Law / United States / 
Connecticut
Data brokers: triennial independent audit of deletion compliance
Public Act 26-64, section 5(d) (data broker audit)
A data brokers rule binding private bodies.
- Obligation class
- Governance, Reporting
As of .
What it requires
- If you are a registered data broker, not later than and every three years after, retain an independent auditor at your expense to audit your books for compliance with section 5(c), prepare an audit report disclosing the results, and submit it and its materials to you (section 5(d)(1)(A)).
- Maintain each audit report and its materials for at least six years from the date they are submitted to you (section 5(d)(1)(B)).
- Submit an audit report and its materials to the Department of Consumer Protection, in the form and manner the commissioner prescribes, not later than five business days after the department notifies you that it requires them (section 5(d)(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 10 of Public Act 26-64: after notice and a hearing under chapter 54, the Commissioner of Consumer Protection may impose a civil penalty of not more than $200 per day for each violation of any provision of sections 2 to 8 of the act, and the penalties go to the data broker registration account.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
Connecticut Commissioner of Consumer Protection, who after notice and a hearing under chapter 54 may impose a civil penalty for a violation of sections 2 to 8 of the act (section 10).
Settledness
- As of
What this law does
Under section 5(d)(1) of Public Act 26-64, not later than and triennially after that, each registered data broker must at its own expense retain an independent auditor to audit its compliance with the deletion duties in section 5(c), have the auditor prepare a report, and keep each report for at least six years.
Under section 5(d)(2) of Public Act 26-64, a registered data broker must submit an audit report to the Department of Consumer Protection not later than five business days after the department notifies it that the department requires the report.
Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.
Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on .
When LexLint raises it
When your app profile says your app processes biometric data.