Connecticut House Bill HB05989

Connecticut 2019 Regular Session

• Introduced: 1/24/19
• Refer: 1/24/19

Caption

An Act Concerning Protection For Certain Business Data Holders In The Event Of A Data Breach.

Impact

If enacted, HB 5989 could significantly impact the responsibilities and liabilities of businesses that handle sensitive data. By establishing a clear criterion—having a cybersecurity program in place based on industry standards—it sets a legal benchmark for compliance. This may incentivize businesses to invest more in cybersecurity measures to protect themselves from potential liabilities following a data breach. As cybersecurity becomes increasingly critical in the digital age, the law aims to bolster the protection of business data, potentially leading to enhanced corporate responsibility and accountability in data management.

Summary

House Bill 5989 aims to amend the general statutes to provide legal protection for certain business data holders in the event of a data breach. The bill specifies that such protections will be granted if the business can demonstrate that it had an established cybersecurity program in place at the time of the breach, which aligns with recognized industry security frameworks. This legislative measure seeks to encourage businesses to adopt robust cybersecurity measures while providing them a level of protection from liability in the event of a breach under certain conditions.

Contention

While there is a general consensus on the need for enhanced cybersecurity measures, some points of contention could arise regarding the specifics of what constitutes acceptable cybersecurity programs and the implications for businesses failing to meet these standards. Additionally, the bill may spark discussions about the extent of liability protection offered to businesses and whether it could lead to complacency in data protection due to perceived safety nets. Critics might argue that simply having a program in place should not exonerate businesses from their responsibilities regarding data protection, especially in cases of negligence.