A bill that would give Connecticut residents better control over their personal data online passed the Senate on Wednesday in a unanimous vote.
If it passes the House and is signed into law, Senate Bill 6 would allow consumers to determine what companies are collecting their personal data and would allow them access to that data. It would also allow them to correct or delete that data and opt out of the use of that data for sale, targeted advertising, and profiling.
“I am honored to have been able to work with advocates, analysts from the data privacy industry, and my fellow senators and representatives to help craft a bill that protects our residents online,” said Sen. James Maroney, D-Milford, co-author of the bill. “This piece of legislation provides some of the strongest privacy protections for children in the country, while not overly burdening small businesses. In our connected world, almost all of our movements can be tracked. This will give us the right to know what is being tracked about us and the ability to opt out of the sale of our personal data.”
It’s modeled, in part, on a bill out of Colorado, but has a much lower threshold for coverage and includes additional protections for minors. The bill would cover companies that collect data on more than 75,000 consumers in the state OR companies who make a quarter of their revenue from selling the data of at least 25,000 Connecticut consumers.
Those companies would be required to be more transparent about their data collection practices, would have to disclose when they sell personal data, and would need to include a privacy policy with a means of contacting the company. They would also be required to allow consumers to opt out of their data being used for tracking, targeted advertising, or sale and would not be allowed to discriminate against users who choose to opt out of these services.
The bill does make some exceptions for businesses that process customer data solely for the purpose of making transactions. Maroney cited the example of a local convenience store that might collect payment information of thousands of customers but doesn’t use or sell that data for any other purpose.
Republicans on the floor of the Senate lauded the bill as consumer-friendly while not going so far as to be anti-business, noting that it includes protections against abusive claims and methods by which businesses can address issues with their systems. Everyone speaking during Wednesday’s debate noted their own increasing concerns with data collection, sale, and privacy as the world moves further into online spaces.
“I find it quite interesting, and scary if you will, what is out there about you,” said Sen. Kevin Witkos, R-Canton. “And I think this bill goes a long way to start addressing those concerns and give you a blanket of security when you opt out of some of these things.”
The bill also allows for authorized agents to opt out on behalf of another person who might not be able to do it for themselves. The bill doesn’t establish specific criteria for becoming an authorized agent, but some people – like parents or conservators – are automatically considered to serve in this role.
“This is a very well-thought-out bill,” said Sen. Saud Anwar, D-South Windsor, “It is going to help consumers. It is protective.”
The program would be enforced by the Attorney General’s Office and as a result would carry costs associated with hiring additional employees to handle investigating and litigating cases. Witkos says he spoke with the AG’s office and was told they already have people in the office working on data privacy. As a result, they would only need to hire two additional lawyers, an investigator, a paralegal, and an administrative assistant. Witkos called this “a good deal” since it would “protect the data of 3.5 million people.”
The bill will next head to the floor of the House where it will likely face additional debate and possible amendments. During the debate in the Judiciary Committee, some representatives expressed concerns over scope and enforcement, hoping to add provisions to allow exceptions for restaurants and a way for private citizens to enforce the law.
If passed, it is set to go into effect in July of next year.
