On June 26, 2023, the Governor of Connecticut signed Senate Bill (SB) 3 which set forth new requirements related to consumer health data and protections for minors online.
As Connecticut’s comprehensive consumer privacy law took effect on July 1, 2023, the state has expanded privacy requirements under SB 3. Similar to Washington and Nevada, Connecticut sets standards for accessing and sharing consumer health data by private entities. The health data portions of the legislation took effect July 1, 2023.
Health Data Defined
Under the new legislation, consumer health data is defined as personal data that a controller uses to identify a consumer’s physical or mental health condition or diagnosis and includes but is not limited to gender-affirming health data and reproductive or sexual health data.
Certain types of information are excluded from coverage including protected health information under the Health Insurance Portability and Accountability Act (HIPAA).
Protections for Health Data
Covered entities are prohibited from collecting or sharing health data without a consumer’s consent. And health data may not be sold without a consumer completing a specified consent form.
The law also prohibits anyone from implementing a geofence to identify, track, collect data from, or send notifications or messages to a consumer that enters the virtual perimeter around a healthcare provider or facility.
Protections for Minors
Under the legislation, certain social media platforms are prohibited from establishing accounts for a minor under the age of 16 without a parent’s or guardian’s consent.
Moreover, covered platforms must delete a minor’s social media account and cease processing personal data within 10 days of receiving a request.
Some of the protections pertaining to minors do not take effect until October 1, 2024.
Enforcement
Under the legislation, any violation of either the consumer health data or online service provisions are enforced solely by the state attorney general. There is no private right of action created.
