Committee debates aligning S.71 with Connecticut 2025 privacy law

The Committee of Commerce & Economic Development met May 7, 2026, to review S.71, a proposed consumer privacy bill. David Barhouse, chair, said the committee would seek drafting help from staff and that the group was considering using Connecticut's 2025 privacy law as the baseline for the state draft.

A staff member leading the discussion said the committee's working approach is to "make a copy of Connecticut 2025" but to remove or reset several definitions that businesses testified would be problematic. The staff member listed items proposed for removal, including keystrokes and "online activity of a consumer over time and across devices," and said the draft would adopt Connecticut's targeted-advertising definition while excluding first-party, contextual and unique persistent-identifier language.

The staff member also proposed narrowing an exemption related to HIPAA. Under the suggested approach the exemption would be entity-based—covering covered entities and business associates—rather than a data-level exemption. The staff member said the draft would align with an earlier 01/21 formulation that treated HIPAA-covered entities and their health-care components differently from other business components.

On enforcement, the staff member said the bill could preserve the attorney general as the primary enforcer while allowing a private right of action only in limited circumstances, proposing "a private right of action at 1000000000 dollars" in revenue as the threshold for private suits under the state's Consumer Protection Act.

Committee members raised several concerns. Multiple members urged keeping protections for some categories beyond what Connecticut's 2025 text includes; staff pointed out that Connecticut's updates — scheduled to take effect July 1 — include additional items such as impact-assessment requirements, transparency rules and restrictions on automated profiling and AI-driven decision-making.

Members debated how to treat medical providers that are not HIPAA-covered entities (for example, some free clinics). One committee member said such providers should be "exempted in the same sort of manner" as HIPAA-covered entities if they accept similar privacy and security safeguards; other members warned against creating exemptions for entities that do not demonstrably meet comparable protections.

A committee member recommended basing cybersecurity requirements on NIST Cybersecurity Framework 2 (CSF 2) and said reasonable baseline controls — plans, backups and multifactor authentication — should be required of processors, with discussion continuing about whether controllers of any size should be included.

Members discussed practical steps for implementation and enforcement. Staff noted Maryland had delayed enforcement until the attorney general's office received budgeted staff; several members said the state should consider funding technical assistance for smaller businesses and an 18-month implementation window so businesses have time to comply.

The chair asked staffer Rick to prepare drafting changes and said the committee would review an updated draft and meet again. Rick was expected to drop a revision around 1:00 p.m. for review with Cameron and Susan McCorran, and the committee planned to reconvene the next morning at 9:00 a.m.; action on H.648 was deferred for two legislative days.

The committee did not take a final vote at the May 7 meeting; members directed staff to bring revised draft language and to follow up with stakeholders and small providers before further action.