Connecticut enacts comprehensive Consumer Data Privacy Law

On May 10, 2022, Connecticut became the fifth U.S. state with comprehensive consumer privacy legislation after Gov. Ned Lamont, D-Conn., signed Senate Bill 6, An Act Concerning Personal Data Privacy and Online Monitoring, into law. Most provisions of the law will go into effect alongside the Colorado Privacy Act July 1, 2023, giving organizations just under 14 months to come into compliance.

The law includes many of the same rights, obligations and exceptions as the consumer privacy laws already on the books in California, Colorado, Utah and Virginia. It draws heavily from Colorado's law and the Virginia Consumer Data Protection Act — with many of the law’s provisions either mirroring or falling somewhere between the Colorado and Virginia laws — but contains a few notable distinctions that should be factored into an entity’s compliance efforts.

Under the law, Connecticut consumers are provided five main rights:
1. Right to access
2. Right to correct
3. Right to delete
4. Right to data portability
5. Right to opt-out

Obligations:
1. Limits on collection
2. Limits on use
3. Consent requirements
4. Data security
5. Transparency
6. Data protection assessments
7. Data processing contracts
8. Responding to consumer requests

Although we have yet to see how the Connecticut law will play out in practice, the text of the law provides a solid starting point. Entities preparing for Colorado's law will be able to leverage some of their compliance efforts, especially when it comes to consumer rights. The law’s heightened protections for children’s data and other important nuances, however, will certainly require additional consideration.

About Ardent Privacy

Ardent Privacy is an "Enterprise Data Privacy Technology" solutions provider based in the Maryland/DC region of the United States and Pune, India. Ardent harnesses the power of AI to enable companies with data discovery and automated compliance with DPB (India), RBI Security Guidelines, GDPR (EU), CCPA/CPRA (California), and other global regulations by taking a data-driven approach. Ardent Privacy's solution utilizes machine learning and artificial intelligence to identify, inventory, map, minimize, and securely delete data in enterprises to reduce legal and financial liability.

For more information visit https://ardentprivacy.ai/and for more resources here.

Ardent Privacy articles should not be considered legal advice on data privacy regulations or any other specific facts or circumstances.