Sends automated outreach, in Connecticut

Conn. Gen. Stat. 52-570c(b), (c), (d) · Read the law's page

• Before sending, or causing to be sent, unsolicited advertising material by electronic mail to an electronic mail address held by a Connecticut resident, identify in the message a toll-free telephone number or a valid return electronic mail address the recipient can use to unsubscribe, and begin the subject line with the letters ADV.
• Once a recipient notifies you that they do not wish to receive further such material, do not send, or cause to be sent, any further unsolicited advertising material to that recipient by electronic mail.
• These duties do not reach a message the recipient consented to receive, or a message to a recipient with whom you have a prior or existing business relationship formed by a voluntary two-way communication, with or without an exchange of consideration, arising from the recipient's own inquiry, application, purchase or use of your products or services.
• These duties do not apply to a tax-exempt nonprofit organization or to a political or candidate committee, candidate or solicitor.

Conn. Gen. Stat. sec. 42-471 · Read the law's page

• This binds any person in possession of another person's personal information (a Social Security number, driver's license or state identification card number, account number, credit or debit card number, passport number, alien registration number, health insurance identification number, or military identification information, combined with an identifier that associates it with the individual), except a state agency or political subdivision of the state.
• Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.
• If you collect Social Security numbers in the course of business, create a privacy protection policy, published or publicly displayed, that protects their confidentiality, prohibits their unlawful disclosure and limits access to them.
• A financial institution whose safeguards comply with the standards under Section 501(b) of the Gramm-Leach-Bliley Act is deemed compliant with this section.
• There is no private right of action for a violation of this section. The Department of Consumer Protection may impose a civil penalty of up to $5,000 per violation after an administrative hearing, and a violation is treated as an unfair trade practice enforceable by the state rather than by a private plaintiff.

Conn. Gen. Stat. sec. 42-471a · Read the law's page

• This binds each employer, other than an agency or political subdivision of the state, and applies to employment applications it obtains and retains.
• Obtain and retain employment applications in a secure manner.
• Employ reasonable measures to destroy or make unreadable employment applications upon disposal; at a minimum, shred them or otherwise permanently destroy them in a secure setting.

Conn. Gen. Stat. sec. 42-901 · Read the law's page

• This is a safe harbor from punitive damages, not a duty: it is available to a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, sued in tort for a failure to implement reasonable cybersecurity controls that resulted in a data breach.
• To claim it, have created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards for personal and restricted information, at the time of the breach, designed to protect the information's security, confidentiality and integrity and scaled to the entity's size, complexity, activities, the sensitivity of the information, and the cost and availability of security tools.
• The program must conform to the current version of a named framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000-series), or, for an entity already regulated under HIPAA, Gramm-Leach-Bliley Title V, FISMA or HITECH, conform to that regime, or comply with the PCI Data Security Standard together with another listed framework; conform to a revised version within six months of its publication.
• The safe harbor is unavailable where the failure to implement reasonable cybersecurity controls was the result of gross negligence or wilful or wanton conduct. It creates no duty to adopt a program of its own, does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief, and leaves undisturbed the class-action certification process and the state's breach-notification statute.

