Law / United States / 
Connecticut
Connecticut Data Privacy Act, de-identified and pseudonymous data
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To hold data as de-identified under the Connecticut Data Privacy Act, take reasonable measures to ensure that it cannot be associated with an individual (Conn. Gen. Stat. § 42-523(a)(1)).
- Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (Conn. Gen. Stat. § 42-523(a)(2)).
- Contractually obligate every recipient of the de-identified data to comply with all provisions of sections 42-515 to 42-525 (Conn. Gen. Stat. § 42-523(a)(3)).
- When you disclose pseudonymous or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (Conn. Gen. Stat. § 42-523(e)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 42-523 states no log or record duty. The oversight duty in subsection (e) names no record, fields or period.
- Kind
- None
- As of
What this law does
Section 42-515(16) defines de-identified data as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, if the controller that possesses it takes reasonable measures to ensure the data cannot be associated with an individual, publicly commits to process it only in a de-identified fashion and not attempt to re-identify it, and contractually obligates any recipients to satisfy those criteria.
Section 42-523(a) requires a controller in possession of de-identified data to take reasonable measures to ensure that the data cannot be associated with an individual, to publicly commit to maintaining and using it without attempting to re-identify it, and to contractually obligate any recipients to comply with all provisions of sections 42-515 to 42-525.
Under section 42-523(e), a controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with the contractual commitments to which the data is subject and must take appropriate steps to address any breaches of those commitments. Section 42-523(b)(1) provides that the Act does not require a controller or processor to re-identify de-identified data or pseudonymous data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .