Hartford Business Journal

24 HARTFORDBUSINESS.COM | June 20, 2022 William Roberts is a partner in the Hartford office of law firm Day Pitney LLP, where he focuses on data security issues. PHOTO | CONTRIBUTED New data privacy law will mean big changes for some CT businesses By Linda Keslar Hartford Business Journal Contributor C onnecticut is among a handful of states stepping up efforts to protect the privacy of consumer data, with the passage of a new law raising plenty of questions and concerns for businesses both in and outside the state that target Connecticut consumers. "Businesses are going to need to change their ways," said Jeff Ziplow, a principal at accounting and consulting firm CLA in West Hartford, who specializes in cybersecurity and business risk services. "In the past, it's been almost like a free-for-all in terms of businesses being able to capture any information they've wanted." The Connecticut Data Privacy Act (CDPA), signed into law on May 10, establishes rules for businesses operating in the state regarding how people's data is collected and shared online. It also creates a new set of rights for consumers, giving them more control over their personal online data, including accessing, correcting and deleting it, even the option to opt out of data sales, targeted advertising and profiling. "The Connecticut law is allowing consumers to say 'I don't want to be tracked across applications, I don't want my personal data sold and I don't want to be targeted by advertisers based on my activities on your website or others," said Marc Lombardi, a partner and chair of privacy, cybersecurity and data innovation at Hartford-based law firm Shipman & Goodwin LLC. Growing trend The state's actions are a response to growing consumer awareness around their data privacy as well as the rising incidence of data breaches, when that sensitive data is stolen from a third-party vendor. Nearly half of survey respondents to a recent Cisco Consumer Privacy Survey, for example, said they felt unable to protect their personal data today, citing companies not being clear about how they are using this data as the top reason. Most respondents also want their national or local governments to play a lead role with respect to protecting data privacy. Besides Connecticut, five additional states — Virginia, Utah, Colorado, California and Nevada — have also passed privacy laws regulating how businesses buy, sell, license and share data, some with stricter parameters in place than others. California consumers, for example, can pursue legal action for a breach of certain information. In Connecticut, the attorney general's office will handle the enforcement of the CDPA through fines and other penalties. Data privacy legislation is also underway in nine other states, according to the International Association of Privacy Professionals, including Massachusetts, New York and Rhode Island. There are also growing calls for a broader national data protection law that would overturn the jumble of state actions. "It's seemingly inevitable that there will be a national privacy law that will supersede or pre-empt these different state laws," said Russell Anderson, a business and technology attorney with law firm Pullman & Comley. Scope of impact The new Connecticut law, which takes effect July 1, 2023, is creating a learning curve for legal experts, who say they are just beginning to receive calls from businesses concerned about whether they need to comply with its provisions. "The law only came out in the last few weeks, so we're all in the process of learning it," Anderson said. The CDPA impacts businesses that handle the data of at least 100,000 consumers annually, or those who earn 25% of their annual gross revenue from the sales of data of more than 25,000 consumers. Handling data generated by 100,000 residents is common among many national and international Jeff Ziplow Marc Lombardi

• Cover