Tue. Jun 6th, 2023

From today’s Reuters Online:

In May, the State of Connecticut enacted the Personal Data Privacy and Online Monitoring Act (the “CTDPA”) which includes a broad array of privacy regulations that will go into effect on July 1, 2023. (S.B. 6, Gen. Assemb., Reg. Sess. (Conn. 2022)). Connecticut joins four other states — California, Virginia, Colorado and Utah — that have enacted privacy laws over the last few years.

While the CTDPA contains many similarities to the existing four U.S. state privacy statutes, it also possesses its own unique differences, thus adding to the growing patchwork of state privacy laws that has been forming absent a federal rule.

The CTDPA is applicable to individuals who conduct business in Connecticut or “produce products or services that are targeted to residents [of Connecticut].” The law governs those who during the preceding calendar year controlled or processed the personal data of (1) at least 100,000 consumers, excluding personal data used solely for the purpose of completing a payment transaction or (2) at least 25,000 consumers and derived more than 25 percent of their gross revenue from the sale of personal data. (§ 2).

The CTDPA’s scope of applicability is narrower than some of the existing state regulations, but broader than others.

For example, the gross revenue amount required by the CTDPA is smaller than that in Virginia and Utah which require at least 50 percent of gross revenue to be from the sale of personal data, but greater than in Colorado which does not have a threshold amount at all. (VCDPA § 59.1-572; UCPA § 13-61-102).

Additionally, unlike California’s Consumer Privacy Act (CCPA) and Privacy Rights Act (CPRA), the CTDPA does not have an independent overriding revenue threshold, and thus, even large revenue generating companies will not be subject to the regulations absent satisfying the minimum consumer requirements (CCPA § 1798.140(c)(1); CPRA § 14(d))). The CTDPA is also unique in that it narrows its reach by not covering data collected solely for the purposes of payment transactions.

Read the complete story here.

By Editor