Connecticut Becomes Fifth State to Enact a Comprehensive Consumer Data Privacy Law

Why This Privacy Law is Important: 

On May 10, 2022, Connecticut joined California, Colorado, Utah, and Virginia as states that have passed comprehensive consumer data privacy laws. The provisions of the Act Concerning Personal Data Privacy and Online Monitoring will go into effect on July 1, 2023, the same date as the Colorado Privacy Act goes into effect.

Overview:

The Connecticut consumer privacy law contains many of the same rights, obligations, and exceptions seen in the previously enacted state-level privacy laws, most closely following the trends set by Colorado and Virginia. Of course, the law does contain several differences from other state privacy laws, which organizations must account for in their compliance efforts.
As in most new privacy legislation, the law imposes limits on collection and use of data, so organizations can only collect what is “adequate, relevant, and reasonably necessary… to the purposes for which such data is processed” and may not use data “for purposes that are neither reasonably necessary to, nor compatible with, the disclosed purposes.” Organizations have an obligation to establish and implement administrative, technical, and physical data security practices. A consumer’s consent must be “freely given, specific, informed and unambiguous.”