For the last few years, Connecticut lawmakers have been working to develop legislation providing stronger protections for consumer data — a task made all the more urgent as the COVID-19 pandemic drove much of daily life and work online.
After efforts stalled in the 2021 session, a new push this year could add Connecticut to the growing list of states enacting consumer data privacy laws.
Senate Bill 6, which could be heard on the floor as soon as next week, would allow consumers to see which companies are collecting their data and what data those companies are collecting — and to opt out of sales of that information to third parties. Consumers under 18 would have to opt in to data collection.
The law would also require companies to notify consumers about their privacy rights and to protect the data they collect. The law would go into effect July 1, 2023.
“In absence of action by the federal government, it’s incumbent upon the states to step up to protect our citizens and their privacy,” said Sen. James Maroney, D-Milford, chair of the General Assembly’s general law committee, which introduced the bill.
Maroney said he’s spent much of the last two years working with lobbyists and advocates around the country to ensure the legislation aligns with other states’ laws and doesn’t create challenges for companies that operate across state lines.
“I’ve gone to great lengths to ensure interoperability,” he said.
The protections provided in Connecticut’s S.B. 6 hew closely to those in the Colorado Privacy Act, enacted last year — which landed between the Virginia Consumer Data Protection Act and the stronger California laws passed in 2018 and 2020. More than a dozen states are considering similar bills this year, including Massachusetts, New York and Rhode Island.
During public testimony before the general law committee, the bill received pushback from business groups who argued that the ability to collect and share data was important to their operations. Several raised concerns about the costs of compliance and questioned whether the legislation was duplicative to other regulations already in place. Hospitals, utilities and other groups proposed making exemptions for certain types of organizations.
“As presently drafted, S.B. 6 contains provisions that could hinder Connecticut residents’ access to valuable ad-supported online resources, impede their ability to exercise choice in the marketplace, and harm businesses of all sizes, including tens of thousands of jobs tied to the advertising industry in Connecticut, that support the economy,” members of the Digital Advertising Alliance, an industry group, argued in written testimony.
On the other end of the spectrum, Maureen Mahoney of Consumer Reports advocated for the bill to go further in expanding consumer privacy rights.
A group representing trial lawyers, opposed a provision in the bill that limits enforcement to the attorney general and doesn’t allow consumers to seek civil damages directly from a business.
Connecticut Attorney General William Tong testified in support of the bill, writing: “The bill enables our Office to appropriately investigate potential violations and make use of a wider array of redress options, including penalties and injunctive relief where circumstances warrant.” Among Tong’s misgivings, however, was the potential for “sweeping exemptions that could serve to dilute the effect of the law.”
The general law committee approved the bill with a vote of 14-4 on March 15. It was referred to the Judiciary Committee, where it passed by a narrower margin this week. It could reach the Senate floor for debate as soon as next week.
Maroney said many of the concerns raised in committee have already been addressed, and several provisions in the bill are still being negotiated. For example, he said, the opt-in age limit could fall to 13 or 16, as is the case in other states’ laws.
Lawmakers said a tremendous amount of work has gone into drafting the bill and engaging with a broad array of constituent groups over the last year.
This year marks Maroney’s third attempt to get the consumer privacy legislation passed, and he’s feeling confident.
“They usually say with major legislation, it takes at least three times to get it across the finish line,” he said. “This is my third try, so I’m hoping that proves true.”