Privacy & Information Security Law Blog

On July 8, 2021, Colorado Governor Jared Polis signed SB21-190, the Colorado Privacy Act (“the Act”), into law, making Colorado the third state to have a comprehensive data privacy law on the books, following California and Virginia. The Colorado House voted 57-7 in favor of the Act on June 7 after it had previously passed the Senate unanimously on May 26. The Senate voted unanimously to adopt the House’s amendments to the Act on June 8. The Act will go into effect on July 1, 2023, with some specific provisions going into effect at later dates.

The Act closely resembles Virginia’s Consumer Data Protection Act, which was signed into law earlier this year in March, but is not a direct copy of the Virginia law and contains some additional provisions. It applies to companies conducting business in Colorado or who produce or deliver commercial products or services intentionally targeted to its residents that either: (1) control or process the personal data of at least 100,000 consumers during a calendar year; or (2) derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of at least 25,000 consumers. The Act notably does not contain a private right of action, and will instead be enforced by the state’s Attorney General and its district attorneys.

The Act contains a number of obligations for companies and provides consumers with several new privacy rights, most notably it:

• Provides consumers with rights of data access, correction, deletion and portability;
• Provides consumers with the right to opt out of processing for the purposes of targeted advertising, sale of personal data and profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer;
• Exempts employee data, deidentified data and publicly available information from its requirements, as well as other data governed by laws such as HIPAA, GLBA and COPPA;
• Contains a controller/processor distinction akin to the GDPR, and outlines duties for both;
• Includes a duty of transparency, which requires controllers to provide consumers with a privacy notice containing certain information;
• Includes a duty of purpose specification, which requires controllers to specify the express purposes for which data is collected and processed;
• Includes a duty of data minimization, which requires that a controller’s collection of personal data must be adequate, relevant and limited to what is reasonably necessary in relation to the specified purposes for which the data is processed;
• Includes a duty to avoid secondary use, which prohibits controllers from processing personal data for purposes that are not reasonably necessary to or compatible with the specified purposes for which the data is processed unless consent is obtained;
• Includes a duty of care, which requires controllers to implement reasonable measures to secure personal data;
• Includes a duty to avoid unlawful discrimination, which prohibits controllers from processing personal data in violation of state or federal laws that prohibit discrimination;
• Requires opt-in consent for the processing of sensitive data;
• Requires data protection assessments for processing that presents a heightened risk of harm, such as processing personal data for targeted advertising, profiling, sale or processing sensitive data;
• Contains exemptions for a number of processing activities, such as performing internal operations, protecting a consumer’s vital interests, preventing and detecting fraud or other malicious, deceptive or illegal activity, and conducting internal research to improve, repair or develop products.