PIRG comment in support of Connecticut’s updated data privacy bill

Connecticut is considering a bill to update its consumer data privacy law, the Connecticut Data Privacy Act. The bill, SB 1356, would strengthen the law’s data minimization provisions, close exemption loopholes, and ban the sale of sensitive data without consent.

On February 26, PIRG associate Ellen Hengesbach testified in support of SB 1356. Read her testimony below.

February 26, 2025

Chair Maroney, Chair Lemar, Members of the Committee:

Thank you for the opportunity to testify today in support of SB 1356. PIRG supports SB 1356 because it is a common-sense update to the Connecticut Data Privacy Act that will provide meaningful protections consumers currently lack. These protections include banning the sale of sensitive data without consent and limiting the collection of personal data to what’s necessary to provide the product a consumer is looking for.

These updates to the Connecticut Data Privacy Act are critical.

When we use our favorite apps, websites or smart devices, the companies on the other side are often gathering far more information about us than what’s necessary to deliver the service we’re expecting to get. 

For instance, a report from the Mozilla Foundation found that some major car companies may collect surprisingly intimate information about their customers, such as their religious affiliation or medical conditions, from cars’ onboard computers and companion apps. 

These data collection practices do not match up with consumers’ expectations for the products or services they are using–and are also dangerous for consumers’ personal security.

The more data that companies collect about you, and the more companies they sell it to or share it with, the more likely it is that your information will be exposed in a breach or a hack and end up in the wrong hands. 

This was made all the more real last month, when it was discovered that a major location data broker called Gravy Analytics was the target of a hack that has led to tens of millions of location data points being leaked.

The best thing for consumers is to change how companies can collect and use personal data upfront. 

SB 1356 does this by banning the sale of sensitive data–like someone’s location or religious beliefs–without their consent and limiting the collection of personal data to what’s necessary to provide the product a consumer is asking for.

Last year, Maryland also passed a privacy law that limited unnecessary data collection as well as banned the sale of sensitive data outright. Therefore, without SB 1356, the privacy and security protections Connecticut residents have will be materially weaker than those of Maryland consumers.

Passing these updates will continue to strengthen Connecticut’s law in meaningful ways that will better protect consumers from harmful data collection practices while still allowing businesses to provide the products and services that consumers are looking for. 

PIRG urges you to continue the important work you’ve done to protect consumers’ data privacy by supporting this bill. Thank you.