Law / United States / 
Colorado
Disposal of personal identifying information, written policy duty
C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1)
In force since .
A security baseline statutes rule binding private bodies.
What it requires
- This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
- Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
- Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.
These lines are LexLint's reading of the law's text. Also read by: Colorado Attorney General, Consumer Protection Section (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civil penalty under C.R.S. 6-1-112(1), reached because a violation of part 7 is a deceptive trade practice under C.R.S. 6-1-105(1)(x). The ceiling is $20,000 for each violation, and $50,000 for each violation committed against an elderly person; the higher tier is coded. Each consumer or transaction involved is a separate violation. The Attorney General or a district attorney brings the action. This is separate from the direct-economic-damages action C.R.S. 6-1-716(4) gives the Attorney General, which states no fixed cap of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Statutory damages
Under C.R.S. 6-1-113(2) a private plaintiff recovers the greater of actual damages, $500, or, on clear and convincing evidence of bad faith conduct, three times actual damages, plus costs and reasonable attorney fees. The subsection excepts a class action from this measure of damages.
- As of
- Currency
- USD
- Per person minimum
- 500
Who enforces it
Enforcement body
The Colorado Attorney General may bring an action in law or equity under C.R.S. 6-1-716(4) to address a violation of this section, either to compel compliance or to recover direct economic damages. A violation is also a deceptive trade practice under C.R.S. 6-1-105(1)(x), enforceable by the Attorney General or a district attorney under the Colorado Consumer Protection Act's general civil-penalty provision, C.R.S. 6-1-112.
Settledness
- As of
- Guidance link
- https://coag.gov/resources/data-protection-laws/
- Guidance body
- Colorado Attorney General, Consumer Protection Section
- Open questions
- When are paper or electronic documents containing personal identifying information "no longer needed" under C.R.S. 6-1-713(1), and must the written policy set a retention period?
- Does the duty in C.R.S. 6-1-713(1) to destroy documents "within its custody or control" reach copies held by a third-party service provider, which the definition of "covered entity" in C.R.S. 6-1-713(2)(a) excludes?
What it reaches
Obligation class
Security
Applicability criteria
A covered entity does not include a person acting as a third-party service provider as defined in section 6-1-713.5.
- As of
- Combinator
- All of
- Criteria
- a person, as defined in section 6-1-102 (6), that maintains, owns, or licenses personal identifying information in the course of the person's business, vocation, or occupation
What this law does
A covered entity that maintains paper or electronic documents containing personal identifying information during the course of business must develop a written policy for the destruction or proper disposal of those documents. Once the documents are no longer needed, the covered entity must destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable through any means.
"Covered entity" and "personal identifying information" carry the same definitions this section shares with the reasonable-security-procedures duty at C.R.S. 6-1-713.5, and a covered entity already regulated by state or federal law and following that regulator's own disposal procedures is deemed compliant.
Unless an entity specifically contracts with a recycler or disposal firm for destruction, the recycler or disposal firm has no duty to verify that the documents it receives were properly destroyed.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .