{"id":410,"date":"2021-07-02T13:02:20","date_gmt":"2021-07-02T17:02:20","guid":{"rendered":"https:\/\/pbacyber.com\/?p=410"},"modified":"2021-07-02T13:05:39","modified_gmt":"2021-07-02T17:05:39","slug":"a-cheat-sheet-for-colorados-forthcoming-new-privacy-act","status":"publish","type":"post","link":"https:\/\/pbacyber.com\/index.php\/2021\/07\/02\/a-cheat-sheet-for-colorados-forthcoming-new-privacy-act\/","title":{"rendered":"A Cheat Sheet for Colorado\u2019s Forthcoming New Privacy Act"},"content":{"rendered":"

By Joshua A. Mooney, Kennedys<\/p>\n

 <\/p>\n

The Colorado Privacy Act (\u201cColoPA\u201d or \u201cAct\u201d) has been sent to Governor Jared Polis\u2019s office to be signed into law, making Colorado the third state to enact comprehensive privacy legislation (coming behind California and Virginia). Once signed, the Act will take effect on July 31, 2023. However, its requirements are substantive, having GDPR-like provisions addressing data security, consumers\u2019 data rights, and mandatory contracting requirements\/clauses. For a quick read, here is a brief snapshot of some highlights of the Act:<\/p>\n

1. Scope, enforcement and penalties<\/strong><\/h6>\n

The Act applies to companies that conduct business or produce products or services intentionally targeted to Colorado residents<\/u> and either: (a) control or process personal data of more than 100,000 consumers<\/u> annually; or (b) derive any<\/u> revenue from the sale of personal data, and control or process the personal data of at least 25,000 consumers. (6-1-1304.(1).)<\/p>\n

 <\/p>\n

The ColoPA broadly defines \u201cpersonal data<\/strong>\u201d as (a) \u201cinformation that is linked or reasonably linked to an identified or identifiable individual,\u201d but does not include \u201cde-identified data or publicly available information.\u201d (6-1-1303.(17).) An \u201cidentified or identifiable individual<\/strong>\u201d is \u201can individual who can be readily identified, directly or indirectly, in particular reference to an identifier such as a name, an identification number, specific geolocation data, or an online identifier.\u201d (6-1-1303.(16).) The Act broadly also defines \u201csell<\/strong>\u201d or \u201csale<\/strong>\u201d as \u201cthe exchange of personal data for monetary or other valuable consideration by a controller to a third party.\u201d (6-1-1303.(23).)<\/p>\n

 <\/p>\n

There is no private right of action. However, the Act provides district attorneys with enforcement rights. Thus, companies may see enforcement of Colorado\u2019s privacy legislation at both the state and local levels, and with greater penalties, too, with penalties topping at $20,000 per violation.<\/p>\n

 <\/p>\n

2. Duties of a controller<\/strong><\/h6>\n

Briefly, the ColoPA imposes upon a controller the duties of transparency, specified purpose, data minimization, avoidance of secondary use, care, anti-discrimination, and consent when using sensitive data. (6-1-1308.) A detailed description of these duties is as follows:<\/p>\n

 <\/p>\n

Transparency<\/strong>. Controllers must provide consumers with \u201ca reasonably accessible, clear and meaningful privacy notice\u201d that includes:<\/p>\n

    \n
  • \n
      \n
    • (i) categories of personal data collected and\/or processed;<\/li>\n
    • (ii) purposes for which personal data is processed;<\/li>\n
    • (iii) how a consumer may exercise his or her rights, including right of appeal;<\/li>\n
    • (iv) categories of personal data shared with third parties;<\/li>\n
    • (v) categories of third parties with whom personal data is shared; and<\/li>\n
    • (vi) if a controller sells personal data or uses it for \u201ctargeted advertising,\u201d the controller must \u201cclearly and conspicuously\u201d disclose the sale or processing as well as the consumer\u2019s right to opt out.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

       <\/p>\n

      Purpose Specification.<\/strong> The controller must specify the purposes for which personal data is collected and processed.<\/p>\n

       <\/p>\n

      Data Minimization.<\/strong> The controller\u2019s collection of personal data \u201cmust be adequate, relevant and limited to what is reasonably necessary in relation to the specified purposes for which the data are processed.\u201d<\/p>\n

       <\/p>\n

      No Secondary Use.<\/strong> A controller may not process personal data that is \u201cnot reasonably necessary in relation to the specified purposes for which the data are processed, unless the controller first obtains the consumer\u2019s consent.\u201d This is the mirror image of the duty of data minimization.<\/p>\n

       <\/p>\n

      Duty of Care. <\/strong>The controller must undertake \u201creasonable measures to secure personal data during both store and use from unauthorized acquisition\u201d that are \u201cappropriate to the volume, scope, and nature of the personal data processed and the nature of the business.\u201d<\/p>\n

       <\/p>\n

      Anti-Discrimination. <\/strong>The controller may not violate any state or federal discrimination laws in the collection or processing of personal data.<\/p>\n

       <\/p>\n

      Consent to Process Sensitive Data<\/strong>. A controller may not process sensitive data without first obtaining the consumer\u2019s consent or, if the consumer is a child, the consent of the child\u2019s parent or legal guardian. The Act defines \u201csensitive data<\/strong>\u201d as \u201c(a) personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or citizenship status; (b) genetic or biometric data that may be processed for the purpose of uniquely identifying an individual; or (c) personal data form a known child.\u201d (6-1-1303.(24).)<\/p>\n

       <\/p>\n

      Data security. <\/strong>Controllers and processors alike also must \u201cimplement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and establish a clear allocation of the responsibilities between them to implement the measures.\u201d (6-1-1305.(4).)<\/p>\n

       <\/p>\n

      3. Mandatory data processing agreements<\/strong><\/h6>\n

      Much like when effecting data transfers under GDPR, the ColoPA in effect requires data processing agreements that have mandatory contractual provisions. (6-1-1305.(5).) Under the Act, any data transfer to a processor must be governed by a written contract that:<\/p>\n