Law / United States / 
Connecticut
Data brokers: accessible deletion mechanism, deletion of verified requests and no later reacquisition
Public Act 26-64, section 5(c) (data broker deletion requests)
A data brokers rule binding private bodies.
- Obligation class
- Data subject rights, Retention
As of .
What it requires
- If you are a registered data broker, access the accessible deletion mechanism at least once every forty-five days to examine each deletion request or update and determine whether you and your data service providers are specifically excluded (section 5(c)(1)).
- For each verified deletion request or update that does not exclude you, delete any personal data you maintain about the participating consumer and direct your data service providers to do the same, subject to the exceptions in section 5(c)(5) (section 5(c)(1)(B)(i)).
- For each unverified deletion request or update that does not exclude you, retain the personal data and process the request, and direct your data service providers to process it, as an exercise of the consumer's right under section 42-518(a)(5)(B) (section 5(c)(1)(B)(ii)).
- At least once every forty-five days after first deleting a participating consumer's data, repeat the deletion unless a verified update excludes you and your data service providers (section 5(c)(2)).
- Do not maintain, use or disclose any personal data you or a data service provider subsequently acquires about a participating consumer whose data you deleted, except as section 5(c)(5) permits (section 5(c)(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 10 of Public Act 26-64: after notice and a hearing under chapter 54, the Commissioner of Consumer Protection may impose a civil penalty of not more than $200 per day for each violation of any provision of sections 2 to 8 of the act, and the penalties go to the data broker registration account.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
Connecticut Commissioner of Consumer Protection, who after notice and a hearing under chapter 54 may impose a civil penalty for a violation of sections 2 to 8 of the act (section 10).
Settledness
- As of
What this law does
Under section 5(a) of Public Act 26-64, the Commissioner of Consumer Protection must establish, not later than , an accessible deletion mechanism program through which a consumer can submit a deletion request to all registered data brokers. Under section 5(c) of Public Act 26-64, on and after each registered data broker must access the accessible deletion mechanism at least once every forty-five days to examine each deletion request or update.
Under section 5(c)(1)(B)(i) of Public Act 26-64, for each verified deletion request that does not exclude it, a registered data broker must delete the personal data it maintains about the participating consumer and direct its data service providers to delete that data.
Under section 5(c)(4) of Public Act 26-64, a registered data broker that deletes a participating consumer's data, and its data service providers, may not maintain, use or disclose personal data they subsequently acquire about the consumer, except as the exceptions in section 5(c)(5) permit.
Under section 5(c)(5) of Public Act 26-64, a registered data broker need not delete a participating consumer's personal data to the extent maintaining it is reasonably necessary for a purpose the paragraph lists, the first being compliance with federal, state or municipal law.
Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.
Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on .
When LexLint raises it
When your app profile says your app processes biometric data.