Law / United States / 
Colorado
Protection of personal identifying information, reasonable security procedures duty
C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2)
In force since .
A security baseline statutes rule binding private bodies.
What it requires
- This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
- Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.NIST CSF 2.0PR.DS-01
- Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.NIST CSF 2.0GV.SC-05
- A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.
These lines are LexLint's reading of the law's text. Also read by: Colorado Attorney General, Consumer Protection Section (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civil penalty under C.R.S. 6-1-112(1), reached because a violation of part 7 is a deceptive trade practice under C.R.S. 6-1-105(1)(x). The ceiling is $20,000 for each violation, and $50,000 for each violation committed against an elderly person; the higher tier is coded. Each consumer or transaction involved is a separate violation. The Attorney General or a district attorney brings the action. This is separate from the direct-economic-damages action C.R.S. 6-1-716(4) gives the Attorney General, which states no fixed cap of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Statutory damages
Under C.R.S. 6-1-113(2) a private plaintiff recovers the greater of actual damages, $500, or, on clear and convincing evidence of bad faith conduct, three times actual damages, plus costs and reasonable attorney fees. The subsection excepts a class action from this measure of damages.
- As of
- Currency
- USD
- Per person minimum
- 500
Who enforces it
Enforcement body
The Colorado Attorney General may bring an action in law or equity under C.R.S. 6-1-716(4) to address a violation of this section, either to compel compliance or to recover direct economic damages. A violation is also a deceptive trade practice under C.R.S. 6-1-105(1)(x), enforceable by the Attorney General or a district attorney under the Colorado Consumer Protection Act's general civil-penalty provision, C.R.S. 6-1-112.
Settledness
- As of
- Guidance link
- https://coag.gov/resources/data-protection-laws/
- Guidance body
- Colorado Attorney General, Consumer Protection Section
- Open questions
- Which security procedures and practices are "reasonable" under C.R.S. 6-1-713.5(1) for a given "nature and size of the business and its operations"?
- Does "require" in C.R.S. 6-1-713.5(2) demand a written contract term with each third-party service provider, or is another assurance enough?
What it reaches
Obligation class
Security
Applicability criteria
A covered entity does not include a person acting as a third-party service provider as defined in section 6-1-713.5.
- As of
- Combinator
- All of
- Criteria
- a person, as defined in section 6-1-102 (6), that maintains, owns, or licenses personal identifying information in the course of the person's business, vocation, or occupation
What this law does
A covered entity, a person that maintains, owns, or licenses personal identifying information of a Colorado resident in the course of its business, vocation, or occupation, must implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information from unauthorized access, use, modification, disclosure, or destruction.
Personal identifying information is defined narrowly: a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device.
Where a covered entity discloses that information to a third-party service provider, it must require the provider to implement and maintain its own reasonable security procedures, unless the covered entity retains primary responsibility and implements technical controls that protect the information. A covered entity already regulated by state or federal law and following that regulator's own data-security procedures is deemed compliant.
This duty binds a private person or commercial entity; a governmental entity's parallel duty sits at C.R.S. 24-73-102, outside this profile's private-sector scope.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .