Highlights

Covered Entities: Any "person" or entity who owns, licenses, or maintains computerized data.

Consumer Notification: Notification must be provided to any Connecticut resident whose personal information was breached or is reasonably believed to have been breached.

Regulatory Notification: Notification must be provided to the Connecticut Attorney General not later than the time when notice is provided to a Connecticut resident.

Notification Timeline: Notification must be provided “without unreasonable delay but not later than 60 days after the discovery of such breach, unless a shorter time is required under federal law.” 

Data Format: Electronic.

Citations: Conn. Gen. Stat. § 36a-701b

More Details

Definitions:

• Breach: Unauthorized access to or unauthorized acquisition of electronic files, media, databases, or computerized data, containing personal information.
• Personal Information (PI):
  • First name or first initial and last name in combination with any one, or more, of the following data:
    • Social Security number;
    • Taxpayer identification number;
    • Identity protection personal identification number issued by the Internal Revenue Service;
    • Driver's license number, state identification card number, passport number, military identification number or other identification number issued by the government that is commonly used to verify identity;
    • Credit or debit card number;
    • Financial account number in combination with any required security code, access code or password that would permit access to such financial account;
    • Medical information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;
    • Health insurance policy number or subscriber identification number, or any unique identifier used by a health insurer to identify the individual; or
    • Biometric information consisting of data generated by electronic measurements of an individual's unique physical characteristics used to authenticate or ascertain the individual's identity, such as a fingerprint, voice print, retina, or iris image.
  • A username or electronic mail address, in combination with a password or security question and answer that would permit access to an online account.
• Medical Information:
  • Medical information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional
• Health Insurance Information: Health insurance policy number or subscriber identification number, or any unique identifier used by a health insurer to identify the individual

Safe Harbors:

• Encryption: Notification is not required where the potentially impacted PI was secured by encryption or by any other method or technology that renders the personal information unreadable or unusable.
• Good Faith: N/A
• Risk of Harm: Notification is not required if, after an appropriate investigation, the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired or accessed.
• Law Enforcement Delay: Notification may be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed. Any such delayed notification shall be made after such law enforcement agency determines that notification will not compromise the criminal investigation and so notifies the person of such determination.
• Public Record: “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.

Direct Notice:

• Timing: Notification must be provided “without unreasonable delay but not later than 60 days after the discovery of such breach, unless a shorter time is required under federal law.”
• Format: N/A
• Content: The notification shall offer to each resident whose Social Security number or taxpayer identification number was breached or is reasonably believed to have been breached at least 24 months of appropriate identity theft prevention services and, if applicable, identity theft mitigation services. Such service or services shall be provided at no cost to such resident for a period of not less than 24 months. The notice must provide all information necessary for such resident to enroll in such service or services and shall include information on how such resident can place a credit freeze on such resident's credit file.
• Method: Notification may be done via 1) written notice; (2) telephone notice; or (3) electronic notice, provided such notice is consistent with the ESIGN Act. In the event of a breach of login credentials, notice may be provided in electronic or other form that directs the resident whose personal information was breached or is reasonably believed to have been breached to promptly change any password or security question and answer, as applicable, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same username or electronic mail address and password or security question and answer.

Substitute Notice:

An entity may provide substitute notice, provided such entity demonstrates that the cost of providing notice would exceed $250,000 that the affected class of subject persons to be notified exceeds 500,000 persons or that the entity does not have sufficient contact information. Substitute notice shall consist of the following:

• Electronic mail notice when the person has an electronic mail address for the affected persons;
• Conspicuous posting of the notice on the web site of the person if the person maintains one; and
• Notification to major state-wide media, including newspapers, radio, and television.

Remediation Services:

The notification shall offer to each resident whose Social Security number or taxpayer identification number was breached or is reasonably believed to have been breached appropriate identity theft prevention services and, if applicable, identity theft mitigation services. Such service or services shall be provided at no cost to such resident for a period of not less than 24 months.

Regulatory Notice:

Notification must be provided to the Connecticut Attorney General not later than the time when notice is provided to a Connecticut resident. 

