Substitute Bill No. 1356 aims to strengthen data privacy protections and regulate the handling of personal data, particularly in relation to online monitoring, social media, data brokers, and connected vehicle services. The bill repeals Section 42-515 of the general statutes and introduces new definitions for various types of personal data, including "biometric data," "consumer health data," and "neural data," while emphasizing the necessity of obtaining clear consumer consent for data processing. It modifies existing definitions to enhance clarity, such as changing "are used to identify" to "can be associated with" in the context of biometric data. The bill also introduces the concept of "dark patterns" and expands the definition of "sensitive data" to include various personal identifiers and health-related information, thereby enhancing consumer rights and protections.

Additionally, the bill imposes new obligations on data controllers, including limiting data collection to what is necessary and maintaining robust data security practices. It grants consumers rights to delete their personal data, access it in a portable format, and receive information about third parties to whom their data has been sold. The bill also introduces regulations for data brokers, requiring them to register with the Department of Consumer Protection and imposing penalties for violations. Notably, it enhances protections for minors and survivors of domestic violence regarding their personal data and connected vehicle services. The changes are set to take effect on October 1, 2025, and aim to create a more transparent and responsible framework for data management in Connecticut.

Statutes affected:
Raised Bill: 42-515, 42-516, 42-524, 42-529, 42-529a
GL Joint Favorable Substitute: 42-515, 42-516, 42-529a
File No. 609: 42-515, 42-516, 42-529a
JUD Joint Favorable: 42-515, 42-516, 42-529a
APP Joint Favorable: 42-515, 42-516, 42-529a