Processes personal data, in Colorado

C.R.S. section 10-3-1104.7 · Read the law's page

• If you are an entity that provides group disability insurance or long-term care insurance coverage and is subject to the jurisdiction of the commissioner of insurance, treat information derived from genetic testing as confidential and privileged, and release it for any purpose other than diagnosis, treatment or therapy, when it identifies the person tested with the test results released, only with the specific written consent of the person tested (section 10-3-1104.7(3)(a)).
• Do not seek, use or keep information derived from genetic testing for any nontherapeutic purpose or for any underwriting purpose connected with group disability insurance or long-term care insurance coverage (section 10-3-1104.7(3)(b)).
• If you are an insurer writing life insurance or individual disability insurance, do not require or perform a genetic test without first receiving the specific, written, informed consent of the subject of the test, or of a person authorized by law to consent for a subject who lacks capacity, in a form the commissioner prescribes. Keep the results privileged and confidential and release them only as state or federal law specifically authorizes (section 10-3-1104.7(10)).

C.R.S. section 6-1-715 · Read the law's page

• Do not publicly post or publicly display an individual's social security number in any manner, which means to intentionally communicate it or otherwise make it available to the general public (section 6-1-715(1)(a)).
• Do not print an individual's social security number on any card the individual must use to access the products or services you provide (section 6-1-715(1)(b)).
• Do not require an individual to transmit a social security number over the internet unless the connection is secure or the number is encrypted, and do not require an individual to use one to access an internet website unless a password, unique personal identification number or other authentication device is also required (section 6-1-715(1)(c) and (d)).
• Do not print an individual's social security number on materials mailed to the individual unless state or federal law requires, permits or authorizes it, and never print a number that may be mailed, in whole or in part, on a postcard or other mailer not requiring an envelope, or make it visible on the envelope or without opening the envelope (section 6-1-715(1)(e)).
• If you used an individual's social security number before January 1, 2007 in a way subsection (1) bars and want to keep doing so, keep the use continuous, give the individual an annual disclosure of the right to stop, implement a written request to stop within 30 days without a fee, and do not deny services because of the request (section 6-1-715(2)).

C.R.S. section 10-3-1104.6 (HB 09-1338, 2009 Colo. Sess. Laws ch. 353, section 2) · Read the law's page

• If you are an entity that provides health care insurance or medicare supplement insurance coverage and is subject to the jurisdiction of the commissioner of insurance, treat an individual's genetic information as confidential and privileged, and release it for any purpose other than diagnosis, treatment or therapy, when it identifies the person tested with the test results released, only with the specific written consent of the person or the person's parent or guardian (section 10-3-1104.6(3)(a)).
• Do not seek, use or keep genetic information for any nontherapeutic purpose or for any underwriting purpose connected with the provision of health care insurance or medicare supplement insurance coverage (section 10-3-1104.6(3)(b)).
• Do not request or require an individual or a family member to undergo a genetic test unless state or federal law authorizes it (section 10-3-1104.6(3)(c)).

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

C.R.S. section 6-1-716 · Read the law's page

• If you experience unauthorized acquisition of unencrypted computerized personal information of Colorado residents, notify affected residents without unreasonable delay and within 30 days of determining a breach occurred.
• Notify the Colorado Attorney General of a security breach affecting 500 or more Colorado residents without unreasonable delay and not later than 30 days after the date of determination that a security breach occurred; also notify nationwide consumer reporting agencies if more than 1,000 residents are affected.

4 CCR 904-3 · Read the law's page

• Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
• Give a biometric identifier notice at or before the initial collection or processing of any biometric identifier, or before a material change to the processing purpose (Rule 6.12).
• Keep records of consumer data rights requests, your responses and the basis for any denial for at least 24 months (Rule 6.11).
• Conduct and document a data protection assessment before starting processing that presents a heightened risk of harm, and review and update it as often as appropriate (Rule 8.05).
• Honor a consumer's request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects where the profiling rests on solely automated processing or human reviewed automated processing (Rule 9.04).
• Process personal data with reasonable and appropriate administrative, technical, organizational and physical safeguards (Rule 6.09).
• Require an employee or prospective employee to consent to biometric collection and processing as a condition of employment only as the Colorado Privacy Act permits, with consent meeting Rules 7.03 to 7.08 (Rule 7.09).