Credit Reporting Agencies Notice:

N/A

Third-Party Notice:

Any entity that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably believed to have been breached.

HIPAA:

Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act (“HITECH”) shall be deemed to be in compliance, provided that (1) any person required to provide notification to Connecticut residents pursuant to HITECH shall also provide notice to the Attorney General not later than the time when notice is provided to such residents if notification to the Attorney General would otherwise be required, and (2) the person otherwise complies with applicable requirements.

Private Action:

N/A

Associated Regulations:

• Information Security Standard (Conn. Gen. Stat. § 42-471)
• Insurance Data Security (Conn. Gen. Stat. Ann. § 38a-38)
• Connecticut Consumer Data Privacy Act (Conn. Gen. Stat. Ann. §§ 42-515 to 42-525)

Connecticut Personal Data Privacy and Online Monitoring Act (CTDPA)

Conn. Gen. Stat. Ann. §§ 42-515 to 42-525

Highlights

Applicability:

Persons that conduct business in Connecticut or produce products or services targeted to Connecticut residents and, during the preceding calendar year, controlled or processed personal data of either:

• 35,000 or more consumers, excluding personal data processed or controlled solely for completing a payment transaction; or
• Controlled or processed consumers’ sensitive data, excluding personal data controlled or processed solely for completing a payment transaction; or
• Offered consumers’ personal data for sale in trade or commerce.

Among other exclusions, the CTDPA does not apply to the following entities or related personal data:

Nonprofit organizations, state government agencies (and persons processing consumer health data on the agencies’ behalf, under contract), candidate committees, national committees, party committees, or political committees, higher education institutions, national securities associations registered under the Securities Exchange Act, banks, Connecticut credit unions, federal credit unions, out-of-state banks, out-of-state credit unions, and any affiliate or subsidiary thereof; agents, broker-dealers, investment advisers, and investment advisor agents, financial institutions subject to the Gramm-Leach-Bliley Act, entities or data regulated by HIPPA, covered entities or business associates, tribal nation government organizations, air carriers, insurers, insurer affiliates, fraternal benefit societies, health carriers, insurance-support organizations, insurance agents, and insurance producers, and relevant entities in compliance with parental consent requirements under COPPA.

Entity Obligations:

Controllers. The CTDPA's controller duties include the following obligations:

• Of transparency (i.e., a privacy notice).
  • Including a reasonably accessible, clear, and meaningful privacy notice that discloses categories of personal data processed, purposes for processing, how consumers may exercise rights and appeal, categories of personal data shared with third parties, categories of third parties with whom personal data is shared, and an active email address or other online mechanism for contacting the controller.
  • Beginning July 1, 2026, if a controller trains a large language model on a consumer’s personal data, the controller must disclose that fact in the privacy notice and provide a detailed description of the categories of personal data used for training.
• Of data minimization.
  • Including limiting the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer.
• Of purpose specification and limitation.
• To limit personal data use to purposes reasonably necessary to or compatible with the disclosed processing purpose unless the consumer consents to the secondary use.
• To use reasonable data security to protect the personal data's confidentiality, integrity, and accessibility.
• To obtain the consumer's consent before processing their sensitive data; and for consumers aged 13, 14, or 15, before selling their personal data or using it for targeted advertising.
• To process children's sensitive data consistent with COPPA.
• To avoid unlawful discrimination when processing personal data.
• To provide equivalent and effective mechanisms for consumers to exercise their rights to revoke and grant consent, including a clear and conspicuous link on the controller's internet web site providing an opt-out link, and describe those mechanisms in a privacy notice. In establishing those mechanisms, the controller must consider the consumer’s normal interactions, the need for secure and reliable communication of such requests, and the ability of the controller to verify the consumer’s identity.
• To recognize universal opt-out preference signals (“OOPS”) indicating a consumer’s intent to opt out of targeted advertising and sales of personal data³.
• To not discriminate (retaliate) when a consumer exercises rights, including by denying goods or services, charging different prices or rates, or providing a different level of quality, except as part of a voluntary, bona fide loyalty-type program.
• To ensure employees or contractors are under a contractual or statutory duty of confidentiality before granting access to consumer health data.
• To obtain the consumer's consent before collecting, sharing, selling or offering to sell their health data.
• To not use geofencing to create a virtual boundary within 1,750 feet of any mental health or reproductive or sexual health facility to: identify or track consumers seeking healthcare services; collect a consumer's data or sell it without consent; or send consumers health data or healthcare service-related notifications, messages, or advertisements.⁴
• To enter into contracts with processors that:
  
