for a violation of this section. The Department of Consumer Protection may impose a civil penalty of up to $5,000 per violation after an administrative hearing, and a violation is treated as an unfair trade practice enforceable by the state rather than by a private plaintiff.

Conn. Gen. Stat. sec. 42-471a · Read the law's page

• This binds each employer, other than an agency or political subdivision of the state, and applies to employment applications it obtains and retains.
• Obtain and retain employment applications in a secure manner.
• Employ reasonable measures to destroy or make unreadable employment applications upon disposal; at a minimum, shred them or otherwise permanently destroy them in a secure setting.

Conn. Gen. Stat. sec. 42-901 · Read the law's page

• This is a safe harbor from punitive damages, not a duty: it is available to a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, sued in tort for a failure to implement reasonable cybersecurity controls that resulted in a data breach.
• To claim it, have created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards for personal and restricted information, at the time of the breach, designed to protect the information's security, confidentiality and integrity and scaled to the entity's size, complexity, activities, the sensitivity of the information, and the cost and availability of security tools.
• The program must conform to the current version of a named framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000-series), or, for an entity already regulated under HIPAA, Gramm-Leach-Bliley Title V, FISMA or HITECH, conform to that regime, or comply with the PCI Data Security Standard together with another listed framework; conform to a revised version within six months of its publication.
• The safe harbor is unavailable where the failure to implement reasonable cybersecurity controls was the result of gross negligence or wilful or wanton conduct. It creates no duty to adopt a program of its own, does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief, and leaves undisturbed the class-action certification process and the state's breach-notification statute.

Conn. Gen. Stat. § 38a-833 · Read the law's page

• If you are an insurer, health care center or fraternal benefit society doing business in Connecticut, do not request, require, purchase or use information obtained from an entity providing direct-to-consumer genetic testing, in connection with issuing, withholding, extending or renewing an annuity or a life, credit life, disability, long-term care, accidental injury, specified disease, hospital indemnity or credit accident insurance policy, without the informed written consent of the individual who was tested (section 38a-833(1)).
• Do not condition insurance rates, the provision or renewal of coverage or benefits, or other conditions of insurance for an individual on a requirement or agreement that the individual undergo genetic testing, or on the results of genetic testing of a member of the individual's family unless the results are contained in the individual's medical record (section 38a-833(2)).

Conn. Gen. Stat. § 42-518 · Read the law's page

• Give a Connecticut consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Connecticut consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor a universal opt-out preference signal.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
• Extend a consumer's deletion right to publicly available information that is collated into a consumer profile made available to users of a publicly accessible website, or that is made available for sale, and to any inference generated from that information.

Conn. Gen. Stat. § 42-523 · Read the law's page

• To hold data as de-identified under the Connecticut Data Privacy Act, take reasonable measures to ensure that it cannot be associated with an individual (Conn. Gen. Stat. § 42-523(a)(1)).
• Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (Conn. Gen. Stat. § 42-523(a)(2)).
• Contractually obligate every recipient of the de-identified data to comply with all provisions of sections 42-515 to 42-525 (Conn. Gen. Stat. § 42-523(a)(3)).
• When you disclose pseudonymous or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (Conn. Gen. Stat. § 42-523(e)).

Conn. Gen. Stat. § 42-525 · Read the law's page

• Expect CTDPA violations to be enforced exclusively by the Connecticut Attorney General as an unfair trade practice, never by a private plaintiff.
• Do not assume a cure opportunity as of right. The mandatory 60-day cure period ended December 31, 2024; since January 1, 2025 the Attorney General decides whether to offer a cure at all.

