Connecticut SB 117: AN ACT PHASING OUT THE REAL ESTATE CONVEYANCE TAX.

Bill Text

LCO 1 of 9

General Assembly Substitute Bill No. 117
February Session, 2026

AN ACT CONCERNING BREACHES OF SECURITY INVOLVING
ELECTRONIC PERSONAL INFORMATION.
Be it enacted by the Senate and House of Representatives in General
Assembly convened:

Section 1. Section 36a-701b of the general statutes is repealed and the 1
following is substituted in lieu thereof (Effective October 1, 2026): 2
(a) For purposes of this section: [,] 3
(1) ["breach of security"] "Breach of security" means unauthorized 4
access to, or unauthorized acquisition of, electronic files, media, 5
databases or computerized data [,] containing personal information 6
when access to the personal information has not been secured by 7
encryption or by any other method or technology that renders the 8
personal information unreadable or unusable; [and (2) "personal 9
information"] 10
(2) "Massive breach of security" means a breach of security where (A) 11
the personal information of at least one hundred thousand residents of 12
this state has been breached or is likely to have been breached, and (B) 13
the breach of security occurred due to any unauthorized access to, or 14
any unauthorized use of, a computer or computer network; and 15
(3) "Personal information" means an individual's (A) first name or 16
first initial and last name in combination with any one, or more, of the 17

Substitute Bill No. 117

LCO 2 of 9

following data: (i) Social Security number; (ii) taxpayer identification 18
number; (iii) identity protection personal identification number issued 19
by the Internal Revenue Service; (iv) driver's license number, state 20
identification card number, passport number, military identification 21
number or other identification number issued by the government that is 22
commonly used to verify identity; (v) credit or debit card number; (vi) 23
financial account number in combination with any required security 24
code, access code or password that would permit access to such 25
financial account; (vii) medical information regarding an individual's 26
medical history, mental or physical condition [,] or medical treatment or 27
diagnosis by a health care professional; (viii) health insurance policy 28
number or subscriber identification number, or any unique identifier 29
used by a health insurer to identify the individual; (ix) biometric 30
information consisting of data generated by electronic measurements of 31
an individual's unique physical characteristics used to authenticate or 32
ascertain the individual's identity, such as a fingerprint, voice print [,] 33
or retina or iris image; or (x) precise geolocation data, as defined in 34
section 42-515; or (B) user name or electronic mail address, in 35
combination with a password or security question and answer that 36
would permit access to an online account. "Personal information" does 37
not include publicly available information that is lawfully made 38
available to the general public from federal, state or local government 39
records or widely distributed media. 40
(b) (1) Any person who owns, licenses or maintains computerized 41
data that includes personal information [,] shall provide notice of any 42
breach of security, following the discovery of the breach, to any resident 43
of this state whose personal information was breached or is reasonably 44
believed to have been breached. Such notice shall be made without 45
unreasonable delay but not later than sixty days after the discovery of 46
such breach, unless a shorter time is required under federal law, subject 47
to the provisions of subsection (d) of this section. If the person identifies 48
additional residents of this state whose personal information was 49
breached or reasonably believed to have been breached following sixty 50
days after the discovery of such breach, the person shall proceed in good 51

Substitute Bill No. 117

LCO 3 of 9

faith to notify such additional residents as expediently as possible. Such 52
notification shall not be required if, after an appropriate investigation, 53
the person reasonably determines that the breach will not likely result 54
in harm to the individuals whose personal information has been 55
acquired or accessed. 56
(2) If notice of a breach of security is required by subdivision (1) of 57
this subsection: 58
(A) The person who owns, licenses or maintains the computerized 59
data that includes the personal information [,] shall, not later than the 60
time when notice is provided to the resident, also provide notice of the 61
breach of security to the Attorney General in a form and manner 62
prescribed by the Attorney General; and 63
(B) The person who owns or licenses the computerized data that 64
includes the personal information [,] shall offer to each resident whose 65
personal information under clause (i) or (ii) of subparagraph (A) of 66
subdivision [(2)] (3) of subsection (a) of this section was breached, or is 67
reasonably believed to have been breached, appropriate identity