Enforcement and Penalties

What it requires

Vests enforcement authority exclusively in the Connecticut Attorney General; there is no private right of action. Each violation of sections 42-515 to 42-524, inclusive, or section 42-526 (consumer health data privacy) constitutes an unfair trade practice under the Connecticut Unfair Trade Practices Act (CUTPA), carrying civil penalties of up to $5,000 per willful violation, in addition to injunctive relief and restitution. The mandatory 60-day right to cure sunset on December 31, 2024, so the Attorney General may now bring an enforcement action at its discretion without first affording an opportunity to cure.

Statute text

(a) The Attorney General shall have exclusive authority to enforce violations of sections 42-515 to 42-524, inclusive, and section 42-526. [...] (c) Beginning on January 1, 2025, the Attorney General may, in determining whether to grant a controller, processor or consumer health data controller the opportunity to cure an alleged violation described in subsection (b) of this section, consider: [...] (d) Nothing in sections 42-515 to 42-524, inclusive, or section 42-526, shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law. (e) A violation of the requirements of sections 42-515 to 42-524, inclusive, or section 42-526, shall constitute an unfair trade practice for purposes of section 42-110b and shall be enforced solely by the Attorney General, provided the provisions of section 42-110g shall not apply to such violation.

Connecticut Data Privacy Act, § 42-525Read the full section from Connecticut Office of the Attorney General