Did You Know?

• There are specific considerations when determining if a breach is reportable
• There are education sector-specific vendor contract requirements that establish the need for breach of security obligation provisions
• Connecticut requires mandatory provision of appropriate identity theft prevention services and, if applicable, identity theft mitigation services
• There are different statutes for particular sectors. Statutes for entities regulated by the Insurance Commissioner have a notification deadline of 5 days. Statutes related to student personal information between a local or regional board of education and their contractors, consultants, and operators have notification deadlines ranging from 48 hours to 60 days
• Notifications may only be given by specific methods
• Notification must be given to the state attorney general
• f a vendor is breached, they must report it to the data owner. The data owner will be responsible to complete the reporting and consumer notification
• If your breach affects residents in other states you will need to notify those residents using that state’s rules
• Violating the statutes constitutes an unfair trade practice
• Connecticut has additional laws related to the protection of personal data to prevent a breach
• Federal laws, industry regulations, and/or out-of-country laws may also apply