Conn. Gen. Stat. §§ 42-515, 42-524 · Read the law's page

• Confirm you conduct business in Connecticut, or produce a product or service targeted at Connecticut residents, and process or sell personal data before relying on CTDPA's scope in compliance planning.
• Reassess your applicability threshold against the 2026 amendments (S.B. 1295) rather than the original 2023 thresholds; secondary reporting describes a lower consumer-count trigger effective July 1, 2026.
• Do not sell a consumer's precise geolocation data, whether as a controller or as a third party.
• If you use facial recognition technology on your premises to prevent, detect or respond to security incidents, fraud or similar activity, use it only to match images against a database you maintain, and post signage at each entrance, other than an entrance to an area restricted to authorized employees, that links to your facial recognition technology policy.

Conn. Gen. Stat. § 36a-44a(c) · Read the law's page

• If you are a licensee under title 36a of the Connecticut General Statutes, a Connecticut bank or a Connecticut credit union, file an initial notification with the Department of Banking, in the form and manner the Banking Commissioner prescribes, not later than three business days after you know, or have reason to know, of a data security incident that may materially impact your ability to operate in a safe and sound manner or comply with applicable laws and regulations, cause significant disruption in customer services, or involve unauthorized access to the personal information of any individual (section 36a-44a(c)).

Public Act 26-64, sections 17 to 19 · Read the law's page

• If you are a direct-to-consumer genetic testing company, at all times conduct your business consistently with the consumer's property right in, and exclusive control over, the biological sample and the genetic test results, including their collection, use, retention, maintenance, disclosure and destruction (sections 18 and 19(a)(1)).
• Before accepting any biological sample, genetic data or payment from a consumer, disclose your policies and procedures on the collection, use and disclosure of genetic data, and display a privacy notice in a prominent and publicly accessible place on your website covering collection, use, access, disclosure, transfer, security, retention and deletion of the consumer's data and the consumer's consent (section 19(a)(2) and (3)).
• Before collecting, using or disclosing a consumer's genetic data, obtain the consumer's express consent after disclosing your policies on use of the data, the identity of each person who may access the test results, including any vendor or service provider, and the manner in which you may disclose the data (section 19(a)(4)).
• Separately obtain the consumer's express consent before disclosing or transferring genetic data to any person other than your vendor or service provider, before using it for any purpose other than the primary purpose for which you offered testing, and before retaining the biological sample after the testing is complete (section 19(a)(5)).
• Obtain informed consent under 45 CFR 46 before disclosing or transferring genetic data to a third party for research, or for research you control that is for publication or generalizable knowledge (section 19(a)(6)).
• Do not disclose the results of genetic testing to anyone other than the consumer unless the consumer has expressly consented or the disclosure is to a person acting under a court order, warrant or subpoena (section 19(a)(7)).
• Do not disclose a consumer's genetic data to the consumer's employer, to a person who offers health, life or long-term care insurance coverage or who gives an insurer, health care center or fraternal benefit society data for underwriting or rating, or to a third party you know or reasonably should know intends to use it for marketing, including targeted advertising (section 19(a)(8)).
• Implement reasonable security measures to protect a consumer's biological sample and genetic data from unauthorized access, destruction, use, modification or disclosure (section 19(a)(9)).
• Implement a process for a consumer to access the consumer's genetic data, require you to delete it, require you to destroy the biological sample and confirm that you have, and revoke consent for use of the data for research by you or by any third party you gave it to (section 19(a)(10)).

Public Act 26-64, sections 2(b), 2(c) and 3 (data broker application and sale limits) · Read the law's page

• Apply to the Department of Consumer Protection, if you are a data broker that intends to sell or license brokered personal data in Connecticut, for an initial registration in the form and manner the commissioner prescribes, with an initial registration fee of $2,500, and renew it each year before it expires on December 31 with a renewal application and a $2,500 renewal fee (section 2(b)).
• Disclose in each application your name, mailing address, monitored email address and telephone number, your primary web site, a publicly accessible web page without dark patterns that details how a consumer may exercise the rights under section 42-518(a), whether you collect minors' personal data or precise geolocation or reproductive or sexual health data, the measures you take to keep personal data from being sold or licensed in violation of the act, and the extent to which you or a subsidiary is regulated under the Fair Credit Reporting Act, Title V of the Gramm-Leach-Bliley Act, section 38a-38 or the HIPAA rules (section 2(c)).
• Do not sell or license any personal data in violation of sections 1 to 10 of the act or sections 42-515 to 42-526 of the general statutes (section 3).
• If you are a registered data broker, establish a privacy policy that at a minimum includes measures to ensure you do not sell or license any personal data in violation of sections 1 to 10 of the act or sections 42-515 to 42-526 of the general statutes (section 3).

