Colorado is poised to join the growing number of states enacting a comprehensive privacy law.  On Monday, June 7, both houses of the legislature passed the Colorado Privacy Act.  The bill will now be sent to the Governor for approval.  The Colorado Privacy Act:

• provides consumers with a right to opt-out of processing of personal data concerning the consumer for purposes of targeted advertising, the sale of personal data, or profiling;
• creates consumer rights of access, correction, deletion, and data portability (subject to certain exceptions);
• restricts controllers from processing personal data for purposes that are not reasonably necessary to or compatible with the specified purposes for which the personal data are processed, without the consumer’s consent;
• imposes a duty of care to secure personal data; and
• requires affirmative consent prior to processing sensitive data about the consumer.

The law would apply to legal entities that conduct business or produce or deliver commercial products or services that are intentionally targeted to residents of Colorado, and either:  (1) controls or processes personal data of 100,000 consumers during a calendar year or (2) derives revenue or receives a discount on the price of goods from the sale of personal data or processes or controls the personal data of 25,000 consumers or more.  However, the law contains exceptions related to HIPAA, GLBA, COPPA, and FERPA.

In addition, the requirements under the Colorado Privacy Act do not restrict the controller’s ability to, among other things, conduct internal research to improve, repair, or develop products, services or technology; identify and repair errors; or perform internal operations that are reasonably aligned with the expectations of the consumer based on the consumer’s existing relationship with the controller.

The Colorado Privacy Act would be enforced by the Colorado Attorney General and District Attorneys, and the Attorney General has rulemaking authority.  If signed into law, the Colorado Privacy Act will go into effect July 1, 2023.