Conn. Gen. Stat. 42-284 to 42-289 · Read the law's page

• Do not make, or cause to be made, a telephonic sales call (a live-voice, automated-dialing, recorded-message, soundboard, over-the-top, text or media message call, but not electronic mail) to a consumer without the consumer's prior express written consent: a written agreement, signed by the consumer, that discloses the means of contact and the number to be contacted and clearly and conspicuously authorizes advertisements or telemarketing messages by those means.
• A telephonic sales call does not include a call or message answering the consumer's own request or inquiry (including about an item bought from you in the preceding twelve months), a nonprofit's call to its members, a polling or opinion call, a business-to-business contact, a call with the consumer's prior express written consent, a call primarily about an existing debt or contract, a call to an existing customer who has not asked you to stop, or a religious, charitable, political or other noncommercial call.
• Do not make a telephonic sales call for a marketing or sales solicitation to a consumer's mobile telephone number unless that number does not appear on the state's current quarterly “no sales solicitation calls” listing or you have the consumer's prior express written consent to call it.
• Limit a telephonic sales call to between nine a.m. and eight p.m. local time; within ten seconds after the call begins, disclose your identity, the purpose of the call and, if applicable, the entity you represent; ask at the outset whether the consumer wishes to continue, end the call or be removed from your list; and end the call within ten seconds of the consumer indicating a wish to end it.
• If a consumer asks not to receive future calls or to be removed from your list, confirm the removal, end the call within ten seconds, do not call that consumer again at any associated number, and do not give, sell or receive value for the consumer's name, telephone number or other personally identifying information.
• Do not install or use a device or service to circumvent a consumer's caller identification, and do not transmit inaccurate or misleading caller identification information.
• Calling a number on the National Do Not Call Registry, or a number that has asked a particular entity for no further calls, in violation of the federal Telephone Consumer Protection Act's rules or the Telemarketing Sales Rule, is also a violation of these sections.
• Do not knowingly, or while avoiding knowledge, provide substantial assistance or support that enables a person you know or avoid knowing is engaged in telemarketing fraud or a violation of these sections to initiate, originate, route or transmit a voice communication or telephonic sales call; this does not reach designing, manufacturing or distributing a component, product or technology with a commercially significant use beyond circumventing these rules, a provider offering general Internet access, or a terminating network provider completing a call.
• None of these duties, apart from the caller-identification rule, reaches a telecommunications company calling its own existing customer without charge about an existing debt, an existing contract, a federally authorized wireless emergency alert, or a prior customer-initiated service request.

Public Act 26-64, sections 17 to 19 · Read the law's page

• If you are a direct-to-consumer genetic testing company, at all times conduct your business consistently with the consumer's property right in, and exclusive control over, the biological sample and the genetic test results, including their collection, use, retention, maintenance, disclosure and destruction (sections 18 and 19(a)(1)).
• Before accepting any biological sample, genetic data or payment from a consumer, disclose your policies and procedures on the collection, use and disclosure of genetic data, and display a privacy notice in a prominent and publicly accessible place on your website covering collection, use, access, disclosure, transfer, security, retention and deletion of the consumer's data and the consumer's consent (section 19(a)(2) and (3)).
• Before collecting, using or disclosing a consumer's genetic data, obtain the consumer's express consent after disclosing your policies on use of the data, the identity of each person who may access the test results, including any vendor or service provider, and the manner in which you may disclose the data (section 19(a)(4)).
• Separately obtain the consumer's express consent before disclosing or transferring genetic data to any person other than your vendor or service provider, before using it for any purpose other than the primary purpose for which you offered testing, and before retaining the biological sample after the testing is complete (section 19(a)(5)).
• Obtain informed consent under 45 CFR 46 before disclosing or transferring genetic data to a third party for research, or for research you control that is for publication or generalizable knowledge (section 19(a)(6)).
• Do not disclose the results of genetic testing to anyone other than the consumer unless the consumer has expressly consented or the disclosure is to a person acting under a court order, warrant or subpoena (section 19(a)(7)).
• Do not disclose a consumer's genetic data to the consumer's employer, to a person who offers health, life or long-term care insurance coverage or who gives an insurer, health care center or fraternal benefit society data for underwriting or rating, or to a third party you know or reasonably should know intends to use it for marketing, including targeted advertising (section 19(a)(8)).
• Implement reasonable security measures to protect a consumer's biological sample and genetic data from unauthorized access, destruction, use, modification or disclosure (section 19(a)(9)).
• Implement a process for a consumer to access the consumer's genetic data, require you to delete it, require you to destroy the biological sample and confirm that you have, and revoke consent for use of the data for research by you or by any third party you gave it to (section 19(a)(10)).

Conn. Gen. Stat. 52-570c(a), (c), (d) · Read the law's page

• Do not use a machine that electronically transmits facsimiles through connection with a telephone network, or a device that automatically transmits a recorded telephone message, to transmit unsolicited advertising material or an unsolicited telephone message offering to sell goods or services.
• This duty does not apply to a tax-exempt nonprofit organization or to a political or candidate committee, candidate or solicitor.