Processes biometric data, in Connecticut

Conn. Gen. Stat. sec. 42-471 · Read the law's page

• This binds any person in possession of another person's personal information (a Social Security number, driver's license or state identification card number, account number, credit or debit card number, passport number, alien registration number, health insurance identification number, or military identification information, combined with an identifier that associates it with the individual), except a state agency or political subdivision of the state.
• Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.
• If you collect Social Security numbers in the course of business, create a privacy protection policy, published or publicly displayed, that protects their confidentiality, prohibits their unlawful disclosure and limits access to them.
• A financial institution whose safeguards comply with the standards under Section 501(b) of the Gramm-Leach-Bliley Act is deemed compliant with this section.
• There is no private right of action for a violation of this section. The Department of Consumer Protection may impose a civil penalty of up to $5,000 per violation after an administrative hearing, and a violation is treated as an unfair trade practice enforceable by the state rather than by a private plaintiff.

Conn. Gen. Stat. sec. 42-471a · Read the law's page

• This binds each employer, other than an agency or political subdivision of the state, and applies to employment applications it obtains and retains.
• Obtain and retain employment applications in a secure manner.
• Employ reasonable measures to destroy or make unreadable employment applications upon disposal; at a minimum, shred them or otherwise permanently destroy them in a secure setting.

Conn. Gen. Stat. sec. 42-901 · Read the law's page

• This is a safe harbor from punitive damages, not a duty: it is available to a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, sued in tort for a failure to implement reasonable cybersecurity controls that resulted in a data breach.
• To claim it, have created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards for personal and restricted information, at the time of the breach, designed to protect the information's security, confidentiality and integrity and scaled to the entity's size, complexity, activities, the sensitivity of the information, and the cost and availability of security tools.
• The program must conform to the current version of a named framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000-series), or, for an entity already regulated under HIPAA, Gramm-Leach-Bliley Title V, FISMA or HITECH, conform to that regime, or comply with the PCI Data Security Standard together with another listed framework; conform to a revised version within six months of its publication.
• The safe harbor is unavailable where the failure to implement reasonable cybersecurity controls was the result of gross negligence or wilful or wanton conduct. It creates no duty to adopt a program of its own, does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief, and leaves undisturbed the class-action certification process and the state's breach-notification statute.

Conn. Gen. Stat. § 42-515(4), (38) · Read the law's page

• Obtain a Connecticut consumer's opt-in consent before processing sensitive data, including biometric data generated to uniquely identify the individual.
• Treat a faceprint or voiceprint generated from a video, audio, or photographic recording, for the purpose of identifying a specific individual, as covered biometric and sensitive data. Connecticut's exclusion does not reach data generated for that purpose.

Conn. Gen. Stat. §§ 42-515 to 42-526 (Public Act 22-15, as amended) · Read the law's page

• Personal data that is made available through a government record or to the general public from widely distributed media, or that a controller or processor has a reasonable basis to believe the consumer has lawfully made available to the general public, falls outside the CTDPA's definition of personal data entirely, so scraping it does not by itself trigger the Act's duties, unless it is biometric data about a consumer collected by a business without the consumer's knowledge, or information the consumer provided on a public web site or online service while restricting it to a specific audience.
• If you meet the CTDPA's applicability thresholds (since July 1, 2026, the personal data of at least 35,000 consumers, any processing of consumers' sensitive data, or offering personal data for sale), personal data you collect that is not publicly available in the Act's own sense still triggers the Act's business obligations, including when it feeds AI training, and your privacy notice must state whether you collect, use or sell personal data to train large language models.
• Do not assume a court will read the reasonable-basis-to-believe standard broadly; no Connecticut case has tested it.

Conn. Gen. Stat. §§ 42-515, 42-524 · Read the law's page

• Confirm you conduct business in Connecticut, or produce a product or service targeted at Connecticut residents, and process or sell personal data before relying on CTDPA's scope in compliance planning.
• Reassess your applicability threshold against the 2026 amendments (S.B. 1295) rather than the original 2023 thresholds; secondary reporting describes a lower consumer-count trigger effective July 1, 2026.
• Do not sell a consumer's precise geolocation data, whether as a controller or as a third party.
• If you use facial recognition technology on your premises to prevent, detect or respond to security incidents, fraud or similar activity, use it only to match images against a database you maintain, and post signage at each entrance, other than an entrance to an area restricted to authorized employees, that links to your facial recognition technology policy.