Connecticut Administrative Code › Title 12 - Taxation › 865 - Online Casino Gaming, Retail and Online Sports Wagering, Fantasy Contests, Keno and Online Sale of Lottery Tickets › Section 12-865-32 - Data Privacy Provisions

Current through July 10, 2024
(a) Gaming entity
			 licensees shall provide a readily accessible privacy policy to patrons on its
			 electronic wagering platform. The privacy policy shall state the information
			 that is required to be collected, the purpose for information collection, and
			 the conditions under which information may be disclosed. Any information about
			 a patron's internet gaming account that is not subject to disclosure pursuant
			 to the privacy policy shall be kept confidential, except where the release is
			 required by law or requested by the department. Patron information shall be
			 securely erased from all storage media, including but not limited to HDD, SDD,
			 Flash, Mobile, Cloud, Virtual, RAID, LUN, hard disks, solid state memory, and
			 other devices before the device is decommissioned. If erasure is not possible,
			 the storage device shall be destroyed.
(b) Gaming entity licensees shall take
			 reasonable steps to ensure that confidential information security measures are
			 implemented which, at a minimum, shall:
(1)
			 Establish, implement and maintain reasonable administrative, technical and
			 physical data security practices to protect the confidentiality, integrity and
			 accessibility of confidential information and to ensure secure and timely
			 disposal of such information once there is no longer a business need for such
			 information;
(2) Create a data
			 minimization plan to ensure that only data required to ensure the verification
			 of a patron's identity and authenticate patron financial information is
			 collected. Such plan shall also set forth the licensee's policy for data
			 destruction after the applicable record retention expiration date;
(3) Immediately, but in no event later than
			 one business day, notify the department after becoming aware of a suspected
			 confidential information breach;
(4) Within five business days of notifying
			 the department of a suspected confidential information breach, provide the
			 department a written notice that (A) details the suspected or confirmed
			 confidential information breach, including the licensee's plan to remediate the
			 breach, mitigate its effects, and prevent breaches of a similar nature from
			 occurring in the future, or (B) details why, upon further investigation, the
			 licensee believes that a breach did not occur;
(5) Upon request of the department, provide a
			 forensic report from a qualified third-party forensic examiner, the cost of
			 which report shall be paid by the licensee contracting for the
			 report;
(6) Establish and publish
			 privacy protection policies on the gaming entity licensee's website that shall
			 include, but not be limited to: safeguarding confidential information, computer
			 files and documents containing confidential information from misuse by third
			 parties; and destroying, erasing or making unreadable such confidential
			 information, computer files and documents prior to disposal; and
(7) Comply with the breach of security
			 reporting requirements of section 36a-701b of the Connecticut General
			 Statutes.