  • Provide processing instructions.
  • Describe the nature and purpose of processing, the types of Personal Data processed, and the duration of processing.
  • Describe the rights and obligations of both parties.
  • Require the processor to:
    
    • Ensure the duty of confidentiality;
    • Return or destroy all personal data when the services end, at the controller's direction, unless the law requires retention;
    • Make available all information necessary to demonstrate compliance with its data protection obligations, on the controller's reasonable request;
    • Provide the controller with an opportunity to object before engaging a subcontractor under a written contract that requires it to meet the Processor's data protection obligations; and
    • Allow and cooperate with reasonable assessments of the Processor's policies and technical and organizational measures supporting its data protection obligations.
• To conduct a Data Protection Assessment (DPA) before conducting processing activities that present a heightened risk of consumer harm⁵, including the following:
  
  • Targeted advertising;
  • Selling personal data;
  • Profiling that presents a reasonably foreseeable risk of: unfair or deceptive treatment of or unlawful disparate impact on consumers; financial, physical, or reputational injury to consumers; a physical or other intrusion on consumers' solitude, seclusion, private affairs, or private concerns, if it would offend a reasonable person; or another substantial consumer injury; and
  • Processing sensitive data.
  • Beginning July 1, 2026, processing personal data for a material new purpose that presents a heightened risk of harm to consumers.
  • Beginning August 1, 2026, controllers must also conduct a DPA before processing personal data for purposes of profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.

Processors. The CTDPA's Processor duties include obligations to:

• To adhere to the controller's instructions.
• To help the controller meet its obligations, considering the nature of the processing and available information, including the controller's obligations to:
  
  • Respond to consumer rights requests;
  • Comply with data security and breach notification requirements; and
  • Conduct data protection assessments.
• To ensure each person processing personal data is under a duty of confidentiality.
• To delete or return all personal data to the controller, upon request, at the end of the provision of services, unless retention of the personal data is required by law.
• To only engage subcontractors after:
  
  • Giving the controller a chance to object; and
  • Executing a written contract requiring the subcontractor to meet the same personal data obligations as the processor.
• To implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, considering the processing context and the Processor's role.
• To execute written processing agreements with specific terms.
• To make available to the controller all information necessary to demonstrate the processor’s compliance with its obligations.
• To allow, and cooperate with, reasonable assessments by the controller or the controller’s designated assessor, or alternatively arrange for an independent qualified assessor to assess the processor’s policies and technical and organizational measures.

Consumer Rights:

A controller must provide a response, without undue delay and within 45 days, to a consumer request regarding the controller's processing of, consumer personal data, and in compliance with the consumer's rights, including but not limited to the following:

• Right to confirm whether the controller is processing their personal data;
• Right to access the personal data, including personal data that the controller used to make, or derive a data point used to make, a covered automated profiling decision concerning the consumer;
• Right to correct inaccuracies in the personal data, taking into account the nature of the personal data and the purposes of processing;
• Right to delete the personal data provided by, or obtained about, the consumer;
• Right to obtain a copy of the personal data in a format that is generally portable, readily usable, and transmittable format that allows the consumer to transmit the data to another controller without hindrance; and
• Right to opt out of processing of personal data for the purposes of (1) targeted advertising; (2) the sale of personal data; or (3) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
• Beginning July 1, 2026, right to obtain a list of the specific third parties to which the controller has sold the consumer’s personal data.
• Beginning July 1, 2026, rights related to covered automated profiling decisions, including the right to question the result of the decision, be informed of the reason the profiling resulted in the decision, review the personal data used in the profiling, and, if the decision was based on inaccurate personal data, correct the data and request reevaluation.
• A controller may extend the 45-day response period once by an additional 45 days when reasonably necessary, taking into account the complexity and number of requests, if the controller informs the consumer of the extension within the initial 45-day response period and provides the reason for the extension.
• If the controller declines to take action on a consumer request, the controller must inform the consumer without undue delay and within 45 days after receiving the request, provide the reasons for not taking action, and provide instructions for how to appeal the decision.

