Sends commercial email, in Colorado

C.R.S. section 6-1-715 · Read the law's page

• Do not publicly post or publicly display an individual's social security number in any manner, which means to intentionally communicate it or otherwise make it available to the general public (section 6-1-715(1)(a)).
• Do not print an individual's social security number on any card the individual must use to access the products or services you provide (section 6-1-715(1)(b)).
• Do not require an individual to transmit a social security number over the internet unless the connection is secure or the number is encrypted, and do not require an individual to use one to access an internet website unless a password, unique personal identification number or other authentication device is also required (section 6-1-715(1)(c) and (d)).
• Do not print an individual's social security number on materials mailed to the individual unless state or federal law requires, permits or authorizes it, and never print a number that may be mailed, in whole or in part, on a postcard or other mailer not requiring an envelope, or make it visible on the envelope or without opening the envelope (section 6-1-715(1)(e)).
• If you used an individual's social security number before January 1, 2007 in a way subsection (1) bars and want to keep doing so, keep the use continuous, give the individual an annual disclosure of the right to stop, implement a written request to stop within 30 days without a fee, and do not deny services because of the request (section 6-1-715(2)).

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.