What does Connecticut's data breach law ask a business to do?

Who does this law apply to?

The law applies to any person who owns, licenses or maintains computerized data that includes personal information.

That person must notify each Connecticut resident whose personal information was breached or is reasonably believed to have been breached.

Any person who owns, licenses or maintains computerized data that includes personal information, shall provide notice of any breach of security following the discovery of the breach to any resident of this state whose personal information was breached or is reasonably believed to have been breached.

What counts as personal information?

Personal information is a first name or first initial and last name joined with items such as a Social Security number, a taxpayer identification number, a government identification number, a card or account number, medical or health insurance information, biometric information or precise geolocation data.

A user name or email address with the password or security question and answer for an online account is covered on its own.

first name or first initial and last name in combination with any one, or more, of the following data: (i) Social Security number; (ii) taxpayer identification number;

user name or electronic mail address, in combination with a password or security question and answer that would permit access to an online account.

How fast must people be told?

The text says notice must be made without unreasonable delay and not later than sixty days after the breach is discovered, unless federal law sets a shorter time.

No notice is due if, after an appropriate investigation, the person reasonably determines that the breach will not likely result in harm to the individuals.

Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law, subject to the provisions of subsection (d) of this section.

Such notification shall not be required if, after an appropriate investigation the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired or accessed.

Who else must be told?

The Attorney General must be told no later than the time notice goes to residents.

The person who owns, licenses or maintains computerized data that includes personal information, shall, not later than the time when notice is provided to the resident, also provide notice of the breach of security to the Attorney General;

Is encrypted information treated differently?

A breach under this law is access to personal information that was not secured by encryption or another method that makes it unreadable or unusable.

"breach of security" means unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data, containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable;

What if a vendor holds the data?

A person that maintains the data for someone else must tell the owner or licensee immediately after discovering a breach.

Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably believed to have been breached.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.