Additionally, a controller must establish a process for a consumer to appeal to the controller’s refusal to take action on a request and make the appeal process conspicuously available. A controller must take action within sixty (60) days of receipt of an appeal, inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions, as well as provide a mechanism for consumers to contact the Attorney General if the appeal is denied.

A consumer may designate an authorized agent to exercise the consumer’s opt-out rights on the consumer’s behalf, including through a technology indicating the consumer’s intent to opt out, such as an internet link, browser setting, browser extension, global device setting, or other similar technology.

A controller must comply with an opt-out request received through an opt-out preference signal that meets the CTDPA’s requirements.

More Details

Definitions:

• Biometric data: Data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises or other unique biological patterns or characteristics that are used to identify a specific individual. "Biometric data" does not include (A) a digital or physical photograph, (B) an audio or video recording, or (C) any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific individual.
• Covered Automated Profiling Decision: Covered automated profiling decision: A decision that produces a legal or similarly significant effect concerning a consumer and is made by the controller solely through profiling.
• Consumer: A resident of Connecticut acting in an individual or household context. "Consumer" does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit or government agency whose communications or transactions with the controller occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit or government agency.
• Consumer health data: Any personal data that a controller uses to identify a consumer's physical or mental health condition or diagnosis, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.
• Consumer health data Controller: Any controller that, alone or jointly with others, determines the purpose and means of processing consumer health data.
• Controller: A person that, alone or jointly with others, determines the purposes and means for processing personal data.
• Gender-affirming health data: Any personal data concerning an effort made by a consumer to seek, or a consumer's receipt of, gender-affirming health care services.
• Minor: Any personal data concerning an effort made by a consumer to seek, or a consumer's receipt of, gender-affirming health care services.
• Neural Data: Information that is generated by measuring the activity of a consumer’s central or peripheral nervous system and that can be processed by or with assistance of a device.
• Personal data: Information linked to or reasonably linkable to an identified or identifiable individual. Personal data excludes: de-identified data and publicly available data (defined as information that is lawfully made available from federal, state, or municipal government records, or widely distributed media; and information that a controller has a reasonable basis to believe the consumer has lawfully made available to the general public).
• Profiling: Any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Reproductive or sexual health care: Any health care-related services or products rendered or provided concerning a consumer's reproductive system or sexual well-being, including, but not limited to, any such service or product rendered or provided concerning (A) an individual health condition, status, disease, diagnosis, diagnostic test or treatment, (B) a social, psychological, behavioral or medical intervention, (C) a surgery or procedure, including, but not limited to, an abortion, (D) a use or purchase of a medication, including, but not limited to, a medication used or purchased for the purposes of an abortion, (E) a bodily function, vital sign or symptom, (F) a measurement of a bodily function, vital sign or symptom, or (G) an abortion, including, but not limited to, medical or nonmedical services, products, diagnostics, counseling or follow-up services for an abortion.
• Reproductive or sexual health data: Any personal data concerning an effort made by a consumer to seek, or a consumer's receipt of, reproductive or sexual health care.
• Sale of personal data: The exchange of personal data for monetary or other valuable consideration by the controller to a third party. “Sale” does not include (A) the disclosure of personal data to a processor that processes the personal data on behalf of the controller, (B) the disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer, (C) the disclosure or transfer of personal data to an affiliate of the controller, (D) the disclosure of personal data where the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party, (E) the disclosure of personal data that the consumer (i) intentionally made available to the general public via a channel of mass media, and (ii) did not restrict to a specific audience, or (F) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction, or a proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes control of all or part of the controller's assets.
• Sensitive personal data: Personal data revealing: racial or ethnic origin, religious beliefs, mental/physical health condition or diagnosis, sex life/sexual orientation, or citizenship/citizenship status, as well as consumer health data (meaning personal data used to identify a consumer's physical or mental health condition or diagnosis, including gender-affirming health data and reproductive or sexual health data), genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child, data concerning an individual’s status as a crime victim, or precise geolocation data. Beginning July 1, 2026, sensitive data also includes a consumer’s Social Security number, driver’s license number, state identification card number, passport number, financial account number in combination with any required access code or password, and neural data.
• Targeted Advertising: Displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated internet websites or online applications to predict the consumer’s preferences or interests. Targeted advertising does not include advertisements based on activities within a controller’s own websites or online applications, the context of a consumer’s current search query or visit, a consumer’s request for information or feedback, or measuring or reporting advertising performance.
• Third Party: An individual or legal entity that is not the consumer, controller, processor, or affiliate of the controller or processor.

