Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

core/heading

Consumer Data Privacy and Online Monitoring

core/paragraph

Available at: &nbsp;<a href="https://www.cga.ct.gov/2022/act/pa/pdf/2022PA-00015-R00SB-00006-PA.pdf">https://www.cga.ct.gov/2022/act/pa/pdf/2022PA-00015-R00SB-00006-PA.pdf</a>

Data Breach Requirements: Conn. Gen. Stat. <a>§ 36a-701b.</a>

The numbering and internal citations herein are derived from the applicable state statute.

The term “personal information” means an individual’s

(A) first name or first initial and last name in combination with any one, or more, of the following data:

(iii) Identity protection personal identification number issued by the Internal Revenue Service;

(iv) Driver’s license number, state identification card number, passport number, military identification number, or other identification number issued by the government that is commonly used to verify identity;

(vi) Financial account number in combination with any required security code, access code, or password that would permit access to such financial account;

(vii) Medical information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional;

(viii) Health insurance policy number or subscriber identification number, or any unique identifier used by a health insurer to identify the individual; or,

(ix) Biometric information consisting of data generated by electronic measurements of an individual’s unique physical characteristics used to authenticate or ascertain the individual’s identity, such as a fingerprint, voice print, retina or iris image; or (B) Username or electronic mail address, in combination with a password or security question and answer that would permit access to an online account.

The term “breach of security” means unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data, containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable.

core/separator

A breach notification is not be required if, after an appropriate investigation, the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired or accessed.

A breach notification shall be made without unreasonable delay but not later than sixty (60) days after the discovery of such breach, unless a shorter time is required under federal law.

A breach notification shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed. Any such delayed notification shall be made after such law enforcement agency determines that notification will not compromise the criminal investigation and so notifies the person of such determination.

A breach notice may be provided by one of the following methods:<br>(1) Written notice;<br>(2) Telephone notice;<br>(3) Electronic notice, provided such notice is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act);<br>(4) substitute notice, provided such person demonstrates that the cost of providing notice in accordance with subdivision (1), (2), or (3) of this subsection would exceed $250,000, that the affected class of subject persons to be notified exceeds 500,000 persons, or that the person does not have sufficient contact information.

Substitute notice shall consist of the following:

(A) Electronic mail notice when the person has an electronic mail address for the affected persons;

(B) Conspicuous posting of the notice on the website of the person if the person maintains one; and (C) Notification to major state-wide media, including newspapers, radio, and television.

The person who owns, licenses or maintains computerized data that includes personal information, shall, not later than the time when a breach notice is provided to the resident, also provide notice of the breach of security to the Attorney General.

Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as applicable, such residents of this state, owners, and licensees required to be notified under and in accordance with the policies or the rules, regulations, procedures, or guidelines established by the primary or functional regulator in the event of a breach of security, and (2) if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the attorney general not later than the time when notice is provided to the resident.

Any person that is subject to and in compliance with the privacy and security standards under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH) shall be deemed to be in compliance with this section, provided that (1) any person required to provide notification to Connecticut residents pursuant to HITECH shall also provide notice to the attorney general not later than the time when notice is provided to such residents if notification to the attorney general would otherwise be required under the law, and (2) the person otherwise complies with the other requirements of the law (i.e., identify theft protection).

Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably believed to have been breached.

The person who owns or licenses computerized data that includes personal information shall offer to each resident whose personal information under clause (i) or (ii) of subparagraph (A) of subdivision (2) of subsection (a) of this section (i.e., Social Security number; taxpayer identification number) was breached or is reasonably believed to have been breached, appropriate identity theft prevention services and, if applicable, identity theft mitigation services. Such service or services shall be provided at no cost to such resident for a period of not less than twenty-four (24) months. Such person shall provide all information necessary for such resident to enroll in such service or services and shall include information on how such resident can place a credit freeze on such resident’s credit file.

In the event of a breach of login credentials, notice to a resident may be provided in electronic or other form that directs the resident whose personal information was breached or is reasonably believed to have been breached to promptly change any password or security question and answer, as applicable, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same username or email address and password or security question and answer.

Any person that furnishes an electronic mail account shall not comply with this section by providing notification to the email account that was breached or reasonably believed to have been breached if the person cannot reasonably verify the affected resident’s receipt of such notification. In such an event, the person shall provide notice by another method described in this section or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an internet protocol address or online location from which the person knows the resident customarily accesses the account.

Data Disposal and Security: Conn. Gen. Stat. § 42-471, 42-471a.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal information” means information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver’s license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number, a health insurance identification number, or any military identification information, and does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records or widely distributed media, and (2) “military identification information” means information identifying a person as a member of the armed forces, as defined in Section 27-103, or a veteran, as defined in said section, including, but not limited to, a selective service number, military identification number, discharge document, military identification card, or military retiree identification card.

The term “publicly displayed” includes, but is not limited to, posting on an Internet web page.

Any person in possession of personal information of another person shall safeguard the data, computer files, and documents containing the information from misuse by third parties.

Any person who collects Social Security numbers in the course of business shall create a privacy protection policy which shall be published or publicly displayed. The policy shall: (1) protect the confidentiality of Social Security numbers, (2) prohibit unlawful disclosure of Social Security numbers, and (3) limit access to Social Security numbers.

Any person in possession of personal information of another person shall destroy, erase, or make unreadable such data, computer files, and documents prior to disposal.

Each employer shall obtain and retain employment applications in a secure manner and shall employ reasonable measures to destroy or make unreadable such employment applications upon disposal. Such measures shall, at a minimum, include the shredding or other means of permanent destruction of such employment applications in a secure setting. For purposes of this section, “employer” has the meaning provided in Section 31-128a (“Employer” means an individual, corporation, partnership, or unincorporated association).