Law / United States / 
Connecticut
Requirements for state contractors who receive confidential information, breach notice and breach report
Conn. Gen. Stat. sec. 4e-70(b)(6), (b)(8), (e) and (f)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Reporting
As of .
What it requires
- This binds a contractor, an individual, business or other entity that receives confidential information from a state agency under a written agreement to provide goods or services to the state. The statute requires each such written agreement to carry the duties below.
- Notify the state contracting agency and the Attorney General as soon as practical after you become aware of or have reason to believe that any confidential information you possess or control has been subject to a confidential information breach.
- Submit to the office of the Attorney General and the state contracting agency, on the timetable your agreement sets, either a report detailing the breach or suspected breach, including a plan to mitigate its effects and the steps taken to ensure future breaches do not occur, or a report detailing why, upon further investigation, you believe no breach has occurred.
- Your written agreement must include a proposed timetable for submitting that report and must specify how the cost of any notification about, or investigation into, a confidential information breach is to be apportioned when the state contracting agency or the contractor is the subject of the breach.
- Where notice is delayed at the state contracting agency's sole discretion, or because a law enforcement or intelligence agency tells you that notice would impede a criminal investigation or jeopardize homeland or national security, give notification to the state contracting agency as soon as reasonably feasible.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Attorney General may investigate any violation of the section and bring a civil action in the superior court for the judicial district of Hartford, in the name of the state, against a contractor that has violated it (subsection (g)).
What this law does
A confidential information breach includes an instance in which an unauthorized person or entity accesses confidential information that is subject to or otherwise used in conjunction with any part of a written agreement with a state contracting agency.
A contractor must notify the state contracting agency and the Attorney General as soon as practical after the contractor becomes aware of or has reason to believe that any confidential information that the contractor possesses or controls has been subject to a confidential information breach.
A contractor must also submit to the office of the Attorney General and the state contracting agency either a report detailing the breach or suspected breach, including a plan to mitigate the effects of any breach and specifying the steps taken to ensure future breaches do not occur, or a report detailing why, upon further investigation, the contractor believes no breach has occurred. Each such written agreement must include a proposed timetable for submittal of that report.
Each such written agreement must also specify how the cost of any notification about, or investigation into, a confidential information breach is to be apportioned when the state contracting agency or contractor is the subject of such a breach. If notice is delayed, the contractor must give notification to the applicable state contracting agency as soon as reasonably feasible. The section took effect on .