§ 4-67aa — Data sharing agreements with state instrumentalities. Required provisions. Disclosure. Exemption.

(a) A data sharing agreement entered into pursuant to subsection (b) of section 12-15 or section 269 of public act 21-2 of the June special session* by an office, department, board, commission, public institution of higher education or other instrumentality of the state with one or more individuals or organizations that allows for the sharing of data held by such state instrumentality shall include, but need not be limited to, the following provisions: (1) The purposes for which any party that has entered into a data sharing agreement with a state instrumentality will use such data and a restriction that such data may only be used for purposes authorized in the data sharing agreement; (2) The specific individuals, within any party that has entered into a data sharing agreement with a state instrumentality, who may access or use such data; (3) Data provided by the state instrumentality shall not be shared with another party unless such party has entered into a data sharing agreement with such instrumentality pursuant to this section and with approval from such instrumentality; (4) Data shall not be copied or stored in any location by any party, unless approved by the state instrumentality in the agreement; (5) All data shall be stored and accessed in a secure manner, as prescribed in the data sharing agreement; (6) Procedures for notifying the state instrumentality of any breach of such agreement; (7) If any provision of the data sharing agreement or the application of such agreement is held invalid by a court of competent jurisdiction, the invalidity does not affect other provisions or applications of such agreement that can be given effect without the invalid provision or application; (8) A party entering into a data sharing agreement shall not (A) use records or information obtained for such data for the purpose of enforcing federal immigration law, or (B) share, disclose or make accessible in any manner, directly or indirectly, such information or records to any federal or state agency that enforces federal immigration law, or to any officer or agent of such agency, unless required in compliance with a judicial warrant or court order issued by a judge or magistrate on behalf of the state or federal judicial branches; (9) A data sharing agreement shall have an explicit term of length; (10) If personally identifying information is permitted or required to be shared pursuant to a data sharing agreement, a description of any methods to de-identify such data. (b) Any data or information shared with a third party pursuant to a data sharing agreement that is not subject to disclosure under section 1-210 by a state instrumentality shall not be subject to disclosure by such third party under section 1-210 . (c) Any data sharing agreement entered into pursuant to subsection (a) of this section shall be deemed a public record. Any state instrumentality that enters into such an agreement shall not release any information that may endanger data security or safety. (d) The provisions of this section shall not apply to any contracts entered into by a state agency that comply with section 4e-70 . *Note: Section 269 of public act 21-2 of the June special session is special in nature and therefore has not been codified but remains in full force and effect according to its terms.

Legislative History

(June Sp. Sess. P.A. 21-2, S. 271; P.A. 23-4, S. 2.) History: June Sp. Sess. P.A. 21-2 effective July 1, 2021; P.A. 23-4 amended Subsec. (a) by deleting reference to Sec. 31-225a(j), effective June 7, 2023.