Connecticut HB 5210: AN ACT CONCERNING REVISIONS TO THE CONNECTICUT GUIDELINES FOR EDUCATOR EVALUATION.

Bill Text

LCO 1 of 3

General Assembly Substitute Bill No. 5210
February Session, 2026

AN ACT ESTABLISHING VARIOUS DATA SECURITY
REQUIREMENTS APPLICABLE TO CERTAIN FINANCIAL
INSTITUTIONS.
Be it enacted by the Senate and House of Representatives in General
Assembly convened:

Section 1. Section 36a-44a of the general statutes is repealed and the 1
following is substituted in lieu thereof (Effective October 1, 2026): 2
(a) As used in this section: 3
(1) "Data security incident" means any unauthorized access to or 4
unauthorized acquisition, destruction or corruption of electronic files, 5
media, databases or computerized data containing (A) personal 6
information of an individual, or (B) supervisory, financial, operational 7
or business information of any (i) licensee under this title, (ii) 8
Connecticut bank, or (iii) Connecticut credit union; 9
(2) "Financial institution" has the same meaning as provided in 10
Section 509 of the Gramm-Leach-Bliley Financial Modernization Act of 11
1999, 15 USC 6809, and the regulations promulgated thereunder, as said 12
act and such regulations may be amended from time to time; and 13
(3) "Personal information" has the same meaning as provided in 14
section 36a-701b. 15

Substitute Bill No. 5210

LCO 2 of 3

(b) Each financial institution that is a bank, a Connecticut credit 16
union, a federal credit union, an out-of-state bank that maintains a 17
branch in this state, an out-of-state trust company or out-of-state credit 18
union that maintains an office in this state [,] or a licensee under this 19
title, [or any] and each person subject to the jurisdiction of the 20
commissioner under title 36b, shall (1) adopt, in writing, a program 21
setting forth standards for developing, implementing and maintaining 22
reasonable data security safeguards to protect the security, 23
confidentiality and integrity of customer information, and (2) comply 24
with all provisions of Subtitle A of Title V of the Gramm-Leach-Bliley 25
Financial Modernization Act of 1999, 15 USC 6801 et seq., and the 26
regulations promulgated thereunder that apply to such financial 27
institution [, except to] or person, including, but not limited to, the 28
applicable provisions of 12 CFR Part 364, Appendix B, 12 CFR Part 748, 29
Appendix A and 16 CFR Part 314, as said act and such regulations may 30
be amended from time to time. To the extent that this [section] 31
subsection is inconsistent with the provisions of sections 36a-41 to 36a-32
44, inclusive, [in which case] the provisions that afford the customer 33
greater protection shall control. [For purposes of this section, "financial 34
institution" has the meaning given to that term in Section 509 of the 35
Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 USC 6809, 36
and the regulations promulgated thereunder.] 37
(c) Each licensee under this title, Connecticut bank and Connecticut 38
credit union shall file a notification with the Department of Banking, in 39
a form and manner prescribed by the Banking Commissioner, not later 40
than three business days after such licensee, Connecticut bank or 41
Connecticut credit union knows, or has reason to know, of the 42
occurrence of any data security incident that may (1) materially impact 43
its ability to operate in a safe and sound manner or comply with 44
applicable laws and regulations, (2) cause significant disruption in 45
customer services, or (3) involve any unauthorized access to the 46
personal information of any individual. 47

Substitute Bill No. 5210

LCO 3 of 3

This act shall take effect as follows and shall amend the following
sections:

Section 1 October 1, 2026 36a-44a

BA Joint Favorable Subst.