JD Supra recently published Vincent Merola's client alert on Connecticut's new Data Privacy Act, which became effective on July 1, 2023.
The Connecticut Data Privacy Act applies to businesses that: (a) transact business in Connecticut or otherwise utilize products or services targeted to Connecticut residents; and (b) either (i) control or process the personal data of at least 100,000 Connecticut residents on an annual basis; or (ii) derive over 25% of their gross revenue from the sale of personal data and control or process the personal data of at least 25,000 Connecticut residents on an annual basis.
Certain entities are exempt from the DPA, including state and local governments, tax-exempt organizations, higher education institutions, financial institutions subject to the Gramm-Leach-Bliley Act, and “covered entities” and “business associates” as defined by the Health Insurance Portability and Accountability Act (HIPAA).
