Connecticut's Digital Privacy Law Is Uncompromising to Businesses

The Connecticut General Assembly advanced a privacy bill last week, bringing the Constitution State a step closer to becoming the fifth state in the U.S. to pass legislation regulating how people's data is collected and shared online. The Connecticut Data Privacy Act—which would take effect July 1, 2023—emulates the privacy laws passed in Utah, Virginia and Colorado, giving residents the option to opt-out of data sales, targeted ads and profiling, and includes protections for children and biometric data. The bill, which failed last year during Connecticut’s special legislative session, targets businesses that hold data on more than 100,000 consumers or those who earn 25% of their annual revenue from the sale of data of more than 25,000 consumers. This time around, the bill emerged with stronger provisions, such as the sunset of the “right to cure” clause that gave companies time to rectify violations before lawsuits could be levied against them. This means companies that violate the rules will have no time to fix these violations, making them more likely to comply with soliciting user consent. This will go into effect on Jan. 1, 2025. “What we're doing today is saying Connecticut residents have the right to know what data is being collected about them, how it's being used and to tell companies not to sell their data," said the lead sponsor of the bill, Sen. James Maroney, on the Senate floor last week. "There is no question that it is a stronger bill,” said Dave Stauss, an attorney with experience in data privacy at law firm Husch Blackwell, “as compared to the laws in Virginia and Utah," per the International Association of Privacy Professionals (IAPP). Stauss was among the contributors to get the privacy bill ready for the 2022 session. The need for an umbrella privacy law is gaining steam, with President Joe Biden recently calling on Congress to pass legislation that limits big tech firms from collecting children’s data on social media platforms for targeted ads. The dearth of a federal law has pushed lawmakers across 29 states so far to work on comprehensive privacy bills, with California taking the lead in 2020. These rules vary slightly in each state: While Utah is known for its business-friendly policies, Colorado and Connecticut are significantly more consumer-oriented. "We have waited and waited for the federal government to do something,” said Sen. Duff during his remarks. "It's now up to the states to finally take control of this issue. The fact it hasn't been done yet is a crime." The Connecticut Attorney General’s Office has a dedicated privacy unit, which will have enforcement authority. The legislation now awaits Gov. Ned Lamont’s signature, or a 15-day window after the end of the current legislative session, to become law.