→
Previous
Latest
General Assembly Substitute Bill No.
Substitute House Bill No.
5310 January Session, 2021 AN ACT CONCERNING DATA PRIVACY BREACHES.
5310 Public Act No.
21-59 AN ACT CONCERNING DATA PRIVACY BREACHES.
(iv) driver's license number, [or] state identification card number, passport number, military identification number or other identification number issued by the government that is commonly used to verify identity;
(iv) driver's license number, [or] state identification card number, [;
[(C)] (v) credit or debit card number;
(C)] passport number, military identification number or other identification number issued by the government that is commonly used to verify identity;
[or (D)] (vi) financial account number in LCO \\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-05310-R021 of 6 HB.docx Substitute Bill No.
(v) credit or debit card number;
[or (D)] (vi) financial account number in Substitute House Bill No.
Such notification shall not be required if, after an appropriate investigation [and consultation with relevant federal, state and local agencies responsible for law enforcement,] the person LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-05310-2 of 6 R02-HB.docx } Substitute Bill No.
Such notification shall not be required if, after Public Act No.
5310 reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired [and] or accessed.
21-59 2 of 6 Substitute House Bill No.
5310 an appropriate investigation [and consultation with relevant federal, state and local agencies responsible for law enforcement,] the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired [and] or accessed.
and (B) The person who [conducts business in this state, and who, in the ordinary course of such person's business,] owns or licenses computerized data that includes personal information, shall offer to each resident whose [nonpublic] personal information under [subparagraph (B)(i) of subdivision (9) of subsection (b) of section 38a- 38 or personal information as defined in] clause (i) or (ii) of subparagraph (A) of subdivision (2) of subsection (a) of this section was breached or is reasonably believed to have been breached, appropriate identity theft prevention services and, if applicable, identity theft mitigation services.
and (B) The person who [conducts business in this state, and who, in the ordinary course of such person's business,] owns or licenses computerized data that includes personal information, shall offer to each resident whose [nonpublic] personal information under [subparagraph (B)(i) of subdivision (9) of subsection (b) of section 38a- or personal information as defined in] clause (i) or (ii) of subparagraph (A) of subdivision (2) of subsection (a) of this section was breached or is reasonably believed to have been breached, appropriate identity theft prevention services and, if applicable, identity theft mitigation services.
(c) Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably believed to have been breached.
(c) Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of Public Act No.
(d) Any notification required by this section shall be delayed for a LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-053103 of 6 R02-HB.docx } Substitute Bill No.
21-59 3 of 6 Substitute House Bill No.
5310 reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed.
5310 a resident of this state was breached or is reasonably believed to have been breached.
(d) Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed.
(f) (1) In the event of a breach of login credentials under subparagraph (B) of subdivision (2) of subsection (a) of this section, notice to a resident may be provided in electronic or other form that directs the resident whose personal information was breached or is reasonably believed to have been breached to promptly change any password or security question and answer, as applicable, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same user name or electronic mail address and password or security question and answer.
(f) (1) In the event of a breach of login credentials under subparagraph (B) of subdivision (2) of subsection (a) of this section, notice to a resident may be provided in electronic or other form that directs the resident whose personal information was breached or is reasonably believed to have been breached to promptly change any password or security question and answer, as applicable, or to take Public Act No.
(2) Any person that furnishes an electronic mail account shall not comply with this section by providing notification to the electronic mail LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-053104 of 6 R02-HB.docx } Substitute Bill No.
21-59 4 of 6 Substitute House Bill No.
5310 account that was breached or reasonably believed to have been breached if the person cannot reasonably verify the affected resident's receipt of such notification.
5310 other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same user name or electronic mail address and password or security question and answer.
(2) Any person that furnishes an electronic mail account shall not comply with this section by providing notification to the electronic mail account that was breached or reasonably believed to have been breached if the person cannot reasonably verify the affected resident's receipt of such notification.
Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelinesestablishedbytheprimaryor functionalregulator,asdefined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as applicable, such residents of this state, owners, and licensees required to be notified under and in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security, and (2) if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the Attorney General not later than the time when notice is provided to the resident.
Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelinesestablishedbytheprimaryorfunctionalregulator,asdefined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as applicable, such residents of this state, owners, and licensees required to be notified under and in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of Public Act No.
(h) Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-053105 of 6 R02-HB.docx } Substitute Bill No.
21-59 5 of 6 Substitute House Bill No.
5310 Economic and Clinical Health Act ("HITECH") shall be deemed to be in compliance with this section, provided that (1) any person required to provide notification to Connecticut residents pursuant to HITECH shall also provide notice to the Attorney General not later than the time when notice is provided to such residents if notification to the Attorney General would otherwise be required under subparagraph (A) of subdivision (2) of subsection (b) of this section, and (2) the person otherwise complies with the requirements of subparagraph (B) of subdivision (2) of subsection (b) of this section.
5310 security, and (2) if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the Attorney General not later than the time when notice is provided to the resident.
(h) Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act ("HITECH") shall be deemed to be in compliance with this section, provided that (1) any person required to provide notification to Connecticut residents pursuant to HITECH shall also provide notice to the Attorney General not later than the time when notice is provided to such residents if notification to the Attorney General would otherwise be required under subparagraph (A) of subdivision (2) of subsection (b) of this section, and (2) the person otherwise complies with the requirements of subparagraph (B) of subdivision (2) of subsection (b) of this section.
This act shall take effect as follows and shall amend the following sections:
Approved June 16, 2021 Public Act No.
Section 1 October 1, 2021 36a-701b GL Joint Favorable Subst.
21-59 6 of 6
GAE Joint Favorable LCO {\\PRDFS1\HCOUSERS\BARRYJN\WS\2021HB-05310- 6 of 6 R02-HB.docx }
⬇ Download PDF