Penalties:

Violations of the CTDPA constitute an unfair trade practice and may be enforced solely by the Connecticut Attorney General. Initial violations may result in an injunction, an order directing restitution, or both, along with reasonable attorneys' fees. Willful violations may result in a civil penalty of up to $5,000 per violation. Beginning on January 1, 2026, the Attorney General may, in the Attorney General's discretion, provide to a controller or processor an opportunity to cure any alleged violation.

Private Action:

No

Enforcement Action

In July 2025, the Connecticut Attorney General announced an $85,000 settlement with TicketNetwork, Inc. for alleged CTDPA violations involving privacy notice deficiencies and consumer rights mechanisms that were misconfigured or inoperable.

Associated Regulations & Rulemakings:

• An Act Concerning Online Privacy, Data And Safety Protections, P.A. 23-56
• An Act Concerning Data Privacy Breaches, P.A. 25-133

Note on AI Related Regulations:

The CTDPA is not a standalone AI law, but it includes AI-adjacent obligations related to automated profiling, large language model training, neural data, sensitive data, and data protection assessments.

Beginning July 1, 2026, controllers must disclose in their privacy notices whether they train large language models on consumers’ personal data and provide a detailed description of the categories of personal data used for that training.

Beginning July 1, 2026, consumers have additional rights related to covered automated profiling decisions, including the right to question the result of the decision, be informed of the reason the profiling resulted in the decision, review the personal data used in the profiling, correct inaccurate personal data, and request reevaluation where the decision was based on inaccurate personal data.

Beginning August 1, 2026, controllers must conduct data protection assessments before processing personal data for profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer.

P.A. 25-113 also adds “neural data” as a defined category of sensitive personal data, which may be relevant for AI systems or devices that process nervous-system activity data.

Effective Date:

July 1, 2023, Certain consumer health data provisions became effective July 1, 2023; additional online privacy, minor, and social media provisions took effect July 1, 2024; and P.A. 25-113 amendments generally take effect July 1, 2026, with certain automated profiling assessment provisions beginning August 1, 2026.

³Effective January 1, 2025.

⁴See PA 23-56.

⁵The DPA requirement applies to activities that occur after July 1, 2023 and is not retroactive. See (Conn. Gen. Stat. Ann. § 42-522(f)).

Highlights

Covered Entities: Any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, pursuant to the insurance laws of Connecticut, but not including a purchasing group or risk retention group chartered and licensed in another state, a person acting as an assuming insurer and domiciled in another state or jurisdiction or a commissioner of the Connecticut Superior Court acting as a title agent.

Security Standard: Each licensee shall develop, implement and maintain a comprehensive written information security program that is based on the licensee's risk assessment and contains the administrative, technical and physical safeguards for the protection of nonpublic information and such licensee's information systems. Each information security program shall be commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including, but not limited to, such licensee's use of third-party service providers, and the sensitivity of the nonpublic information used by such licensee or in such licensee's possession, custody or control.

Consumer Notification: A licensee shall comply with all applicable provisions of section 36a-701b and provide to the Insurance Commissioner a copy of the notice that such licensee sends to consumers pursuant to said section, if any, if such licensee is required to notify the commissioner.

