Law / United States / 
Connecticut
Data brokers: registration application and no sale in violation of the act or the Connecticut Data Privacy Act
Public Act 26-64, sections 2(b), 2(c) and 3 (data broker application and sale limits)
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Disclosure, Prohibition
As of .
What it requires
- Apply to the Department of Consumer Protection, if you are a data broker that intends to sell or license brokered personal data in Connecticut, for an initial registration in the form and manner the commissioner prescribes, with an initial registration fee of $2,500, and renew it each year before it expires on December 31 with a renewal application and a $2,500 renewal fee (section 2(b)).
- Disclose in each application your name, mailing address, monitored email address and telephone number, your primary web site, a publicly accessible web page without dark patterns that details how a consumer may exercise the rights under section 42-518(a), whether you collect minors' personal data or precise geolocation or reproductive or sexual health data, the measures you take to keep personal data from being sold or licensed in violation of the act, and the extent to which you or a subsidiary is regulated under the Fair Credit Reporting Act, Title V of the Gramm-Leach-Bliley Act, section 38a-38 or the Health Insurance Portability and Accountability Act (HIPAA) rules (section 2(c)).
- Do not sell or license any personal data in violation of sections 1 to 10 of the act or sections 42-515 to 42-526 of the general statutes (section 3).
- If you are a registered data broker, establish a privacy policy that at a minimum includes measures to ensure you do not sell or license any personal data in violation of sections 1 to 10 of the act or sections 42-515 to 42-526 of the general statutes (section 3).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 10 of Public Act 26-64: after notice and a hearing under chapter 54, the Commissioner of Consumer Protection may impose a civil penalty of not more than $200 per day for each violation of any provision of sections 2 to 8 of the act, and the penalties go to the data broker registration account.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
Connecticut Commissioner of Consumer Protection, who after notice and a hearing under chapter 54 may impose a civil penalty for a violation of sections 2 to 8 of the act (section 10).
Settledness
- As of
What this law does
Under section 1 of Public Act 26-64, a data broker is any business, or portion of a business, that sells or licenses brokered personal data to another person. Under section 2(b) of Public Act 26-64, a data broker applies for registration with an initial fee of $2,500, the registration expires on December 31 of the year issued, and it may be renewed for successive one-year terms with a renewal fee of $2,500.
Under section 3 of Public Act 26-64, no data broker may sell or license personal data in violation of the act or sections 42-515 to 42-526 of the general statutes, and each registered data broker must establish a privacy policy with measures to ensure it does not. Section 3 of Public Act 26-64 takes effect on . Section 2 of Public Act 26-64 takes effect on .
Under section 4 of Public Act 26-64, the Commissioner of Consumer Protection must maintain a web page on the Department of Consumer Protection's web site that discloses, for each registered data broker, the information required under section 2(c) that was in its most recently approved application.
Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.
Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on .
When LexLint raises it
When your app profile says your app processes biometric data.