July 24, 2024
Connecticut Adds New Privacy Rules for Health Data
By adding a host of new protections for health data, Connecticut has continued to play an outsized role in privacy regulation. Learn more at TrueVault.
As 2023 approaches and a new round of data privacy laws are slated to take effect, business leaders are scrambling to determine which laws apply to their companies and how to juggle multi-state compliance. The Connecticut Data Privacy Act (CDPA) is one of those laws, going into effect on July 1, 2023.
To anyone familiar with Virginia’s Consumer Data Protection Act, the criteria for determining whether the CDPA applies should look familiar as they are more or less identical. Here’s a quick rundown on how to figure out if the Connecticut Data Privacy Act applies to your business.
As with the Virginia privacy law, most of the CDPA’s rules apply to “controllers”—i.e., for-profit businesses that “determine the purpose and means of processing personal data.”
Basically, if it’s your website (or store), you are the controller of any data that is processed in connection with that site.
Any controller that has a physical presence in Connecticut, or sells its products or services online to state residents, must comply with the CDPA if at least one of the following applies:
For most businesses, it will be the 100,000-consumer threshold that applies to them. If your business has a website, it is controlling the personal data (e.g., IP addresses, cookies, etc.) of each one of its visitors. If you are getting just 8,400 unique visitors from Connecticut per month, that puts you over the 100,000 mark.
The CTDPA also contains a number of exemptions at the entity level, and for specific types of personal data. These exemptions include:
Disclaimer: This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions.
Get monthly updates on the latest updates on policy & the shifting privacy landscape.
Dive into a world of knowledge, trends, and industry updates on the TrueVault blog.
