CT Attorney General Highlights Key Areas Of Enforcement, Suggests Legislative Changes

Overview

Connecticut was one of the first U.S. states to pass a comprehensive data privacy law back in May 2022. Today, a total of 13 states have passed similar laws, and dozens of other states are proposing legislation to do so as well. A unique element of Connecticut's law, the Connecticut Data Privacy Act (CTDPA), requires the attorney general's office (the Office) to issue a privacy report (the Report) no later than February 1, 2024, including (1) the number of notices of violation the attorney general has issued; (2) the nature of each violation; (3) the number of violations cured; and (4) any other matter the attorney general deems relevant.

Per the Report, the Office indicated that since the CTDPA went into effect on July 1, 2023, it has issued over a dozen notices of violations (generally referred to in the Report as "cure notices" since recipients have a 60-day cure period to address any alleged violations) and other information requests focusing