Colorado: Personal data privacy bill introduced in State Senate
Senate Bill ('SB') 21-190 for an Act concerning additional protection of data relating to personal privacy was introduced, on 19 March 2021, to the Colorado State Senate. In particular, the bill provides several privacy rights including the right to opt-out of the processing of personal data, as well the right to access, correction, or deletion of personal data, or to obtain a portable copy of the data. Furthermore, the bill imposes obligations on data controllers such as transparency, purpose specification, data minimisation, avoiding unlawful discrimination, and the use of sensitive data, among others. In addition, the bill requires that controllers conduct assessments when processing personal data in activities that present a heightened risk to consumers, and assigns enforcement powers to the Attorney General ('AG') and district attorneys.
UPDATE (14 May 2021)
SB 21-190 referred to Appropriations Committee with amendments
SB 21-190 passed, on 5 May 2021, the Colorado Senate Business, Labor & Technology Committee and was referred to the Colorado Senate Committee on Appropriations with amendments. In particular, the amendments include the removal of the opt-in for processing of consumer sensitive data, omissions on a controller's obligation to disclose data to a consumer that would disclose the controller's trade secrets and to delete data that the controller believes on a reasonable basis has been made available to the public, as well as amendments to data subject rights.
UPDATE (1 June 2021)
SB 21-190 passes State Senate
SB 21-190 passed, on 26 May 2021, the State Senate following a third reading with no amendments. In particular, SB 21-190 had been sent to the Colorado House of Representatives on 27 May 2021.
UPDATE (7 June 2021)
SB 21-190 passes second reading with amendments
SB 21-190 received, on 4 June 2021, additional amendments following the passage of the second reading in the House. In particular, the amendments reintroduce pseudonymous data and provide an exception to data subject rights in relation to such data. Moreover, the amendments provide that the AG may adopt rules that govern the process of issuing opinion letters and interpretative guidance to develop an operational framework for business. In addition, the amendments provide that, should SB 21-190 become law, such rules must become effective by 1 July 2025. Furthermore, from 1 January 2024, a controller that processes personal data for purposes of targeted advertising or the sale of personal data must allow consumers to exercise the right to opt out of the processing through a user-selected universal opt-out mechanism that meets the technical specifications established by the AG.
UPDATE (8 June 2021)
SB 21-190 passes third reading in House
The House passed, on 7 June 2021, SB 21-190, following a third reading with no amendments. In particular, SB 21-190 will now be sent to the Senate to consider the amendments that were made during the second reading in the House.
UPDATE (9 June 2021)
Senate repasses SB 21-190 and due to be sent to Governor
The Senate repassed, on 8 June 2021, SB 21-190, following their consideration of amendments made to SB 21-190 by the House. In particular, SB 21-190 now requires the signature of the Governor, or it can become a law without the Governor's signature if not expressly vetoed.
Once enacted, SB 21-190 will go into effect on 1 July 2023.
UPDATE (29 June 2021)
SB 21-190 sent to Governor for signature
SB21-190 was sent, on 25 June 2021, to the Governor for signature.
UPDATE (8 July 2021)
SB 21-190 signed into law by Governor
SB21-190 was signed, on 7 July 2021, into the law by the Governor. In particular, following signing, SB 21-190 will go into effect on 1 July 2023.