C.R.S. sections 6-1-1301 et seq. · Read the law's page

• If you process the personal data of Colorado residents at the qualifying volume thresholds, give clear privacy notice and honor consumer requests to access, correct, delete, and port their data within 45 days.
• Obtain the consumer's affirmative opt-in consent before processing or selling sensitive data, including biometric data used for identification and precise geolocation data, or before resuming processing for targeted advertising or sale after a consumer opts out.
• Offer consumers a way to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects, and complete a data protection assessment before processing that presents a heightened risk of harm.

C.R.S. sections 6-1-1303(11) and 6-1-1307 · Read the law's page

• To treat data as de-identified under the Colorado Privacy Act, take reasonable measures to ensure that it cannot be associated with an individual (C.R.S. 6-1-1303(11)(a)).
• Publicly commit to maintain and use the data only in a de-identified fashion and not to attempt to re-identify it (C.R.S. 6-1-1303(11)(b)).
• Contractually obligate any recipient of the data to comply with the requirements of the definition (C.R.S. 6-1-1303(11)(c)).
• If you use de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments to which it is subject, and take appropriate steps to address any breach of those commitments (C.R.S. 6-1-1307(2)).

C.R.S. sections 6-1-1303(2.5), 6-1-1303(16.7), 6-1-1303(24)(b)-(d) (2024 Colo. Sess. Laws ch. 68) · Read the law's page

• Treat data generated by measuring an individual's biological, genetic, biochemical, physiological, or neural properties, or central or peripheral nervous system activity, as sensitive data requiring the consumer's affirmative opt-in consent before you process it.

C.R.S. section 6-1-1314(6) (HB 24-1130, 2024 Colo. Sess. Laws ch. 313) · Read the law's page

• If you are an employer, require an employee or prospective employee to consent to your collecting and processing the person's biometric identifier as a condition of employment only to permit access to secure physical locations and secure electronic hardware and software applications, to record the start and end of the full work day including meal breaks and rest breaks over thirty minutes, to improve or monitor workplace safety or security or ensure the safety or security of employees, or to improve or monitor the safety or security of the public in an emergency or crisis (section 6-1-1314(6)(a)).
• Do not obtain an employee's or prospective employee's consent to retain biometric data that is used for current employee location tracking or for tracking how much time the employee spends using a hardware or software application (section 6-1-1314(6)(a)(I)).
• Collect and process an employee's or prospective employee's biometric identifier for any other use only with the person's consent, and do not require that consent as a condition of employment or retaliate against a person who does not give it (section 6-1-1314(6)(b)).

C.R.S. sections 6-1-1303(2.2)-(2.4), 6-1-1314 (2024 Colo. Sess. Laws ch. 313) · Read the law's page

• Before collecting a Colorado resident's biometric identifier such as a fingerprint, voiceprint, or facial geometry template, disclose in a clear and accessible manner what is collected, why, and how long it will be kept, and obtain the consumer's consent, whatever your app's overall personal-data processing volume.
• Adopt and publish a written policy that sets a retention schedule and a destruction timeline (the earliest of purpose satisfied, 24 months after the consumer's last interaction, or 45 days, extendable by up to 45 more, after the identifier is no longer needed) and a data-security-incident response protocol.
• Do not sell, lease, or trade a biometric identifier, or disclose one to a third party, without the consumer's consent or a listed statutory exception.
• A voiceprint or facial template you generate from a photo, audio, or video recording for the purpose of identifying someone is covered biometric data even though the underlying photo or recording itself is excluded when not used that way.

C.R.S. sections 6-1-1305.5, 6-1-1308.5, 6-1-1309.5, 6-1-1311(1)(d)(II) (2024 Colo. Sess. Laws ch. 296) · Read the law's page

• If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.
• Get opt-in consent, parental consent for a minor under 13, before processing a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects.
• Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.