HB 5310 — AN ACT CONCERNING DATA PRIVACY BREACHES.

General Assembly Substitute House Bill No.

5310 JanuaryPublic Session,Act 2021No. AN ACT CONCERNING DATA PRIVACY BREACHES.

21-59 AN ACT CONCERNING DATA PRIVACY BREACHES.

(iv) driver's license number, [or] state identification card number, passport[; number, military identification number or other identification number issued by the government that is commonly used to verify identity;

[(C)](C)] (v)passport creditnumber, military identification number or debitother cardidentification number;number issued by the government that is commonly used to verify identity;

[or(v) (D)]credit (vi)or financialdebit accountcard numbernumber; in LCO \\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-05310-R021 of 6 HB.docx Substitute Bill No.

[or (D)] (vi) financial account number in Substitute House Bill No.

Such notification shall not be required if, after anPublic appropriateAct investigation [and consultation with relevant federal, state and local agencies responsible for law enforcement,] the person LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-05310-2 of 6 R02-HB.docx } Substitute Bill No.

531021-59 reasonably2 determinesof that6 theSubstitute breachHouse willBill notNo. likely result in harm to the individuals whose personal information has been acquired [and] or accessed.

5310 an appropriate investigation [and consultation with relevant federal, state and local agencies responsible for law enforcement,] the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired [and] or accessed.

and (B) The person who [conducts business in this state, and who, in the ordinary course of such person's business,] owns or licenses computerized data that includes personal information, shall offer to each resident whose [nonpublic] personal information under [subparagraph (B)(i) of subdivision (9) of subsection (b) of section 38a- 38 or personal information as defined in] clause (i) or (ii) of subparagraph (A) of subdivision (2) of subsection (a) of this section was breached or is reasonably believed to have been breached, appropriate identity theft prevention services and, if applicable, identity theft mitigation services.

(c) Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of aPublic residentAct ofNo. this state was breached or is reasonably believed to have been breached.

(d)21-59 Any3 notification required by this section shall be delayed for a LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-053103 of 6 R02-HB.docx } Substitute House Bill No.

5310 reasonablea periodresident of timethis ifstate awas lawbreached enforcementor agencyis determinesreasonably thatbelieved theto notificationhave willbeen impedebreached. a criminal investigation and such law enforcement agency has made a request that the notification be delayed.

(d) Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed.

(f) (1) In the event of a breach of login credentials under subparagraph (B) of subdivision (2) of subsection (a) of this section, notice to a resident may be provided in electronic or other form that directs the resident whose personal information was breached or is reasonably believed to have been breached to promptly change any password or security question and answer, as applicable, or to take otherPublic appropriateAct stepsNo. to protect the affected online account and all other online accounts for which the resident uses the same user name or electronic mail address and password or security question and answer.

(2)21-59 Any4 person that furnishes an electronic mail account shall not comply with this section by providing notification to the electronic mail LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-053104 of 6 R02-HB.docx } Substitute House Bill No.

5310 accountother thatappropriate wassteps breachedto orprotect reasonablythe believedaffected toonline haveaccount beenand breachedall ifother theonline personaccounts cannotfor reasonablywhich verifythe resident uses the affectedsame resident'suser receiptname ofor suchelectronic notification.mail address and password or security question and answer.

(2) Any person that furnishes an electronic mail account shall not comply with this section by providing notification to the electronic mail account that was breached or reasonably believed to have been breached if the person cannot reasonably verify the affected resident's receipt of such notification.

Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelinesestablishedbytheprimaryorguidelinesestablishedbytheprimaryorfunctionalregulator,asdefined functionalregulator,asdefined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as applicable, such residents of this state, owners, and licensees required to be notified under and in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security,Public andAct (2)No. if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the Attorney General not later than the time when notice is provided to the resident.

(h)21-59 Any5 person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-053105 of 6 R02-HB.docx } Substitute House Bill No.

5310 Economicsecurity, and Clinical(2) Healthif Actnotice ("HITECH")is shallgiven be deemed to bea inresident complianceof with this section,state providedin thataccordance (1)with anysubdivision person(1) requiredof tothis providesubsection notificationregarding toa Connecticutbreach residentsof pursuantsecurity, tosuch HITECHperson shall also providenotifies notice to the Attorney General not later than the time when notice is provided to such residents if notification to the Attorneyresident. General would otherwise be required under subparagraph (A) of subdivision (2) of subsection (b) of this section, and (2) the person otherwise complies with the requirements of subparagraph (B) of subdivision (2) of subsection (b) of this section.

(h) Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act ("HITECH") shall be deemed to be in compliance with this section, provided that (1) any person required to provide notification to Connecticut residents pursuant to HITECH shall also provide notice to the Attorney General not later than the time when notice is provided to such residents if notification to the Attorney General would otherwise be required under subparagraph (A) of subdivision (2) of subsection (b) of this section, and (2) the person otherwise complies with the requirements of subparagraph (B) of subdivision (2) of subsection (b) of this section.

ThisApproved actJune shall16, take2021 effectPublic asAct followsNo. and shall amend the following sections:

Section21-59 16 Octoberof 1,6 2021 36a-701b GL Joint Favorable Subst.

GAE Joint Favorable LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-05310- 6 of 6 R02-HB.docx }