Law / United States / 
Connecticut
Data brokers: annual public statement on deletion requests
Public Act 26-64, section 6 (data broker annual statement)
A data brokers rule binding private bodies.
- Obligation class
- Disclosure, Reporting
As of .
What it requires
- If you were a registered data broker during the preceding calendar year, post on a publicly accessible web page on your primary web site, in the form and manner the commissioner prescribes, a statement disclosing the total number of deletion requests you accessed that did not exclude you, the number you answered by deleting, retaining, or deleting and retaining personal data, and for retention the number retained under the section 5(c)(5) exceptions or the section 7 exemptions (section 6).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 10 of Public Act 26-64: after notice and a hearing under chapter 54, the Commissioner of Consumer Protection may impose a civil penalty of not more than $200 per day for each violation of any provision of sections 2 to 8 of the act, and the penalties go to the data broker registration account.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
Connecticut Commissioner of Consumer Protection, who after notice and a hearing under chapter 54 may impose a civil penalty for a violation of sections 2 to 8 of the act (section 10).
Settledness
- As of
What this law does
Under section 6 of Public Act 26-64, not later than and annually after that, each business that was a registered data broker during the preceding calendar year must post a statement on its primary web site disclosing the number of deletion requests it accessed and how it responded.
Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.
Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on .
When LexLint raises it
When your app profile says your app processes biometric data.