Crawls the web, in Colorado

C.R.S. § 18-5.5-102 · Read the law's page

• Do not knowingly access a computer, computer network, or computer system without authorization, or beyond the scope of the authorization granted; Colorado defines authorization as the express consent of a person.
• Whether a public, unauthenticated page is accessed with the express consent the definition requires is open under Colorado law, so treat that question as unsettled.

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

C.R.S. § 6-1-105(1)(rrr) · Read the law's page

• A scraping practice that is knowingly or recklessly unfair, unconscionable, or deceptive can fall within Section 6-1-105(1)(rrr); no Colorado decision applies the paragraph to scraping.

C.R.S. §§ 6-1-1301 et seq., 6-1-1303(2.2), (2.4), (17), (24) · Read the law's page

• Do not treat personal data scraped from an aggregator, people-search site, or re-hosted directory as publicly available under the Colorado Privacy Act; the exemption reaches only a government record or the consumer's own disclosure.
• Track biometric data (a usable identifier) and biometric identifier (the raw measured characteristic) as two separate defined terms, at Section 6-1-1303(2.2) and (2.4) respectively.
• Treat a scraped photo or voice recording as sensitive data, requiring opt-in consent, once you process it into a template used to identify a specific individual, even though the raw file alone is excluded from biometric data.