Regulatory Notification: A licensee shall notify the Commissioner of Insurance as promptly as possible, but in no event later than 3 business days from a determination that a cybersecurity event involving nonpublic information that is in the possession of a licensee has occurred, when either of the criteria referenced below has been met.

Notification Timeline: As promptly as possible, no later than 3 business days from a determination that a cybersecurity event involving nonpublic information that is in the possession of a licensee has occurred.

Citations: Conn. Gen. Stat. Ann. § 38a-38

More Details

Definitions:

• Consumer: An individual, including, but not limited to, an applicant, beneficiary, certificate holder, claimant, insured or policyholder, who is a resident of this state and whose nonpublic information is in a licensee's possession, custody or control.
• Cybersecurity Event: An event resulting in any unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored thereon, except if: the event involves the unauthorized acquisition of encrypted nonpublic information if the encryption process for such information or encryption key to such information is not acquired, released or used without authorization; or the event involves access of nonpublic information by an unauthorized person and the licensee determines that such information has not been used or released and has been returned or destroyed.
• Licensee: Any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, pursuant to the insurance laws of this state, including, but not limited to, a fraternal benefit society, an interlocal risk management agency formed pursuant to chapter 113a or an employers' mutual association authorized under part C of chapter 568, but not including a purchasing group or risk retention group chartered and licensed in another state, a person acting as an assuming insurer and domiciled in another state or jurisdiction or a commissioner of the Superior Court acting as a title agent, as defined in section 38a-402.
• Nonpublic Information: Electronic data and information, other than publicly available information and a consumer's age or gender, that:
  
  • Concerns the business of a licensee and that, if accessed, disclosed, tampered with or used without authorization from the licensee, would have a material adverse impact on the business, operations or security of such licensee;
  • Concerns a consumer and that, because such data or information contains a name, number, personal mark or other identifier, can be used to identify such consumer in combination with:
    
    • Social Security number;
    • Driver’s license number or nondriver identification card number;
    • an account, credit or debit card number;
    • Security code, access code, or password that would permit access to a consumer’s financial account; or
    • Biometric records; or
  • Is in a form or medium created by, or derived from, a health care provider or consumer and concerns:
    
    • The past, present, or future physical, mental, or behavioral health or condition of a consumer or a member of the consumer’s family;
    • The provision of health care to any consumer; or
    • Payment for the provision of health care to any consumer.

Regulatory Notice:

Each licensee shall notify the Insurance Commissioner that a cybersecurity event has occurred, as promptly as possible but in no event later than 3 business days after the date on which such licensee first determines that a cybersecurity event has occurred, if:

• Connecticut is the state of domicile of the licensee, in the case of an insurer, or the home state of the licensee, in the case of a producer, as those terms are defined in CT Code § 38a-702a, and the cybersecurity event has a reasonable likelihood of materially harming a consumer residing in Connecticut or a material part of licensee’s operations.
• The licensee reasonably believes that the nonpublic information involves 250 or more consumers residing in Connecticut and the cybersecurity event is either:
  
  • A cybersecurity event impacting the licensee that the licensee is required to notify any government body, self-regulatory agency, or any other supervisory body about pursuant to any state or federal law; or
  • A cybersecurity event that has a reasonable likelihood of materially harming either a consumer residing in Connecticut or a material part of licensee’s operations.

Content Requirements:

When notifying the Commissioner of Insurance of a cybersecurity event, a licensee shall provide to the commissioner, in an electronic form prescribed by the commissioner, as much of the following information as possible (and shall have a continuing obligation to update and supplement such notice):

• The date of the cybersecurity event.
• A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of any third-party service providers.
• How, and the date on which, the cybersecurity event was discovered.
• Whether any lost, stolen, or breached information has been recovered and if so, how this was done.
• The identity of the source of the cybersecurity event.
• Whether the licensee has filed a police report or notified any regulatory, government, or law enforcement agency and, if so, when such licensee filed such report or provided such notice.
• A description of the specific types of exposed, lost, stolen, or breached information. Including for example, specific types of medical information, financial information or information allowing identification of the consumer.
• The period during which each information system was compromised by the cybersecurity event was compromised by such cybersecurity event.
• The number of total consumers residing in this state that, within such licensee's knowledge at the time that such licensee discloses such number to the commissioner, are affected by the cybersecurity event.
• The results of any internal review identifying any lapse in either automated controls or internal procedures or confirming that all automated controls or internal procedures were followed.
• A description of efforts being undertaken to remediate the situation that permitted the cybersecurity event to occur.
• A copy of the privacy policy of the licensee and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event.
• The name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee.

