Makes education decisions, in Colorado

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

4 CCR 904-3 · Read the law's page

• Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
• Give a biometric identifier notice at or before the initial collection or processing of any biometric identifier, or before a material change to the processing purpose (Rule 6.12).
• Keep records of consumer data rights requests, your responses and the basis for any denial for at least 24 months (Rule 6.11).
• Conduct and document a data protection assessment before starting processing that presents a heightened risk of harm, and review and update it as often as appropriate (Rule 8.05).
• Honor a consumer's request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects where the profiling rests on solely automated processing or human reviewed automated processing (Rule 9.04).
• Process personal data with reasonable and appropriate administrative, technical, organizational and physical safeguards (Rule 6.09).
• Require an employee or prospective employee to consent to biometric collection and processing as a condition of employment only as the Colorado Privacy Act permits, with consent meeting Rules 7.03 to 7.08 (Rule 7.09).

C.R.S. sections 6-1-1301 et seq. · Read the law's page

• If you process the personal data of Colorado residents at the qualifying volume thresholds, give clear privacy notice and honor consumer requests to access, correct, delete, and port their data within 45 days.
• Obtain the consumer's affirmative opt-in consent before processing or selling sensitive data, including biometric data used for identification and precise geolocation data, or before resuming processing for targeted advertising or sale after a consumer opts out.
• Offer consumers a way to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects, and complete a data protection assessment before processing that presents a heightened risk of harm.

C.R.S. sections 6-1-1305.5, 6-1-1308.5, 6-1-1309.5, 6-1-1311(1)(d)(II) (2024 Colo. Sess. Laws ch. 296) · Read the law's page

• If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.
• Get opt-in consent, parental consent for a minor under 13, before processing a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects.
• Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.

C.R.S. 6-1-1702 · Read the law's page

• This duty does not bind until January 1, 2027.
• If you develop a covered automated decision-making technology that is marketed, configured or contracted to materially influence a consequential decision, make available to each deployer a general statement of its intended and known harmful or inappropriate uses, the categories of data used to train it, its known limitations, and instructions for appropriate use, monitoring and meaningful human review.
• Make available the information a deployer reasonably needs to give its own consumer disclosures, and notify the deployer if you withhold information.
• Notify each deployer, within a reasonable time, of material updates, intentional and substantial modifications, and changes to the intended use of, limitations for, or risk mitigation for the technology.
• Retain for at least three years after each record is created, or longer if state or federal law requires, records reasonably necessary to demonstrate compliance, including system version identifiers, changelogs, and documentation and notices of material updates given to deployers.

C.R.S. 6-1-1703 · Read the law's page

• This duty does not bind until January 1, 2027.
• Retain for at least three years after the date of each consequential decision, or longer if state or federal law requires, records reasonably necessary to demonstrate compliance with Part 17, such as the technology's version identifiers, changelogs, and documentation of material mitigation changes.

C.R.S. 6-1-1704 · Read the law's page

• Give clear and conspicuous notice before using covered automated decision-making technology that materially influences a consequential decision
• A prominent public notice at the points where consumers interact with you satisfies that notice duty
• Where the technology produces an adverse outcome for a consumer, give the consumer, within 30 days after making the decision, a plain-language description of the decision and the technology's role in it, plus an explanation of the consumer's rights
• Consequential decisions here are education, employment, housing, financial or lending services, insurance, health care, and essential government services
• The consumer disclosure duty takes effect 1 January 2027