Law / United States / 
Connecticut
Breach of security re computerized data containing personal information
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify each affected Connecticut resident of a breach of security involving personal information without unreasonable delay and no later than 60 days after discovery, unless federal law requires a shorter time.
- Notify the Connecticut Attorney General of the breach not later than the time when you notify affected residents (section 36a-701b(b)(2)(A)).
- Treat a failure to comply with section 36a-701b as an unfair trade practice for purposes of section 42-110b, enforced by the Attorney General.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Connecticut (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Because a breach-notice violation is enforced as an unfair trade practice under Conn. Gen. Stat. sec. 42-110b, the Attorney General may petition to recover, on the state's behalf, a civil penalty of up to $5,000 per wilful violation under CUTPA's general civil-penalty provision (sec. 42-110o(b)); the Commissioner of Consumer Protection may separately impose a civil penalty up to the same amount, or order restitution below $10,000, after an administrative hearing (sec. 42-110d).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Connecticut Attorney General; a failure to comply is deemed an unfair trade practice for purposes of sec. 42-110b and is enforced by the Attorney General (sec. 36a-701b(j)).
Settledness
- As of
- Guidance link
- https://portal.ct.gov/ag/sections/privacy/reporting-a-data-breach
- Guidance body
- Office of the Attorney General of Connecticut
- Open questions
- Does the statement in Conn. Gen. Stat. § 36a-701b(j) that a failure to give breach notice "shall be enforced by the Attorney General" bar a private damages action under section 42-110g(a) for a breach-notice violation, or does CUTPA's own private-action provision still apply?
What it makes you log
Logging duty
The duty is to notify: affected Connecticut residents without unreasonable delay and within sixty days of discovery, the Attorney General no later than the resident notice, and the owner or licensee where the person only maintains the data. No clause tells the person to document a breach, keep a record of it or keep the reasonable determination that harm is unlikely. The substitute-notice route has the person demonstrate its cost or contact-information problem in the notice it sends the Attorney General, which is a filing. A person that keeps its own security breach procedures as part of an information security policy is deemed compliant if it follows the timing and notice rules; a written policy states rules and is not a record. Investigative-demand material the Attorney General receives is exempt from public disclosure (subsection (i)), which is a rule about the regulator's file.
- Kind
- None
- As of
What this law does
A person who owns, licenses, or maintains computerized data including personal information must notify each affected Connecticut resident of a breach without unreasonable delay, and no later than 60 days after discovery unless federal law requires a shorter time. 'Personal information' excludes publicly available information lawfully made available to the general public from government records or widely distributed media.
This breach-notification section deems a failure to comply an unfair trade practice for purposes of section 42-110b and provides that it shall be enforced by the Attorney General; it grants no cause of action to a private person of its own. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .