Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party collaboration tools that collect personal information in Connecticut? What are the requirements?

Use of Third-Party Collaboration Tools that Collect Personal Information in Connecticut

Connecticut has regulations in place to protect personal data, including data collected by third-party collaboration tools. The Personal Data Act, Section 4-190 (9) of the Connecticut General Statutes, defines the categories of personal information that are protected [2.1][3.1].

If you plan to use third-party collaboration tools that collect personal information in Connecticut, you must ensure that the data is relevant and necessary to accomplish the lawful purpose of your agency [3.4]. Additionally, you must inform individuals of the legal authority under which you are empowered to collect and maintain the personal data, the individual’s rights pertaining to such records under the Personal Data Act and the agency’s regulations, the known consequences arising from supplying or refusing to supply the requested personal data, and the proposed use to be made of the requested personal data [3.3].

If an individual requests access to their personal data, you must verify their identity and provide a written response within four business days, informing them as to whether or not you maintain personal data on that individual, the category and location of the personal data maintained on that individual, and procedures available to review the records [3.2].

If an individual believes that you are maintaining inaccurate, incomplete, or irrelevant personal data concerning them, they may file a written request with your agency for correction of said personal data. You must give written notice to that person within thirty days of receipt of such request that you will make the requested correction, or if the correction is not to be made as submitted, you must state the reason for its denial of such request and notify the person of their right to add their own statement to their personal data records. Following such denial, the person requesting such correction shall be permitted to add a statement to their personal data record setting forth what they believe to be an accurate, complete, and relevant version of the personal data in question [3.5].

Requirements for Using Third-Party Collaboration Tools that Collect Personal Information in Connecticut

To use third-party collaboration tools that collect personal information in Connecticut, you must ensure that the data is relevant and necessary to accomplish the lawful purpose of your agency. Additionally, you must inform individuals of the legal authority under which you are empowered to collect and maintain the personal data, the individual’s rights pertaining to such records under the Personal Data Act and the agency’s regulations, the known consequences arising from supplying or refusing to supply the requested personal data, and the proposed use to be made of the requested personal data. If an individual requests access to their personal data, you must verify their identity and provide a written response within four business days, informing them as to whether or not you maintain personal data on that individual, the category and location of the personal data maintained on that individual, and procedures available to review the records. If an individual believes that you are maintaining inaccurate, incomplete, or irrelevant personal data concerning them, they may file a written request with your agency for correction of said personal data. You must give written notice to that person within thirty days of receipt of such request that you will make the requested correction, or if the correction is not to be made as submitted, you must state the reason for its denial of such request and notify the person of their right to add their own statement to their personal data records. Following such denial, the person requesting such correction shall be permitted to add a statement to their personal data record setting forth what they believe to be an accurate, complete, and relevant version of the personal data in question.

Source(s):
Jurisdiction

Connecticut