Source: https://coag.gov/resources/data-protection-laws
Timestamp: 2019-04-21 16:45:50+00:00

Document:
Who is impacted by the changes to Colorado’s consumer data privacy laws?
Any person, commercial entity, or governmental entity that maintains, owns, or licenses personal identifying information (“PII”) of Colorado residents in the course of its business, vocation, or occupation.
How have the laws changed?
There have been three major changes. First, the law that requires disposal of PII now requires written policies governing the disposal of both paper and electronic records containing PII. Second, a new law requires covered persons and entities to take reasonable steps to protect PII. Third, the law that requires notification of data security breaches now requires detailed notice to consumers and, in certain circumstances, notice to the Attorney General.
The changes are effective as of September 1, 2018.
What does the new law say about disposal of PII?
If you maintain, own, or license PII, in paper or electronic form, you are required to develop and implement a written policy to ensure that the PII is destroyed when it is no longer needed. Private persons and entities should refer to C.R.S. § 6-1-713. Governmental entities should refer to C.R.S. § 24-73-101.
PII includes social security numbers; personal identification numbers; passwords; pass codes; official state or government-issued driver’s license or identification card numbers; government passport numbers; biometric data; employer, student, or military identification numbers; and financial transaction devices, including financial account numbers.
I am regulated by state or federal law, and my regulator sets its own requirements for disposal of personal identifying information. Is it sufficient to follow those laws and regulations?
Yes. If you maintain procedures for disposal of PII pursuant to the laws, rules, regulations, guidances, or guidelines established by your state or federal regulator, you are in compliance with Colorado’s law governing disposal of personal identifying information.
What steps does the law require me to take to protect PII that I maintain, own, or license in the course of my business?
You are required to take reasonable security measures to protect PII, taking into account the nature and size of your business and the type of PII that you are collecting. See C.R.S. § 6-1-713.5 if you are a person or commercial entity, C.R.S. § 24-73-102 if you are a governmental entity.
I am regulated by state or federal law, and my regulator sets its own requirements for protection of PII. Is it sufficient to follow those laws and regulations?
Yes. If you maintain procedures for the protection of personal identifying information pursuant to the laws, rules, regulations, guidances, or guidelines established by your state or federal regulator, you are in compliance with Colorado’s law governing protection of PII.
I am a third-party service provider that maintains, stores or processes PII for clients. What are my obligations to protect that PII?
Unless your client agrees to provide its own security protection for the PII it discloses to you, it must require you to implement and maintain security procedures and practices that are appropriate to the kind of PII your client is disclosing, and are reasonably designed to help protect the PII from unauthorized access, use, modification, disclosure or destruction.
I am a person, commercial entity, or governmental entity that collects PII. Do I need to familiarize myself with the updates to Colorado’s security breach notification laws?
Yes. There have been significant changes to the security breach notification requirements. See C.R.S. § 6-1-716. The new law also imposes security breach notification requirements for governmental entities. See C.R.S. § 24-73-103.
A security breach is the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of PII maintained by a person, commercial entity, or governmental entity.
A mobile device or data storage device containing PII that is stolen or misplaced.
What type of breached information does the law cover?
Personal information does not include information that is lawfully made available to the general public from government records or widely distributed media.
Under what circumstances do I have to notify Colorado residents of a security breach?
If you become aware that a security breach may have occurred, you must conduct a prompt, good faith investigation to determine the likelihood that personal information has been or will be misused. Unless the investigation determines that the information has not been misused and is not reasonably likely to be misused, you must provide notice to the affected Colorado residents.
How long do I have to provide notice to the affected Colorado Residents?
You must provide notice in the most expedient time possible, without unreasonable delay, and within 30 days after the date of determination that a security breach has occurred. You may take longer than 30 days to provide notice if a law enforcement agency has directed you not to send notice, or if longer than 30 days is necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.
Other than the affected Colorado residents, am I required to notify anyone else?
If the security breach is reasonably believed to have affected 500 or more Colorado residents, you must provide notice of the security breach to the Colorado Attorney General. You must provide this notice in the most expedient time possible and without unreasonable delay, but not later than 30 days after the date of determination that a security breach occurred.
Notice to the Attorney General should be sent to the Consumer Protection Program Manager at databreach@coag.gov.
If the security breach is reasonably believed to have affected more than 1,000 Colorado residents, you must notify the consumer reporting agencies that compile and maintain files on consumers on a nationwide basis. You must notify these agencies of the anticipated date of the notification to the residents and the approximate number of residents who are to be notified. You must provide this notice in the most expedient time possible and without unreasonable delay.
How must the notice to Colorado residents be provided?
Electronic notice, if you use electronic means as a primary means of communicating with the Colorado resident, or if you provide notice consistent with the provisions regarding electronic records and signatures set forth in the federal “Electronic Signatures in Global and National Commerce Act,” 15 U.S. C. sec. 7001 et seq.
Is there any exception to the requirement to provide notice in this manner?
What are the requirements for substitute notice?
What information should I include in the notice to Colorado residents?
The security breach included a Colorado resident’s username or e-mail address, in combination with a password or security questions and answers, that would permit access to an online account. Are there additional notice requirements?
Yes. In this case, you must also direct the affected Colorado residents to take steps to protect their account, i.e., by changing their user password and/or security questions and answers.
My entity maintains its own notification procedures as part of its information security policy. Is it sufficient to comply with those procedures?
If your procedures are consistent with the timing requirements set forth in C.R.S. § 6-1-716, you may follow your own procedures for notifying Colorado residents. However, if the security breach is reasonably believed to have affected 500 or more Colorado residents, you are still required to provide notice to the Colorado Attorney General at databreach@coag.gov.
My entity is regulated by state or federal law (i.e., the Health Insurance Portability and Accountability Act (HIPAA) or the Gramm-Leach-Bliley Act) and maintains procedures for security breaches in compliance with those laws and regulations. Is it sufficient to comply with those laws and regulations?
If the applicable laws set forth different timeframes for the notification to Colorado residents, the law with the shorter timeframe applies. For example, while HIPAA, in some circumstances, permits notification within a period of up to 60 days, you must provide notice in compliance with Colorado’s 30-day timeframe.
What do I have to provide in my notice to the Colorado Attorney General?
A copy of the notice you provided to Colorado residents.
Please DO NOT provide the Attorney General with the PII that was breached. If the office requires additional information, someone will contact your primary contact as described above to request that information.

References: § 6
 § 24
 § 6
 § 24
 § 6
 § 24
 § 6