Connecticut's Proposed Revisions To Data Breach Statute

Connecticut's attorney general wants "the tea" on your data breaches – even if it means taking matters into their own hands. Connecticut lawmakers recently brewed amendments to Connecticut's data breach notification statute, which create a first-of-its-kind data breach reporting obligation for entities. Under the proposed framework, any entity experiencing a "massive breach of security" – newly defined as involving the personal information of more than 100,000 Connecticut residents – must retain an experienced forensic firm and submit a detailed forensic report to the Connecticut attorney general within 90 days following the discovery of the massive breach of security. If the entity fails to do so, the Connecticut attorney general may directly engage a firm and require the entity to cover the costs, with noncompliance carrying a civil penalty of up to $500,000 ($100,000 for small businesses).