The Connecticut CTDPA states that Connecticut residents have the right to have their data deleted from data broker databases. The data broker company must respond to this request without undue delay, and within 45 days at the latest. The data broker may request an additional 45 days when reasonably necessary if they inform the Connecticut resident within the initial 45 day period and provide a reason. If the request to delete data is denied, a reason must be provided along with a process for appealing the decision. The data broker must provide a decision within 60 days of the submission of the appeal, along with a written explanation of the decision. If the appeal is denied, the data broker must provide a process for the Connecticut resident to submit a complaint to the Attorney General.

Connecticut Resident Sample Email:

Dear [company name],

I am submitting a request for implementation of the following rights under 4(a)3 of the Connecticut CTDPA which grant Connecticut residents certain rights in relation to protection of their personal data information:

1) To obtain erasure (deletion) of personal data (information) without undue delay;
2) To withdraw any consent given to the processing of personal data (information);
3) To object to processing of personal data (information) concerning the below individual, including but not limited to profiling and direct marketing.

I can be identified by my details below:

Name:
Address:
E-mail address:

Please confirm your compliance with the request without undue delay and in any event within 45 (forty five) days of receipt of this request.

Thank you,

AN ACT CONCERNING PERSONAL DATA PRIVACY AND ONLINE MONITORING.

Sec. 4. (NEW) (Effective July 1, 2023) (a) A consumer shall have the
right to: (1) Confirm whether or not a controller is processing the
consumer’s personal data and access such personal data, unless such
confirmation or access would require the controller to reveal a trade
secret; (2) correct inaccuracies in the consumer’s personal data, taking
into account the nature of the personal data and the purposes of the
processing of the consumer’s personal data; (3) delete personal data
provided by, or obtained about, the consumer; (4) obtain a copy of the
consumer’s personal data processed by the controller, in a portable and,
to the extent technically feasible, readily usable format that allows the
consumer to transmit the data to another controller without hindrance,
where the processing is carried out by automated means, provided such
controller shall not be required to reveal any trade secret; and (5) opt out
of the processing of the personal data for purposes of (A) targeted
advertising, (B) the sale of personal data, except as provided in
subsection (b) of section 6 of this act, or (C) profiling in furtherance of
solely automated decisions that produce legal or similarly significant
effects concerning the consumer.