Connecticut becomes the fifth state to enact a comprehensive privacy law
Connecticut joins Virginia, Colorado, Utah, and California in passing a comprehensive privacy law. The “Act Concerning Personal Data Privacy and Online Monitoring”, or the Connecticut Data Privacy Act (CTDPA), is scheduled to take effect on July 1, 2023.
Scope:
The CTDPA applies to persons that conduct business in the state or produce products or services target to state residents and, during the prior calendar year, controlled or processed the personal data of:
- 100,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
- 25,000 consumers and derived over 25% of gross revenue from the “sale” (defined as “the exchange of personal data for monetary or other valuable consideration”) of personal data.
Consumer rights:
- Right to access
- Right to correct
- Right to delete
- Right to data portability
- Right to opt out
Obligations:
- Data minimization
- Data security
- Consent requirements
- Non discrimination
- Transparency
To learn more about the law, including exemptions & enforcements, visit the link below.
The Bottom Line
- This new law shares many similarities with other state's privacy legislations
- The Connecticut law goes into effect on July 1, 2023, giving businesses over a year to determine if the CTDPA is applicable to them, and how to comply.
The full guidelines can be found
here