Connecticut HB 5208: AN ACT CONCERNING DATA SECURITY, PAYROLL PROCESSING, CONSUMER FRAUD PROTECTION, MORTGAGE LOANS AND EMPLOYEE CREDIT RATES.

Bill Text

House Bill No. 5208 
 
Public Act No. 26-51 
 
 
AN ACT CONCERNING DATA SECURITY, PAYROLL PROCESSING, 
CONSUMER   FRAUD   PROTECTION,   MORTGAGE   LOANS AND 
EMPLOYEE CREDIT RATES. 
Be  it  enacted  by  the  Senate  and  House  of  Representatives  in General 
Assembly convened: 
 
Section 1. Section 36a-44a of the general statutes is repealed and the 
following is substituted in lieu thereof (Effective October 1, 2026): 
(a) As used in this section: 
(1)  "Data  security  incident"  means  any  unauthorized  access  to  or 
unauthorized  acquisition,  destruction  or  corruption  of  electronic  files, 
media,   databases   or   computerized   data   containing   (A)   personal 
information of an individual, or (B) supervisory, financial, operational 
or   business   information   of   any   (i)   licensee   under   this   title,   (ii) 
Connecticut bank, or (iii) Connecticut credit union; 
(2)  "Financial  institution"  has  the  same  meaning  as  provided  in 
Section 509 of the Gramm-Leach-Bliley Financial Modernization Act of 
1999, 15 USC 6809, and the regulations promulgated thereunder, as said 
act and such regulations may be amended from time to time; and 
(3)  "Personal  information"  has  the  same  meaning  as  provided  in 
section 36a-701b. 

House Bill No. 5208 
 
Public Act No. 26-51 2 of 6 
 
(b) Each  financial  institution  that  is  a  bank, a Connecticut  credit 
union, a federal  credit  union,  an  out-of-state  bank  that  maintains  a 
branch in this state, an out-of-state trust company or out-of-state credit 
union  that  maintains  an  office  in  this  state [,] or a  licensee  under  this 
title, [or any] and   each person   subject   to   the   jurisdiction   of   the 
commissioner under title 36b, shall (1) adopt, in writing, a program that 
sets  forth  standards  for  developing,  implementing  and  maintaining 
reasonable    data security    safeguards    to    protect    the    security, 
confidentiality   and   integrity   of   customer   information   and   that   is 
consistent with applicable federal regulations, and (2) comply with all 
provisions of Subtitle A of Title V of the Gramm-Leach-Bliley Financial 
Modernization  Act  of  1999,  15  USC  6801  et  seq.,  and  the  regulations 
promulgated thereunder that apply to such financial institution [, except 
to] or person, including, but not limited to, the applicable provisions of 
12 CFR Part 364, Appendix B, 12 CFR Part 748, Appendix A and 16 CFR 
Part 314, as said act and such regulations may be amended from time to 
time. To the extent that this [section] subsection is inconsistent with the 
provisions  of  sections  36a-41  to  36a-44,  inclusive, [in  which  case] the 
provisions that afford the customer greater protection shall control. [For 
purposes of this section, "financial institution" has the meaning given to 
that   term   in   Section   509   of   the   Gramm-Leach-Bliley   Financial 
Modernization   Act   of   1999,   15   USC   6809,   and   the   regulations 
promulgated thereunder.] 
(c) Each licensee under this title, Connecticut bank and Connecticut 
credit  union  shall  file  an  initial  notification  with  the  Department  of 
Banking,    in    a    form    and    manner    prescribed    by    the    Banking 
Commissioner,  not  later  than  three  business  days  after  such licensee, 
Connecticut bank or Connecticut credit union knows, or has reason to 
know,  of  the  occurrence  of  any  data  security  incident  that  may  (1) 
materially  impact  its  ability  to  operate  in  a  safe  and  sound  manner  or 
comply  with  applicable  laws  and  regulations,  (2)  cause  significant 
disruption in customer services, or (3) involve any unauthorized access 

House Bill No. 5208 
 
Public Act No. 26-51 3 of 6 
 
to    the    personal    information    of    any    individual.    The    Banking 
Commissioner may request additional information regarding any such 
occurrence subsequent to the filing of such initial notification. 
Sec.  2.  (Effective  from  passage)  The  Department  of  Banking  shall 
conduct  a  study  concerning  payroll  processing  methods  employed  by 
financial institutions and the time required for payroll checks to clear. 
Not later than January 1, 2027, the Department of Banking shall submit 
a  report  on its  findings  and  recommendations  to  the  joint  standing 
committee  of  the  General  Assembly  having  cognizance  of  matters 
relating to banking, in accordance with the provisions of section 11-4a 
of the general statutes. 
Sec. 3. (Effective from passage) (a) The chairpersons of the joint standing 
committee  of  the  General  Assembly  having  cognizance  of  matters 
relating to banking shall convene a working group to study consumer 
fraud and protections against such fraud. 
(b) The working group shall include, but need not be limited to, the 
following members: 
(1)  The  chairpersons  and  ranking  members  of  the  joint  standing 
committe