Connecticut has joined California, Virginia, Colorado, and Utah in enacting comprehensive data privacy legislation, with a signature from Governor Lamont this week on the Connecticut Data Privacy Act (“CTDPA”). Meanwhile, the text of Virginia’s privacy law was amended and finalized, and the California Privacy Protection Agency (“CPPA”) held pre-rulemaking stakeholder sessions about topics related to automated decision-making, consumers’ rights, business’ concerns, and cybersecurity, among others. Companies should account for these changes as they develop and refine their privacy compliance programs.
Connecticut Data Privacy Act
The CTDPA draws heavily upon its predecessor statutes in Virginia and Colorado, with very few departures of significance.[1] Indeed, while the specific combination of features in the CTDPA may be unique, the combination is largely made of elements seen in at least one of its preceding laws. The CTDPA will become effective by its terms in a little over a year, on July 1, 2023[2] – six months after the California Privacy Rights Act (“CPRA”) and Virginia Consumer Data Protection Act (“VCDPA”), simultaneously with the Colorado Privacy Act (“CPA”), and six months before the Utah Consumer Privacy Act (“UCPA”).
Potentially one of the most significant differences between the CTDPA and other states’ laws may be within the threshold requirements. The CTDPA applies to persons that conduct business in Connecticut or produce products or services that are...
A former security officer at Reno’s Peppermill Casino claims its facial recognition technology routinely misidentified customers, sometimes producing as many as 12 false matches with 100% confidenc...