On June 26, 2023, Senate Bill 1058 An Act Concerning Charitable Organizations, Telecommunications and the Attorney General's Recommendations Regarding Consumer Protection (the Act) was signed by the Connecticut Governor, Ned Lamont. In particular, the Act amends several laws protecting personal information and data breach notifications.

Data breach notification

The Act amends §36a-701b of the General Statutes of Connecticut (the Conn. Gen. Stat.), expanding the definition of personal information to include precise geolocation data. In addition, the Act also amends §36a-701b of the Conn. Gen. Stat. to clarify that any notice to a resident, owner, or licensee may be provided by a substitute notice, provided that such person demonstrates in the notice provided to the Attorney General (AG) that the cost of providing notice would exceed $250,000, that the affected class of subject persons to be notified exceeds 500,000 persons, or that the person does not have sufficient contact information.

In addition, the Act amends §36a-701b of the Conn. Gen. Stat. adding that any civil penalties collected for failure to comply with the requirements of this section may be deposited into the privacy protection guaranty and enforcement account established pursuant to §42-472a of the Conn. Gen. Stat.

The amendments to §36a-701b of the Conn. Gen. Stat. took effect on October 1, 2023.

Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTPDA)

The Act specifically amends the CTPDA to clarify that a controller must not process the personal data of a consumer for purposes of targeted advertising, sell the consumer's personal data without the consumer's consent, under circumstances where a controller has actual knowledge, or willfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age.

The amendments to the CTDPA took effect on July 1, 2023.

Telemarketing

Moreover, the Act amends §42-288520 of the Conn. Gen. Stat. to expand the applicability of the state's prohibitions on telephone sales calls. Specifically, no telemarketer may make, or cause to be made, a telephonic sales call to a consumer without such consumer's prior express written consent, unlike the previous restriction which applied only to unsolicited, automatically dialed, recorded calls.

In addition, the Act includes that a telephonic sales call that is made to any consumer residential, mobile, or telephonic paging device telephone number that is not otherwise prohibited by this section shall be limited to being conducted between the hours of nine a.m. and eight p.m. local time.

The amendments to §42-288520 of the Conn. Gen. Stat. took effect on October 1, 2023.

You can read the Act here and view its history here.