Ten Percent and Rising: Connecticut Becomes Fifth U.S. State to Enact Privacy Law

On Tuesday, Connecticut became the fifth state to pass comprehensive privacy legislation when Governor Ned Lamont signed “An Act Concerning Personal Data Privacy and Online Monitoring” into law. Connecticut joins California, Virginia, Colorado, and Utah in enacting new privacy laws that take effect in 2023. Out of fifty states in the U.S., ten percent have now passed a comprehensive privacy law.

Effective July 1, 2023, the Connecticut law adopts a general framework of definitions, consumer rights, and compliance obligations based on concepts of data controller and data processor from the EU’s General Data Protection Regulation (GDPR), and the right to opt out of the “sale” of personal data as first articulated in the California Consumer Privacy Act (CCPA). Overall, the Connecticut law mirrors Colorado’s privacy law but then borrows select concepts from the California, Virginia, and Utah laws. The result is a hybrid of the pre-existing state laws, but not a law that introduces significant contradictions or unique compliance challenges.

The following are highlights of the Connecticut law:

• Applicability. Consistent with other state laws, Connecticut’s privacy law applies to companies that do business in Connecticut and meet certain thresholds. In order to apply, the company must process personal data of more than 100,000 Connecticut consumers, or process personal data of 25,000 Connecticut consumers but also derive a significant percentage of income from the “sale” of personal data – 25 percent. The law does not apply to non-profits.
• Federal Law Exemptions. Similar to other state laws, Connecticut exempts Covered Entities or Business Associates subject to HIPAA and Financial Institutions or data subject to the Gramm-Leach-Bliley Act. The law also exempts certain activities of consumer reporting agencies and furnishers and users of consumer reports where regulated by the Fair Credit Reporting Act.
• Employee and B2B Exceptions. Similar to the Colorado, Virginia, and Utah laws, the Connecticut law does not apply to personal data of employees or individuals acting in a commercial context. California’s employee and B2B contact data exemptions are set to sunset at the end of 2022, although legislation is pending to extend these exemptions.
• Opt-Out of Sale and Targeted Advertising. The Connecticut law provides a right to opt-out of the sale of personal data. The definition of a “sale” is “the exchange of personal data for monetary or other valuable consideration by the controller to a third party,” which is similar to the definition in the Colorado privacy law. The Connecticut law also provides for a right to opt-out of processing of personal data for purposes of targeted advertising. Similar to Colorado, “targeted advertising” is defined as “displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated internet web sites or online applications to predict such consumer’s preferences or interests.” The definition excludes targeting advertisements based on activities within a business’s own websites or apps.
• Consent for Sales and Targeted Advertising Involving Minors: For minors at least 13 years of age and younger than 16 years of age, a business may not process data for targeted advertising or sell the minor’s data without consent. The minor has a right to revoke consent in a manner that is “at least as easy as the mechanism by which the consumer provided the consumer’s consent.” This provision is similar to the California right to opt-in to the sale or sharing of a minor’s personal information.
• Consent to Process Sensitive Data. The Connecticut law requires consent to process sensitive data, similar to the Virginia and Colorado laws. The law defines sensitive data to include data revealing racial or ethnic origin, religious beliefs, mental or physical health conditions or diagnoses, sex life, sexual orientation, and citizenship and immigration status; genetic and biometric data that identifies an individual; and precise geolocation data. This definition is similar to the Virginia law; in contrast, the Colorado law does not include precise geolocation data within its definition of “sensitive data.”
• Children’s Data. Personal data collected from a known child is considered to be sensitive data. The Connecticut law requires processing this data in accordance with the federal Children’s Online Privacy Protection Act (COPPA).
• Consumer Rights. The Connecticut law provides consumers the right to access their personal data in a portable format, delete their personal data, and correct inaccuracies in their personal data.
• Contract Terms. The Connecticut law includes a laundry list of terms that must be added to contracts between controllers and processors. These terms, which overlap with contract requirements in the other state privacy laws, include instructions on processing data, duty of confidentiality, deletion at the end of provision of services, requiring a processor to provide evidence of compliance to a controller, the opportunity to object to sub-processors, and controller audit rights.
• Enforcement and Regulation. The Connecticut law does not include a private right of action or rulemaking process. There is a 60 day right to cure violations until Jan. 1, 2025. The law is the first to omit an express penalty per violation. Instead, a violation constitutes an unfair trade practice for purposes of Connecticut’s Consumer Protection Law, Section 42-110b. The Consumer Protection Law, in turn, grants the Connecticut Attorney General the right to seek injunctive relief and $5,000 statutory penalties only for willful misconduct.