Bill Text: CT HB05427 | 2012 | General Assembly | Introduced

---

Bill Title: An Act Concerning Notice To The Attorney General Of Data Security Breaches Involving The Disclosure Of Personal Information.

Spectrum: Committee Bill

Status: (Introduced - Dead) 2012-03-09 - Public Hearing 03/14 [HB05427 Detail]

Download: Connecticut-2012-HB05427-Introduced.html

---

General Assembly		Raised Bill No. 5427
February Session, 2012		LCO No. 1909
		*01909_______JUD*
Referred to Committee on Judiciary
Introduced by:
(JUD)

AN ACT CONCERNING NOTICE TO THE ATTORNEY GENERAL OF DATA SECURITY BREACHES INVOLVING THE DISCLOSURE OF PERSONAL INFORMATION.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 36a-701b of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2012):

(a) For purposes of this section, "breach of security" means unauthorized access to or acquisition of electronic files, media, databases or computerized data containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable; "personal information" means an individual's first name or first initial and last name in combination with any one, or more, of the following data: (1) Social Security number; (2) driver's license number or state identification card number; or (3) account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account. "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.

(b) Any person who conducts business in this state, and who, in the ordinary course of such person's business, owns, licenses or maintains computerized data that includes personal information, shall [disclose] provide notice of any breach of security following the discovery of the breach to the Attorney General immediately following the discovery of the breach of security and to any resident of this state whose personal information was, or is reasonably believed to have been, accessed by an unauthorized person through such breach of security. [Such disclosure] Notice to a resident of this state shall be made without unreasonable delay, subject to the provisions of subsection (d) of this section and the completion of an investigation by such person to determine the nature and scope of the incident, to identify the individuals affected, or to restore the reasonable integrity of the data system. [Such notification] Notification to affected residents shall not be required if, after an appropriate investigation and consultation with relevant federal, state and local agencies responsible for law enforcement, the person reasonably determines that the breach will not likely result in harm to the individuals whose personal information has been acquired and accessed.

(c) Any person that maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following its discovery, if the personal information was, or is reasonably believed to have been accessed by an unauthorized person.

(d) Any notification to a resident of this state required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed. Any such delayed notification shall be made after such law enforcement agency determines that notification will not compromise the criminal investigation and so notifies the person of such determination. Nothing in this section shall relieve any person of the obligation to notify the Attorney General of a breach of security immediately following the discovery of such breach of security.

(e) Any notice to a resident, owner or licensee required by the provisions of this section may be provided by one of the following methods: (1) Written notice; (2) telephone notice; (3) electronic notice, provided such notice is consistent with the provisions regarding electronic records and signatures set forth in 15 USC 7001; (4) substitute notice, provided such person demonstrates that the cost of providing notice in accordance with subdivision (1), (2) or (3) of this subsection would exceed two hundred fifty thousand dollars, that the affected class of subject persons to be notified exceeds five hundred thousand persons or that the person does not have sufficient contact information. Substitute notice shall consist of the following: (A) Electronic mail notice when the person [, business or agency] has an electronic mail address for the affected persons; (B) conspicuous posting of the notice on the web site of the person [, business or agency] if the person maintains one; and (C) notification to major state-wide media, including newspapers, radio and television.

(f) Any person that maintains such person's own security breach procedures as part of an information security policy for the treatment of personal information and otherwise complies with the timing requirements of this section, shall be deemed to be in compliance with the security breach notification requirements of this section pertaining to affected residents, owners and licensees, provided such person notifies subject persons in accordance with such person's policies in the event of a breach of security. Any person that maintains such a security breach procedure pursuant to the rules, regulations, procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), shall be deemed to be in compliance with the security breach notification requirements of this section pertaining to affected residents, owners and licensees, provided such person notifies subject persons in accordance with the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security of the system.

(g) Failure to comply with the requirements of this section shall constitute an unfair trade practice for purposes of section 42-110b and shall be enforced by the Attorney General.

This act shall take effect as follows and shall amend the following sections:
Section 1	October 1, 2012	36a-701b

Statement of Purpose:

To require that persons who own, license or maintain computerized data that includes personal information immediately notify the Attorney General in the event of a breach of security relating to such data.

[Proposed deletions are enclosed in brackets. Proposed additions are indicated by underline, except that when the entire text of a bill or resolution or a section of a bill or resolution is new, it is not underlined.]