Conn. Gen. Stat. § 36a-701b · Read the law's page

• Notify each affected Connecticut resident of a breach of security involving personal information without unreasonable delay and no later than 60 days after discovery, unless federal law requires a shorter time.
• Notify the Connecticut Attorney General of the breach not later than the time when you notify affected residents (section 36a-701b(b)(2)(A)).
• Treat a failure to comply with section 36a-701b as an unfair trade practice for purposes of section 42-110b, enforced by the Attorney General.

Conn. Gen. Stat. § 38a-988(9) · Read the law's page

• If you are an insurance institution, agent or insurance-support organization, disclose personal or privileged information about an individual for an actuarial or research study only if no individual may be identified in any actuarial or research report (section 38a-988(9)(A)).
• Make sure materials in which the individual may be identified are returned or destroyed as soon as they are no longer necessary (section 38a-988(9)(B)).
• Have the actuarial or research organization agree not to disclose the information unless the disclosure would otherwise be permitted by section 38a-988 if made by an insurance institution, agent or insurance-support organization (section 38a-988(9)(C)).

Public Act 26-64, section 2(a) (data broker registration requirement) · Read the law's page

• If you are a data broker, meaning a business that sells or licenses brokered personal data to another person, do not sell or license brokered personal data in Connecticut on or after January 1, 2027 unless you are actively registered with the Department of Consumer Protection (section 2(a)).

Public Act 26-64, section 5(c) (data broker deletion requests) · Read the law's page

• If you are a registered data broker, access the accessible deletion mechanism at least once every forty-five days to examine each deletion request or update and determine whether you are specifically excluded (section 5(c)(1)).
• For each verified deletion request or update that does not exclude you, delete any personal data you maintain about the participating consumer, subject to the exceptions in section 5(c)(5), except that you keep that data to the extent necessary to comply with section 5 and do not use it for any other purpose (section 5(c)(1)(B)(i)).
• For each unverified deletion request or update that does not exclude you, retain the personal data and process the request as an exercise of the consumer's right under section 42-518(a)(5)(B) (section 5(c)(1)(B)(ii)).
• At least once every forty-five days after first deleting a participating consumer's data, repeat the deletion unless a verified update excludes you (section 5(c)(2)).
• Do not maintain, use or disclose any personal data you subsequently acquire about a participating consumer whose data you deleted, except as section 5(c)(5) permits (section 5(c)(4)).

Public Act 26-64, section 6 (data broker annual statement) · Read the law's page

• If you were a registered data broker during the preceding calendar year, post on a publicly accessible web page on your primary web site, in the form and manner the commissioner prescribes, a statement disclosing the total number of deletion requests you accessed that did not exclude you, the number you answered by deleting, retaining, or deleting and retaining personal data, and for retention the number retained under the section 5(c)(5) exceptions or the section 7 exemptions (section 6).

Public Act 26-64, section 5(d) (data broker audit) · Read the law's page

• If you are a registered data broker, not later than July 1, 2031 and every three years after, retain an independent auditor at your expense to audit your books for compliance with section 5(c), prepare an audit report disclosing the results, and submit it and its materials to you (section 5(d)(1)(A)).
• Maintain each audit report and its materials for at least six years from the date they are submitted to you (section 5(d)(1)(B)).
• Submit an audit report and its materials to the Department of Consumer Protection, in the form and manner the commissioner prescribes, not later than five business days after the department notifies you that it requires them (section 5(d)(2)).