Processes de-identified data, in Colorado

C.R.S. sections 6-1-1303(11) and 6-1-1307 · Read the law's page

• To treat data as de-identified under the Colorado Privacy Act, take reasonable measures to ensure that it cannot be associated with an individual (C.R.S. 6-1-1303(11)(a)).
• Publicly commit to maintain and use the data only in a de-identified fashion and not to attempt to re-identify it (C.R.S. 6-1-1303(11)(b)).
• Contractually obligate any recipient of the data to comply with the requirements of the definition (C.R.S. 6-1-1303(11)(c)).
• If you use de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments to which it is subject, and take appropriate steps to address any breach of those commitments (C.R.S. 6-1-1307(2)).