Substitute Senate Bill No. 3, known as Public Act No. 23-56, is a comprehensive piece of legislation aimed at enhancing online privacy, data, and safety protections, with a particular focus on consumer health data and the rights of minors. The bill amends Section 42-515 of the general statutes and introduces new definitions such as "abortion," "consumer health data," "consumer health data controller," and "gender-affirming health care services," while refining existing ones like "biometric data" and "sensitive data." It also updates legal language, redefines terms like "person" and "controller," and specifies the handling of consumer health data, including prohibitions on certain actions without consumer consent and exemptions for specific entities. The bill sets an effective date of July 1, 2023, for these changes.

The legislation also addresses the responsibilities of controllers and processors of personal data, particularly concerning minors, by establishing requirements for data protection assessments, consent for data collection, and safeguards against unsolicited communications from adults. It outlines exemptions for various types of information, such as protected health information under HIPAA, and clarifies that compliance with the act should not violate evidentiary privileges or adversely affect rights such as freedom of speech. Violations of the requirements are deemed unfair trade practices and are enforceable exclusively by the Attorney General, with a notice and cure period established before civil penalties can be applied. The bill also amends the powers of the Commissioner of Consumer Protection and the Attorney General, and redefines the Division of Scientific Services, effective July 1, 2023.

Statutes affected:
Committee Bill: 54-33c, 29-7b
JUD Joint Favorable Substitute: 54-33c, 29-7b
File No. 604: 54-33c, 29-7b
Public Act No. 23-56: 42-515, 42-524, 42-525, 29-7b