Law / United States / 
Connecticut
Data brokers: no sale or licensing of brokered personal data in Connecticut unless registered
Public Act 26-64, section 2(a) (data broker registration requirement)
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Prohibition
As of .
What it requires
- If you are a data broker, meaning a business that sells or licenses brokered personal data to another person, do not sell or license brokered personal data in Connecticut on or after unless you are actively registered with the Department of Consumer Protection (section 2(a)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 10 of Public Act 26-64: after notice and a hearing under chapter 54, the Commissioner of Consumer Protection may impose a civil penalty of not more than $200 per day for each violation of any provision of sections 2 to 8 of the act, and the penalties go to the data broker registration account.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
Connecticut Commissioner of Consumer Protection, who after notice and a hearing under chapter 54 may impose a civil penalty for a violation of sections 2 to 8 of the act (section 10).
Settledness
- As of
What this law does
Under section 1 of Public Act 26-64, a data broker is any business, or portion of a business, that sells or licenses brokered personal data to another person. Section 2 of Public Act 26-64 takes effect on , and under section 2(a) no data broker may sell or license brokered personal data in Connecticut on or after unless it is actively registered with the Department of Consumer Protection.
Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.
Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on .
When LexLint raises it
When your app profile says your app processes biometric data.