Processes biometric data, in Colorado

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

4 CCR 904-3 · Read the law's page

• Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
• Give a biometric identifier notice at or before the initial collection or processing of any biometric identifier, or before a material change to the processing purpose (Rule 6.12).
• Keep records of consumer data rights requests, your responses and the basis for any denial for at least 24 months (Rule 6.11).
• Conduct and document a data protection assessment before starting processing that presents a heightened risk of harm, and review and update it as often as appropriate (Rule 8.05).
• Honor a consumer's request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects where the profiling rests on solely automated processing or human reviewed automated processing (Rule 9.04).
• Process personal data with reasonable and appropriate administrative, technical, organizational and physical safeguards (Rule 6.09).
• Require an employee or prospective employee to consent to biometric collection and processing as a condition of employment only as the Colorado Privacy Act permits, with consent meeting Rules 7.03 to 7.08 (Rule 7.09).

C.R.S. sections 6-1-1301 et seq. · Read the law's page

• If you process the personal data of Colorado residents at the qualifying volume thresholds, give clear privacy notice and honor consumer requests to access, correct, delete, and port their data within 45 days.
• Obtain the consumer's affirmative opt-in consent before processing or selling sensitive data, including biometric data used for identification and precise geolocation data, or before resuming processing for targeted advertising or sale after a consumer opts out.
• Offer consumers a way to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects, and complete a data protection assessment before processing that presents a heightened risk of harm.

C.R.S. section 6-1-1314(6) (HB 24-1130, 2024 Colo. Sess. Laws ch. 313) · Read the law's page

• If you are an employer, require an employee or prospective employee to consent to your collecting and processing the person's biometric identifier as a condition of employment only to permit access to secure physical locations and secure electronic hardware and software applications, to record the start and end of the full work day including meal breaks and rest breaks over thirty minutes, to improve or monitor workplace safety or security or ensure the safety or security of employees, or to improve or monitor the safety or security of the public in an emergency or crisis (section 6-1-1314(6)(a)).
• Do not obtain an employee's or prospective employee's consent to retain biometric data that is used for current employee location tracking or for tracking how much time the employee spends using a hardware or software application (section 6-1-1314(6)(a)(I)).
• Collect and process an employee's or prospective employee's biometric identifier for any other use only with the person's consent, and do not require that consent as a condition of employment or retaliate against a person who does not give it (section 6-1-1314(6)(b)).

C.R.S. sections 6-1-1303(2.2)-(2.4), 6-1-1314 (2024 Colo. Sess. Laws ch. 313) · Read the law's page

• Before collecting a Colorado resident's biometric identifier such as a fingerprint, voiceprint, or facial geometry template, disclose in a clear and accessible manner what is collected, why, and how long it will be kept, and obtain the consumer's consent, whatever your app's overall personal-data processing volume.
• Adopt and publish a written policy that sets a retention schedule and a destruction timeline (the earliest of purpose satisfied, 24 months after the consumer's last interaction, or 45 days, extendable by up to 45 more, after the identifier is no longer needed) and a data-security-incident response protocol.
• Do not sell, lease, or trade a biometric identifier, or disclose one to a third party, without the consumer's consent or a listed statutory exception.
• A voiceprint or facial template you generate from a photo, audio, or video recording for the purpose of identifying someone is covered biometric data even though the underlying photo or recording itself is excluded when not used that way.

C.R.S. §§ 6-1-1301 et seq., 6-1-1303(2.2), (2.4), (17), (24) · Read the law's page

• Do not treat personal data scraped from an aggregator, people-search site, or re-hosted directory as publicly available under the Colorado Privacy Act; the exemption reaches only a government record or the consumer's own disclosure.
• Track biometric data (a usable identifier) and biometric identifier (the raw measured characteristic) as two separate defined terms, at Section 6-1-1303(2.2) and (2.4) respectively.
• Treat a scraped photo or voice recording as sensitive data, requiring opt-in consent, once you process it into a template used to identify a specific individual, even though the raw file alone is excluded from biometric data.