Connecticut General Statutes
Chapter 669 - Regulated Activities
Section 36a-701b. - Breach of security re computerized data containing personal information. Notice of breach. Provision of identity theft prevention services and identity theft mitigation services. Delay for criminal investigation. Means of notice....

(a) For purposes of this section, (1) “breach of security” means unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data, containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable; and (2) “personal information” means an individual's (A) first name or first initial and last name in combination with any one, or more, of the following data: (i) Social Security number; (ii) taxpayer identification number; (iii) identity protection personal identification number issued by the Internal Revenue Service; (iv) driver's license number, state identification card number, passport number, military identification number or other identification number issued by the government that is commonly used to verify identity; (v) credit or debit card number; (vi) financial account number in combination with any required security code, access code or password that would permit access to such financial account; (vii) medical information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; (viii) health insurance policy number or subscriber identification number, or any unique identifier used by a health insurer to identify the individual; or (ix) biometric information consisting of data generated by electronic measurements of an individual's unique physical characteristics used to authenticate or ascertain the individual's identity, such as a fingerprint, voice print, retina or iris image; or (B) user name or electronic mail address, in combination with a password or security question and answer that would permit access to an online account. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.

(b) (1) Any person who owns, licenses or maintains computerized data that includes personal information, shall provide notice of any breach of security following the discovery of the breach to any resident of this state whose personal information was breached or is reasonably believed to have been breached. Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law, subject to the provisions of subsection (d) of this section. If the person identifies additional residents of this state whose personal information was breached or reasonably believed to have been breached following sixty days after the discovery of such breach, the person shall proceed in good faith to notify such additional residents as expediently as possible. Such notification shall not be required if, after an appropriate investigation the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired or accessed.
(2) If notice of a breach of security is required by subdivision (1) of this subsection:
(A) The person who owns, licenses or maintains computerized data that includes personal information, shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the Attorney General; and
(B) The person who owns or licenses computerized data that includes personal information, shall offer to each resident whose personal information under clause (i) or (ii) of subparagraph (A) of subdivision (2) of subsection (a) of this section was breached or is reasonably believed to have been breached, appropriate identity theft prevention services and, if applicable, identity theft mitigation services. Such service or services shall be provided at no cost to such resident for a period of not less than twenty-four months. Such person shall provide all information necessary for such resident to enroll in such service or services and shall include information on how such resident can place a credit freeze on such resident's credit file.
(c) Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably believed to have been breached.
(d) Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed. Any such delayed notification shall be made after such law enforcement agency determines that notification will not compromise the criminal investigation and so notifies the person of such determination.
(e) Any notice to a resident, owner or licensee required by the provisions of this section may be provided by one of the following methods, subject to the provisions of subsection (f) of this section: (1) Written notice; (2) telephone notice; (3) electronic notice, provided such notice is consistent with the provisions regarding electronic records and signatures set forth in 15 USC 7001; (4) substitute notice, provided such person demonstrates that the cost of providing notice in accordance with subdivision (1), (2) or (3) of this subsection would exceed two hundred fifty thousand dollars, that the affected class of subject persons to be notified exceeds five hundred thousand persons or that the person does not have sufficient contact information. Substitute notice shall consist of the following: (A) Electronic mail notice when the person has an electronic mail address for the affected persons; (B) conspicuous posting of the notice on the web site of the person if the person maintains one; and (C) notification to major state-wide media, including newspapers, radio and television.
(f) (1) In the event of a breach of login credentials under subparagraph (B) of subdivision (2) of subsection (a) of this section, notice to a resident may be provided in electronic or other form that directs the resident whose personal information was breached or is reasonably believed to have been breached to promptly change any password or security question and answer, as applicable, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same user name or electronic mail address and password or security question and answer.
(2) Any person that furnishes an electronic mail account shall not comply with this section by providing notification to the electronic mail account that was breached or reasonably believed to have been breached if the person cannot reasonably verify the affected resident's receipt of such notification. In such an event, the person shall provide notice by another method described in this section or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an Internet protocol address or online location from which the person knows the resident customarily accesses the account.
(g) Any person that maintains such person's own security breach procedures as part of an information security policy for the treatment of personal information and otherwise complies with the timing requirements of this section, shall be deemed to be in compliance with the security breach notification requirements of this section, provided such person notifies, as applicable, residents of this state, owners and licensees in accordance with such person's policies in the event of a breach of security and in the case of notice to a resident, such person also notifies the Attorney General not later than the time when notice is provided to the resident. Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as applicable, such residents of this state, owners, and licensees required to be notified under and in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security, and (2) if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the Attorney General not later than the time when notice is provided to the resident.
