The Connecticut legislature passed Connecticut SB 6 on April 28, 2022.  If signed by the governor, the bill would take effect on July 1, 2023, though the task force created by the bill will be required to begin work sooner.

The bill closely resembles the Colorado Privacy Act, with a few notable additions.  Like the Colorado Privacy Act, the bill adopts “controller” and “processor” terminology, provides consumers with rights to access, correct, delete, obtain a copy, and opt-out of certain types of processing of their personal data, and requires consent for certain activities.

Scope of the Bill’s Requirements

The bill’s requirements would apply to persons conducting business in Connecticut or persons that produce products or services that are targeted to residents of Connecticut that meet certain thresholds:

  1. Controlled or processed the personal data of not less than 100,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction, or
  2. Controlled or processed the personal data of not less than 25,000 consumers and derived more than 25% of their gross revenue from the sale of personal data.

The bill explicitly exempts nonprofit organizations, institutions of higher education, financial institutions or data subject to the GLBA, or HIPAA covered entities or business associates.  The bill also exempts business-to-business and employee data from the definition of “consumer.”

Consumer Rights

The bill would provide consumers with the ability to (1) confirm whether or not a controller is processing personal data, (2) access their personal data in a portable format, (3) correct inaccuracies in their personal data, (3) delete personal data “provided by, or obtained about,” them, and (4) obtain a copy of the consumer’s personal data processed by the controller in a portable format.  Controllers must also establish a process for consumers to appeal a denial of their rights request.  However, the bill includes some exceptions to these consumer rights, including where compliance with an access or portability request would require the controller to reveal a trade secret.

The bill would provide consumers with a right to opt-out of the processing of the consumer’s personal data for “targeted advertising,” “sale,” or “profiling,” with these terms defined in a way that tracks the Colorado Privacy Act.  Additionally, controllers would be required to obtain consent prior to processing sensitive data, and consent may not be obtained through acceptance to terms and conditions or through the use of dark patterns.  Notably, the Connecticut bill would require that controllers provide consumers with an “effective mechanism” to revoke consent, which must be ‘at least as easy as the mechanism by which the consumer provided consent.”

13-16 Year Olds

Unlike the Colorado Privacy Act, the Connecticut bill would require that a controller “not process the personal data of a consumer for purposes of targeted advertising, or sell the consumer’s personal data without the consumer’s consent,” where a controller has actual knowledge, and willfully disregards that the consumer is at least 13 years old, but under 16 years old.

Enforcement

The bill would be enforced by the attorney general.  Although there is no rulemaking authority created by the statute, the bill would require a task force that must study certain topics including, information sharing among health care providers and social care providers, algorithmic decision-making and bias, age verification for social media accounts, among other topics.

 

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.

Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.