Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Connecticut has been in the forefront in protecting the personal information of its residents.&nbsp; In July 2010, in the first action by a state attorney general for violations of HIPAA since HITECH authorized state attorneys general to enforce HIPAA, a settlement was reached between HealthNet and the state of Connecticut &ndash; stemming from a May 2009 incident related to a lost computer disk containing the protected health and other private information of 1.5 million consumers nationwide.&nbsp; The incident affected nearly a half million Connecticut consumers.&nbsp; The settlement included HealthNet&rsquo;s payment of $250,000 to the state representing statutory damages and HealthNet&rsquo;s implementation of a corrective action plan.&nbsp; &nbsp;&nbsp;&nbsp;
Connecticut&rsquo;s commitment to its residents&rsquo; personal privacy continued into 2011.&nbsp; In September of 2011, Connecticut Attorney General George Jepsen announced the creation of a privacy task force to focus on internet and data privacy concerns.&nbsp; Since its creation, the Attorney General&rsquo;s office has publicly requested information from various entities, including the state Department of Labor, Central Connecticut State University, Wells Fargo, and Zappos, after receiving reports of security breaches affecting Connecticut residents.&nbsp; The requests for information have occurred without a statutory requirement for the notification of a security breach to the Attorney General&rsquo;s office.&nbsp; Recently, however, Connecticut joined the ranks of states requiring notification to the Attorney General following a breach incident.&nbsp;
On June 12, 2012, at an end of term General Assembly special session, Connecticut updated its existing data breach notification statute,&nbsp;Conn. Gen Stat. 36a-701b.&nbsp; The update appears on page 162 of the Connecticut General Assembly's June 12, 2012 Special Session <a href="http://cga.ct.gov/2012/TOB/h/pdf/2012HB-06001-R00-HB.pdf">Bill&nbsp;No. 6001</a>, a&nbsp;468 page house and senate budget bill. &nbsp;The updates to the statute are effective as of October 1, 2012.&nbsp;
The legislature, instead of amending the existing data breach notification statute, repealed the statute in full, replacing it with an amended version.&nbsp; The amended statute differs from the one it replaces as follows:
<ul>
<li>"breach of security&rdquo; is defined as the "unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable" (amended language is underlined);</li>
<li>If notice of a breach of security is required, notice must also be provided to the Attorney General at a time no later than when notice is provided to a resident;</li>
<li>the statute expressly states that the statute's notification requirements are applicable only to the personal information of a "resident of this state."</li>
</ul>
Personal information continues to be defined as an individual's first name or first initial and last name in combination with&nbsp;any one, or more, of the following data: (1) Social Security number; (2) driver's license number or state identification card number; or (3) account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account.&nbsp; Any violation of the statute continues to be&nbsp;considered an&nbsp;unfair trade practice under Connecticut&rsquo;s Unfair Trade Practices Act, with the Attorney General&nbsp;retaining enforcement authority, and no private right of action.
&nbsp;

Connecticut to Require Notice to Attorney General Following a Breach