Connecticut Mandates Identity Theft Services for Social Security Number Data Breaches
On June 30, 2015, Connecticut’s governor signed into law an amendment to the state’s data-security-breach-notice statute to mandate ‘appropriate’ identity theft prevention services for breaches involving social security numbers. Identity theft mitigation services are also required ‘if applicable’, e.g., if identify theft actually occurs. The services must be provided at no cost and for at least 12 months. The statute does not explain which identity theft ‘prevention’ or ‘mitigation’ services are mandated or which are ‘appropriate.’