Connecticut AG Issues Report Urging Legislature to Adopt Strong Data Minimization

The Connecticut Attorney General’s office published a new report discussing trends after its first year enforcing of the Connecticut Data Privacy Act (CTDPA) and recommending legislative fixes that would allow the office to better protect consumers’ privacy. This report updates an earlier one discussing trends and legislative recommendations after six months of the CTDPA being in effect.

The AG makes the following recommendations to the Legislature: scale back exemptions, including omitting entity-level exemptions; lower applicability thresholds to cover more businesses; strengthen data minimization provisions rather than relying on an “exploitable” notice-and-choice regime; expand the “sensitive data” definition; strengthen provisions protecting minors’ data; narrow the “publicly available information” definition; give consumers the right to know the specific third parties that their data is disclosed to; and expand the opt-out preference signal and deletion mechanisms to make them easier for consumers to use.

Nearly all of these suggested changes are incorporated into EPIC and Consumer Reports’ model bill, which uses the CTDPA as the base text but adds important strengthening amendments.

Sen. James Maroney, the original sponsor of the CTDPA, is sponsoring a bill this legislative session that would update the law. The update bill, S.B. 1356, includes many of the AG’s recommendations.

EPIC previously testified in support of this bill and discussed the AG’s updated report on StateScoop’s podcast. EPIC urges the Connecticut Legislature to incorporate the Attorney General’s recommendations in further amending the CTDPA.