Connecticut Personal Data Privacy and Online Monitoring Act

Connecticut Personal Data Privacy and Online Monitoring Act
Name	Connecticut Personal Data Privacy and Online Monitoring Act
Enacted by	Connecticut General Assembly
Signed by	Ned Lamont
Date enacted	2023
Status	active

Connecticut Personal Data Privacy and Online Monitoring Act

The Connecticut Personal Data Privacy and Online Monitoring Act is a state statute enacted to regulate data privacy, consumer rights, and online monitoring practices within Connecticut. The law establishes obligations for covered entities regarding personal data processing, access rights, and transparency, and creates enforcement mechanisms involving the Connecticut Attorney General. The statute sits amid a wave of state privacy laws alongside initiatives in California, Virginia, and Colorado and has influenced litigation and compliance efforts across the United States.

Background and Legislative History

The statute emerged during legislative sessions in the Connecticut General Assembly following debates influenced by landmark measures such as the California Consumer Privacy Act and the European Union General Data Protection Regulation. Sponsors cited testimony from privacy advocates associated with organizations like the Electronic Frontier Foundation and research from universities including Yale University and University of Connecticut. Public hearings featured representatives from technology firms like Meta Platforms, Google, Amazon and industry groups such as the Internet Association and the Consumer Technology Association. Governor Ned Lamont signed the bill into law after negotiations among legislators affiliated with the Democratic Party and the Republican Party.

Scope and Definitions

The statute defines "personal data" with terms paralleling concepts in the GDPR and the California Consumer Privacy Act. Covered entities include businesses that meet thresholds similar to those in laws enacted by California, Virginia, and Colorado, as well as certain data brokers regulated in states like Vermont and Nevada. Definitions address categories such as "sensitive data," biometric identifiers, and household data, referencing standards discussed by the National Institute of Standards and Technology and model rules from the Uniform Law Commission. Exemptions align with precedents established in statutes governing sectors overseen by agencies like the Federal Trade Commission and the Department of Health and Human Services.

Key Provisions and Requirements

The act creates consumer rights including access, correction, deletion, and data-portability obligations similar to provisions in the California Privacy Rights Act and the Virginia Consumer Data Protection Act. It requires covered entities to provide clear privacy notices, data-minimization practices, and opt-out mechanisms for targeted advertising akin to rules debated at the Federal Communications Commission. Data security mandates echo guidance from the National Institute of Standards and Technology and incident-notification timelines used in regulations by the Securities and Exchange Commission. The law imposes specific constraints on online monitoring and behavioral advertising that reference practices litigated in matters involving TikTok, Snap Inc., and Twitter, Inc..

Enforcement and Penalties

Enforcement is primarily vested in the Connecticut Attorney General with civil penalties for violations mirroring approaches used in enforcement actions by the Federal Trade Commission. The statute includes provisions for notice-and-cure periods and statutory fines for non-compliance, modeled on mechanisms in the California Privacy Rights Act. The act permits private rights of action limited to data security incidents, an enforcement design that reflects compromises found in state laws from Massachusetts and proposals debated in the United States Congress. Regulatory coordination provisions envision interaction with federal agencies such as the Federal Trade Commission.

Impact on Businesses and Consumers

Businesses operating in Connecticut—including startups incubated at institutions like Yale University and established firms headquartered in Hartford—face heightened compliance obligations, leading to investment in privacy teams, technology audits, and legal counsel from firms with expertise in laws like the California Consumer Privacy Act and GDPR compliance. Consumer advocacy groups such as the American Civil Liberties Union and the Electronic Privacy Information Center have praised expanded rights while trade associations representing business interests warned about compliance costs. The law is expected to influence procurement practices of municipal bodies such as the Connecticut Department of Administrative Services and affect services provided by companies like Microsoft and Oracle Corporation.

Litigation and Legal Challenges

Following enactment, the statute prompted litigation raising constitutional and preemption claims similar to challenges filed against the California Consumer Privacy Act and state privacy statutes in Virginia and Colorado. Plaintiffs have included trade groups, technology companies, and data-broker entities represented by law firms with histories in cases before the United States Court of Appeals for the Second Circuit and the United States District Court for the District of Connecticut. Judicial review has considered issues related to administrative interpretation, standing doctrines articulated in precedents like Spokeo, Inc. v. Robins, and federal preemption principles derived from decisions involving the Federal Communications Commission.

Comparison with Other State and Federal Privacy Laws

The act aligns with trends established by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, and the Colorado Privacy Act by providing comprehensive consumer rights and obligations for businesses, while differing in enforcement structure and specific exemptions similar to statutes in Vermont and Nevada. Unlike sectoral federal statutes such as the Health Insurance Portability and Accountability Act of 1996 and the Gramm–Leach–Bliley Act, the law applies broadly across industries within the state and addresses online monitoring and targeted advertising in ways reminiscent of proposals debated in the United States Congress and rulemaking at the Federal Trade Commission.

Category:Connecticut law Category:Data protection legislation Category:Privacy law in the United States