CT Passes Data Breach Notification Legislation

The new law requires that consumers be given notice no later than 90 days from the discovery of a breach. In addition, it requires at least one year of free identity theft protection services for victims of breaches involving Social Security Numbers.

Connecticut Atty. General, George Jepsen indicates that the 90 days is an “outside limit for notification, but does not in any way diminish my discretion to seek relief against companies who unduly delay notifying those whose data has been compromised or my office. We intend to continue to scrutinize breaches and to take enforcement action against companies who unreasonably delay notification – even if notification is provided less than 90 days after discovery of the breach.”

“My office will continue to aggressively investigate these breaches and, where appropriate, take action when we feel that notification has not been reasonable or protections offered to consumers are not adequate,” said Jepsen.

For more information about Senate Bill 949, visit the Connecticut General Assembly’s website.