(h) Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act (“HITECH”) shall be deemed to be in compliance with this section, provided that (1) any person required to provide notification to Connecticut residents pursuant to HITECH shall also provide notice to the Attorney General not later than the time when notice is provided to such residents if notification to the Attorney General would otherwise be required under subparagraph (A) of subdivision (2) of subsection (b) of this section, and (2) the person otherwise complies with the requirements of subparagraph (B) of subdivision (2) of subsection (b) of this section.
(i) All documents, materials and information provided in response to an investigative demand issued pursuant to subsection (c) of section 42-110d in connection with the investigation of a breach of security as defined by this section shall be exempt from public disclosure under subsection (a) of section 1-210, provided the Attorney General may make such documents, materials or information available to third parties in furtherance of such investigation.
(j) Failure to comply with the requirements of this section shall constitute an unfair trade practice for purposes of section 42-110b and shall be enforced by the Attorney General.
(P.A. 05-148, S. 3; 05-288, S. 231, 232; June 12 Sp. Sess. P.A. 12-1, S. 130; P.A. 15-142, S. 6; P.A. 18-90, S. 2; P.A. 19-117, S. 231; 19-196, S. 9; P.A. 21-59, S. 1.)
History: P.A. 05-148 effective January 1, 2006; P.A. 05-288 made technical changes in Subsecs. (b) and (f), effective January 1, 2006; June 12 Sp. Sess. P.A. 12-1 amended Subsec. (a) by adding “unauthorized” re acquisition, amended Subsec. (b) by designating existing provisions as Subdiv. (1) and amending same to replace “disclose” with “provide notice of” and “disclosure” with “notice” and by adding Subdiv. (2) re notice of breach of security to Attorney General, amended Subsec. (c) by adding “of a resident of this state” re personal information, amended Subsec. (e) by adding “to a resident, owner or licensee” re notice, replacing “person, business or agency” with “person” and making a technical change, and amended Subsec. (f) by replacing references to subject persons with references to residents of this state, owners and licensees, as applicable, adding provisions re notice to Attorney General and deleting reference to system; P.A. 15-142 made technical changes in Subsec. (a), amended Subsec. (b) to replace “was, or is reasonably believed to have been, accessed by an unauthorized person through such breach of security” with “was breached or is reasonably believed to have been breached” and add provision re notice of breach of security not later than 90 days after discovery unless shorter time is required under federal law in Subdiv. (1), to designate existing provision re notice of breach to Attorney General as Subpara. (A) in Subdiv. (2) and amend same to add Subpara. (B) re provision of identity theft prevention services and identity theft mitigation services, and amended Subsec. (c) to replace “was, or is reasonably believed to have been accessed by an unauthorized person” with “was breached or is reasonably believed to have been breached”; P.A. 18-90 amended Subsec. (a)(1) by deleting “account number,” in Subpara. (C), adding Subpara. (D) re financial account number, and making a technical change, and amended Subsec. (b)(2)(B) by replacing “twelve months” with “twenty-four months” re period for which service is to be provided at no cost to resident; P.A. 19-117 amended Subsec. (b)(2)(B) by replacing provision re personal information under Sec. 38a-999b(a)(4)(A) with provision re nonpublic information under Sec. 38a-38(b)(9)(B)(i) and made a conforming change, effective October 1, 2020; P.A. 19-196 changed effective date of P.A. 19-117 from October 1, 2020, to October 1, 2021, effective July 8, 2019; P.A. 21-59 amended Subsec. (a)(2) to redefine “personal information”, redesignate Subpara. (A) as clause (i), Subpara. (B) as clause (iv), Subpara. (C) as clause (v), Subpara. (D) as clause (vi) and added clauses (ii), (iii) and (vii) to (ix) re additional types of personal information in Subpara. (A) and added new Subpara. (B) re user name or electronic mail address; amended Subsec. (b)(1) and (2) to delete provision re conducting business in this state and reference to “ordinary course of such person's business”, amended Subsec. (b)(1) to change 90 days to 60 days, delete provision re completion of investigation by person, add provision regarding notification of additional residents following 60 days after discovery of the breach, delete provision re consultation with law enforcement agencies, and make a technical change, amended Subsec. (b)(2)(B) to replace “nonpublic information” with “personal information” and make a technical change, amended Subsec. (e) to add “, subject to the provisions of subsection (f) of this section”, added new Subsec. (f) re breach of login credentials, redesignated existing Subsec. (f) as Subsec. (g), added Subsec. (h) re persons subject to certain privacy and security standards deemed to be in compliance, added Subsec. (i) re exemption from public disclosure and redesignated existing Subsec. (g) as Subsec. (j).