Privacy & Information Security Law Blog

Effective October 1, 2018, Connecticut law requires organizations that experience a security breach affecting Connecticut residents’ Social Security numbers (“SSNs”) to provide 24 months of credit monitoring to affected individuals. Previously, Connecticut law required entities to provide 12 months of credit monitoring for breaches affecting SSNs.

The amendment was passed as part of Public Act 18-90, An Act Concerning Security Freezes on Credit Reports, Identity Theft Prevention Services and Regulations of Credit Rating Agencies. Among other requirements, the Act also eliminates fees for placing and lifting a security freeze and requires consumer reporting agencies to (1) act on requests related to credit freezes as soon as practicable, but no later than 5 days for requests to place a security freeze or 3 days for requests to remove a security freeze, and (2) offer to notify the other consumer reporting agencies of the request for a credit freeze on behalf of the consumer.