On May 10, 2022, Connecticut became the fifth state to sign into law a comprehensive consumer privacy law. The law, the Connecticut Data Privacy Act (“CTDPA”), will go into effect on July 1, 2023, giving businesses fewer than 14 months to become compliant. The CDPA takes many cues from other recent state consumer privacy laws, such as California’s (CCPA), Colorado’s (CPA), and Virginia’s (“VCDPA”). These similarities include data processor obligations—like obtaining consent to process sensitive data—and the creation of data subject rights to delete, access, and correct data held by companies about subjects.
The CTDPA’s passage is yet another comprehensive state privacy law that businesses must consider when meeting their privacy obligations. It adds to the growing trend of states, acting as the “laboratories of democracy,” enacting privacy regimes to govern local data collection and use, and it puts further pressure on Congress to pass comprehensive federal privacy legislation to save companies from the headache of complying with the patchwork of privacy measures. Stay tuned for more information on the CTDPA and for additional state action on privacy laws.
Sources:
