Connecticut Data Privacy Act

What you need to know about the CTDPA:

Does the CTDPA Apply to You?

The CTDPA applies to you if your business:

  1. Is for-profit and conducts business in or provides products or services to residents (“consumers”) of Connecticut, and
  2. Annually controls or processes the personal data of either:
    1. 100,000 residents, excluding data solely used for completing payment transactions; or
    2. 25,000 residents, and derives 25%+ of gross revenue from sale of personal data
To Whom and What Does the CTDPA NOT Apply?
  • The CTDPA exempts both certain data types and certain entities entirely. In addition, like almost every other state data privacy law, the CTDPA does not apply to individuals acting in an employment or commercial (B2B) context.

    Exempt Data:  The CTDPA exempts many different types of data from coverage under the law. Below is a list of some of the more commonly held data types that are exempt under the law. For a complete list, refer to the law or reach out to us at Red Clover Advisors, we would be happy to help you understand how your various data types effect your privacy obligations.

    • Protected Health Information (PHI) under HIPAA
    • Various federally and internationally protected health and patient information, including that protected by the Common Rule, human subject data, and more.
    • Various forms of credit data regulated by the FCRA
    • Certain uses of emergency contact data
    • Data covered by a wide variety of other federal laws including FERPA data, FCA data and DPPA data.

    Exempt Entities:  The CTDPA also exempts many different types of entities from coverage under the law. Below is a list of some of the more commonly relevant entity types that are exempt. For a complete list, refer to the law or reach out to us at Red Clover Advisors, we would be happy to help you understand how your entity classification effect’s your privacy obligations.

    • Non-profits;
    • The state government and its various entities;
    • Higher Education Institutions;
    • Air Carriers;
    • GLBA covered entities;
    • HIPAA covered entities and business associates;
    • Tribal nation governments;
    • National securities associations that are registered under the SEC Act of 1934
What Do You Need to Do?
  • Update their privacy notices to reflect the data collection purposes.
  • Assess and, if necessary, obtain consent for processing sensitive personal data.
  • Establish processes to respond to consumer rights requests effectively.
  • Conduct Data Protection Assessments for certain types of data processing activities.
  • Ensure that vendor contracts align with CTDPA requirements.

Key Components of Connecticut’s Data Privacy Law

What Constitutes Personal Data?

“Personal data” is defined as any information that is linked or reasonably linkable to an identified or identifiable individual. “Personal data” does not include de-identified data or publicly available information.

Where a controller processes de-identified data, the CTDPA requires it to take reasonable measures to ensure the data cannot be associated with an individual; publicly commit to maintaining such data without an attempt to re-identify it; and contractually obligate any recipients of the data to comply with the CTDPA.

CTDPA also exempts pseudonymous data where the controller can show it keeps information that would allow the data to be re-identified separate and subject to technical and organizational controls that prevent its use for re-identification.

What Constitutes Sensitive Data?

CTDPA’s definition of Sensitive personal data consists of the following categories of information:

  • Racial or ethnic origin;
  • Religious beliefs;
  • Mental or physical condition or diagnosis;
  • Sex life or sexual orientation;
  • Consumer health data (new term from Connecticut’s amendment)
  • Citizenship or immigration status;
  • personal data about a known child;
  • Precise geolocation data;
  • Data concerning an individual’s status as a victim of crime; and
  • Genetic or biometric data.
Is Consent Needed to Process Sensitive Data?

In a word: Yes!

Is Consent Needed for Any Other Processing?

Parental consent is required to process personal data about a known child (under 13) in accordance with COPPA, and data subject consent is required to sell the personal data of a person between the ages of 13 and 15 or use it for targeted advertising.

What Needs to be Included in the Privacy Notice?

Under the CTDPA, a privacy notice must include (among other requirements):

  • The categories of personal data processed by the controller;
  • the purpose for processing personal data;
  • how consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request;
  • the categories of personal data that the controller shares with third parties, if any;
  • the categories of third parties, if any, with which the controller shares personal data; and
  • an active electronic mail address or other online mechanism that the consumer may use to contact the controller.
What Constitutes Sale of Personal Data?

Connecticut and many other states define “sale” as: Exchange of personal data for monetary or other valuable consideration by the controller to a third party.

There are limits on the definition of “sale” to ensure that certain business functions are not unintentionally impeded by this law. Examples of activities deemed not to be a sale include: the disclosure of personal data to provide a product or service requested by the consumer, the disclosure of personal data that had been intentionally made available to the public, and the disclosure of personal data as part of a merger or bankruptcy. For more, see the statue.

How Will the CTDPA Be Enforced?

Like most state data privacy laws, the attorney general (AG) has sole enforcement authority over the CTDPA. Under the CTDPA the AG may bring an enforcement action after providing a 60-day notice and an opportunity for the business to cure the alleged violation(s).The cure period will end December 31, 2024, with the AG having discretion over whether to grant an opportunity to cure from that point on based on statutorily defined factors. Actions can be brought that seek injunctive relief (the company must stop certain behaviors) and/or civil penalties, with fines up to $5,000 as determined by the CT Unfair Trade Practices Act.

Data Privacy is Just Good Business