4 Things You Need To Know About Connecticut's Privacy Law

Some quick hits on the changes in privacy in Connecticut. This space is moving fast, so we will try and keep you up to date with summarized content on these changes and not bore you with too much legal jargon.

Here are 4 points to understand.

On June 3, the Connecticut House unanimously passed Senator?James Maroney’s Senate Bill 3, which creates new data privacy rights for consumer health data and children’s personal data.

1. Section 1-6 amend last year’s Connecticut Data Privacy Act (CTDPA) to create new protections for consumer health data. Consumer health data is defined much more narrowly than the definition found in Washington’s My Health My Data Act.

2. The Act prohibits persons from (1) providing employees or contractors with consumer health data unless they are subject to a contractual or statutory duty of confidentiality, (2) using geofences within 1,750 feet of a mental health facility or reproductive or sexual health facility under certain circumstances, and (3) selling, or offering to sell, consumer health data without first obtaining consumer consent. The Act also adds consumer health data as a category of sensitive data under the CTDPA.

3. Sections 8-13 create new obligations for the processing of personal data of children under 18 years of age (“minors”). The obligations apply to controllers that offer any online service, product, or feature to consumers whom such controller has actual knowledge or wilfully disregards are minors.

4. Section 9 also restricts the ways in which controllers can collect and use minors' personal data. Among other things, controllers cannot (absent consent) (1) engage in targeted advertising or the sale of a minor’s personal data, (2) collect a minor’s personal data unless necessary to provide the service, product, or feature, (3) retain the data for longer than is necessary to provide the service, product or feature, and (4) use the personal data for an incompatible processing purpose. Controllers also cannot use a system design feature to significantly increase or extend a minor’s use of the service, product, or feature.

The children’s privacy protections go into effect on October 1, 2024. They are enforceable by the Connecticut Attorney General’s office. The office must provide a right to cure until December 31, 2025.

The bill is available here:?https://lnkd.in/g3gEhvtd