Processes voice recordings, in Connecticut

Conn. Gen. Stat. 53a-187, 53a-188, 53a-189 · Read the law's page

• As a person who is not a sender or receiver of a telephonic, telegraphic or cellular radio telephone communication, do not intentionally overhear or record it by instrument, device or equipment when neither the sender nor the receiver has consented; this wiretapping offense does not reach a party to the communication who records it.
• As a person not present at a conversation or discussion, do not intentionally overhear or record it by instrument, device or equipment when no party to it has consented; this mechanical-overhearing offense does not reach a participant in the conversation.
• Do not unlawfully engage in wiretapping or mechanical overhearing of a conversation.
• If you do not have the sender's or receiver's consent, do not obtain from a telephone or telegraph corporation's employee, officer or representative, by connivance, deception, intimidation or otherwise, information about the contents or nature of a telephonic or telegraphic communication, and, if you are such an employee, officer or representative, do not divulge that information to another person without that consent.
• None of these offenses reaches wiretapping by a federal, state or local criminal law enforcement official in the lawful performance of official duties.

Conn. Gen. Stat. sec. 42-471 · Read the law's page

• This binds any person in possession of another person's personal information (a Social Security number, driver's license or state identification card number, account number, credit or debit card number, passport number, alien registration number, health insurance identification number, or military identification information, combined with an identifier that associates it with the individual), except a state agency or political subdivision of the state.
• Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.
• If you collect Social Security numbers in the course of business, create a privacy protection policy, published or publicly displayed, that protects their confidentiality, prohibits their unlawful disclosure and limits access to them.
• A financial institution whose safeguards comply with the standards under Section 501(b) of the Gramm-Leach-Bliley Act is deemed compliant with this section.
• There is no private right of action for a violation of this section. The Department of Consumer Protection may impose a civil penalty of up to $5,000 per violation after an administrative hearing, and a violation is treated as an unfair trade practice enforceable by the state rather than by a private plaintiff.

Conn. Gen. Stat. sec. 42-471a · Read the law's page

• This binds each employer, other than an agency or political subdivision of the state, and applies to employment applications it obtains and retains.
• Obtain and retain employment applications in a secure manner.
• Employ reasonable measures to destroy or make unreadable employment applications upon disposal; at a minimum, shred them or otherwise permanently destroy them in a secure setting.

Conn. Gen. Stat. sec. 42-901 · Read the law's page

• This is a safe harbor from punitive damages, not a duty: it is available to a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, sued in tort for a failure to implement reasonable cybersecurity controls that resulted in a data breach.
• To claim it, have created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards for personal and restricted information, at the time of the breach, designed to protect the information's security, confidentiality and integrity and scaled to the entity's size, complexity, activities, the sensitivity of the information, and the cost and availability of security tools.
• The program must conform to the current version of a named framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000-series), or, for an entity already regulated under HIPAA, Gramm-Leach-Bliley Title V, FISMA or HITECH, conform to that regime, or comply with the PCI Data Security Standard together with another listed framework; conform to a revised version within six months of its publication.
• The safe harbor is unavailable where the failure to implement reasonable cybersecurity controls was the result of gross negligence or wilful or wanton conduct. It creates no duty to adopt a program of its own, does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief, and leaves undisturbed the class-action certification process and the state's breach-notification statute.

Conn. Gen. Stat. 52-570d · Read the law's page

• Before using an instrument, device or equipment to record an oral private telephonic communication, either obtain the consent of all parties to it in writing or as part of, and at the start of, the recording, or give verbal notification recorded at the beginning and made part of the communication, or use an automatic tone-warning device that produces a distinct signal repeated at approximately fifteen-second intervals throughout the call.
• This duty reaches a party to the call who records it, not only a third party, and Connecticut carries no general exception letting a business record its own customer, sales or support calls without using one of these three mechanisms.
• These duties do not apply to: a federal, state or local law enforcement official recording in the lawful performance of duty; a public or private safety agency employee recording an emergency call; a person who, as recipient, records a threatening, extortionate or otherwise unlawfully demanding call; a person who, as recipient, records a call that occurs repeatedly or at an extremely inconvenient hour; a common carrier employee performing lawful duties or providing wiretap facilities to law enforcement; an FCC-licensed broadcast station employee recording solely for broadcast; a United States Secret Service employee recording calls concerning presidential or White House safety; and an FCC broadcast licensee's employee recording as part of a cooperative broadcast programming effort solely for broadcast.