The Connecticut Data Protection Act (CTDPA) regulates the processing of personal data by businesses operating in Connecticut. It defines personal data as any information linked or reasonably linkable to an identified or identifiable individual. Key obligations include:
- Obtaining consent before processing sensitive data
- Providing an accessible privacy notice
- Fulfilling other obligations, such as allowing individuals to access and correct inaccuracies with their personal data
Violation Penalties
Violations of the CTDPA constitute an unfair trade practice under the Connecticut Unfair Trade Practices Act, which provides for penalties of:
- Up to $5,000 per willful violation
- Restitution
- Disgorgement
- Injunctive relief
Additionally, the law allows for:
- Civil penalties of up to $750 per violation
- Individuals’ right to sue businesses for damages if they suffer harm due to a violation of the CTDPA
The Connecticut Attorney General is responsible for enforcing the CTDPA.