Connecticut Passes Comprehensive New Consumer Data Privacy Law

On Tuesday, May 10, Connecticut Governor Ned Lamont signed into law, “An Act Concerning Personal Data Privacy and Online Monitoring,” making Connecticut the fifth state to enact consumer data privacy legislation. The statute, which is being referred to as the Connecticut Data Privacy Act (CTDPA) takes effect on July 1, 2023. Here is what companies controlling or processing consumer information should understand about the CTDPA as they begin to prepare for compliance.

Key Takeaways

1. The CTDPA generally applies to businesses that control or process personal data, including sensitive data, which are each broadly defined.
2. Nonprofits, institutions of higher education, certain financial institutions, and Health Insurance Portability and Accountability Act (HIPAA)-covered entities and business associates are excluded, along with certain classifications of data, including de-identified data and data already protected by various federal laws.