Third-Party Notice Requirements:

If a licensee discovers that a cybersecurity incident in an information system maintained by a third-party service provider, the licensee shall treat the event, if the licensee is aware of the event, in the same manner for purposes of notification to the Commissioner of Insurance.

Penalties:

The Commissioner may take any action that is necessary or appropriate to enforce the provisions of this section and, in addition to or in lieu of suspending, revoking or refusing to reissue or renew any license, certificate of registration or authorization to operate the commissioner has issued, or may issue, to the licensee, impose on such licensee a civil penalty of not more than fifty thousand dollars for each violation of the provisions of this section. The commissioner may bring a civil action to recover the amount of any civil penalty that the commissioner imposes on a licensee.

Associated Regulations:

N/A

Highlights

Covered Entities: Any person in possession of personal information of another person.

First Party Security Standard: Any person in possession of personal information of another person shall safeguard the data, computer files and documents containing the information from misuse by third parties.

Any person who collects Social Security numbers in the course of business shall create a privacy protection policy which shall be published or publicly displayed... Such policy shall (1) protect the confidentiality of Social Security numbers, (2) prohibit unlawful disclosure of Social Security numbers, and (3) limit access to Social Security numbers.

Employment Applications: Each employer shall obtain and retain employment applications in a secure manner.

Third Party Security Standard: N/A

Disposal/Destruction Standard:

General: Any entity in possession of personal information of another person shall destroy, erase or make unreadable such data, computer files and documents prior to disposal.

Employment Applications: Each employer shall employ reasonable measures to destroy or make unreadable employment applications upon disposal. Such measures shall, at a minimum, include the shredding or other means of permanent destruction of such employment applications in a secure setting.

Data Format: Electronic and physical.

Citations: Conn. Gen. Stat. § 42-471, 42-471(a).

More Details

Definitions:

• Employer:  An individual, corporation, partnership or unincorporated association.
• Personal Information (PI): Information capable of being associated with a particular individual through one or more identifiers, including, but not limited to:
  
  • Social Security number;
  • Driver’s license number or state identification card number;
  • State identification card number;
  • An account number;
  • Credit or debit card number;
  • Passport number;
  • Alien Registration number;
  • Health insurance identification number; or
  • Military identification information.

PI does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

Military Information: Information identifying a person as a member of the armed forces, as defined in section 27-103, or a veteran, as defined in said section, including, but not limited to, a selective service number, military identification number, discharge document, military identification card or military retiree identification card.

Methods of Compliance:

The statute does not define methods of compliance.

Exclusions:

• Health Care: N/A
• Financial: If a financial institution has adopted safeguards that comply with the standards established pursuant to Section 501(b) of the Gramm-Leach-Bliley Act of 1999, 15 USC 6801, then such compliance shall constitute compliance with the provisions of this section.
• Other: These requirements do not apply to any agency or political subdivision of the state.

Enforcement/Penalties:

General: A violation of this section shall constitute an unfair trade practice under subsection (a) of section 42-110b, provided the provisions of section 42-110g shall not apply to such violation. Nothing in this section shall be construed to create a private right of action.

In the event of a violation of this section, the Department of Consumer Protection may conduct an administrative hearing, in accordance with chapter 54, and impose a civil penalty of not more than five thousand dollars per violation.

Any civil penalties received pursuant to this section may be deposited into the privacy protection guaranty and enforcement account established pursuant to section 42-472a.

Employment Applications: Any civil penalties received pursuant to this section may be deposited into the privacy protection guaranty and enforcement account established pursuant to section 42-472a.

Associated Regulations:

General Statutes of Connecticut, C.G.S. § 42-472