Law / United States / 
Colorado
Colorado Privacy Act, de-identified data
C.R.S. sections 6-1-1303(11) and 6-1-1307
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Governance
- Audit expectation
- none
What it requires
- To treat data as de-identified under the Colorado Privacy Act, take reasonable measures to ensure that it cannot be associated with an individual (C.R.S. 6-1-1303(11)(a)).
- Publicly commit to maintain and use the data only in a de-identified fashion and not to attempt to re-identify it (C.R.S. 6-1-1303(11)(b)).
- Contractually obligate any recipient of the data to comply with the requirements of the definition (C.R.S. 6-1-1303(11)(c)).
- If you use de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments to which it is subject, and take appropriate steps to address any breach of those commitments (C.R.S. 6-1-1307(2)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 6-1-1303(11) and 6-1-1307 state the conditions for treating data as de-identified and the oversight duty. They state no log or record duty.
- Kind
- None
- As of
What this law does
Section 6-1-1303(11) of the Colorado Revised Statutes defines de-identified data as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such an individual, if the controller that possesses the data meets three conditions. Section 6-1-1303(11)(a) requires the controller that possesses the data to take reasonable measures to ensure that the data cannot be associated with an individual.
Section 6-1-1303(11)(b) requires the controller that possesses the data to publicly commit to maintain and use the data only in a de-identified fashion and not attempt to re-identify the data. Section 6-1-1303(11)(c) requires the controller that possesses the data to contractually obligate any recipients of the information to comply with the requirements of the subsection.
Section 6-1-1307(1)(a) provides that the Colorado Privacy Act does not require a controller or processor to reidentify de-identified data solely for purposes of complying with the act. Section 6-1-1307(2) requires a controller that uses de-identified data to exercise reasonable oversight to monitor compliance with any contractual commitments to which the data are subject and to take appropriate steps to address any breaches of those commitments.
Section 6-1-1307(3) provides that the consumer rights in section 6-1-1306(1)(b) to (1)(e) do not apply to pseudonymous data if the controller can demonstrate that the information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing the information.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .