Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

core/heading

Consumer Data Privacy and Online Monitoring

core/paragraph

Available at: <a href="https://coag.gov/app/uploads/2022/01/SB-21-190-CPA_Final.pdf">https://coag.gov/app/uploads/2022/01/SB-21-190-CPA_Final.pdf</a>

Data Breach Requirements: Colo. Rev. Stat. § 6-1-716.

The numbering and internal citations herein are derived from the applicable state statute.

(g)(I)(A) The term “personal information” means a Colorado resident’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident, when the data elements are not encrypted, redacted, or secured by any other method rendering the name or the element unreadable or unusable: Social Security number; student, military, or passport identification number; driver’s license number or identification card number; medical information; health insurance identification number; or biometric data;

(B) A Colorado resident’s username or email address, in combination with a password or security questions and answers, that would permit access to an online account; or (C) A Colorado resident’s account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to that account.

core/separator

The term “security breach” means the unauthorized acquisition of unencrypted computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity.

Good faith acquisition of personal information by an employee or agent of a covered entity for the covered entity’s business purposes is not a security breach if the personal information is not used for a purpose unrelated to the lawful operation of the business or is not subject to further unauthorized disclosure.

A covered entity that maintains, owns, or licenses computerized data that includes personal information about a resident of Colorado shall, when it becomes aware that a security breach may have occurred, conduct in good faith a prompt investigation to determine the likelihood that personal information has been or will be misused. The covered entity shall give notice to the affected Colorado residents unless the investigation determines that the misuse of information about a Colorado resident has not occurred and is not reasonably likely to occur.

Notice of the security breach must be made in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.

Notice of a data breach may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation and the law enforcement agency has notified the covered entity that conducts business in Colorado not to send the breach notice. The breach notice must be made in good faith, in the most expedient time possible, and without unreasonable delay, but not later than thirty days after the law enforcement agency determines that notification will no longer impede the investigation and has notified the covered entity that conducts business in Colorado that it is appropriate to send the breach notice.

In the case of a breach of personal information, notice to affected Colorado residents must include, but need not be limited to, the following information:

(I) The date, estimated date, or estimated date range of the security breach;

(II) A description of the personal information that was acquired or reasonably believed to have been acquired as part of the security breach;

(III) Information that the resident can use to contact the covered entity to inquire about the security breach;

(IV) The toll-free numbers, addresses, and websites for consumer reporting agencies;

(V) The toll-free number, address, and website for the Federal Trade Commission; and (VI) A statement that the resident can obtain information from the Federal Trade Commission and the credit reporting agencies about fraud alerts and security freezes.

A breach notice may be provided by one of the following methods:

(I) Written notice to the postal address listed in the records of the covered entity;

(III) Electronic notice, if a primary means of communication by the covered entity with a Colorado resident is by electronic means or the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); or (IV) Substitute notice, if the covered entity required to provide notice demonstrates that the cost of providing notice will exceed $250,000, the affected class of persons to be notified exceeds 250,000 Colorado residents, or the covered entity does not have sufficient contact information to provide notice.

Substitute notice consists of all of the following:

(A) Email notice if the covered entity has email addresses for the members of the affected class of Colorado residents;

(B) Conspicuous posting of the notice on the website page of the covered entity if the covered entity maintains one; and (C) Notification to major statewide media.

The covered entity that must notify Colorado residents of a data breach shall provide notice of any security breach to the Colorado attorney general in the most expedient time possible and without unreasonable delay, but not later than 30 days after the date of determination that a security breach occurred, if the security breach is reasonably believed to have affected 500 Colorado residents or more, unless the investigation determines that the misuse of information about a Colorado resident has not occurred and is not likely to occur. The Colorado attorney general shall designate a person or persons as a point of contact for these functions and shall make the contact information for the person or persons public on the attorney general’s website and by any other appropriate means.

If a covered entity is required to notify more than 1,000 Colorado residents of a security breach, the covered entity shall also notify, in the most expedient time possible and without unreasonable delay, all consumer reporting agencies of the anticipated date of the notification to the residents and the approximate number of residents who are to be notified. Nothing in this subsection (2)(d) requires the covered entity to provide to the consumer reporting agency the names or other personal information of security breach notice recipients. This subsection (2)(d) does not apply to a covered entity who is subject to Title V of the Gramm-Leach-Bliley Act.

A covered entity that is regulated by state or federal law and that maintains procedures for a security breach pursuant to the laws, rules, regulations, guidances, or guidelines established by its state or federal regulator is in compliance with this section; notice to the attorney general is still required pursuant to subsection (2)(f) of this section. In the case of a conflict between the time period for notice to individuals that is required pursuant to law and the applicable state or federal law or regulation, the law or regulation with the shortest time frame for notice to the individual controls.

The law’s content requirements shall not be interpreted to prohibit data breach notifications from containing additional information, including any information that may be required by state or federal law.

If a covered entity uses a third-party service provider to maintain computerized data that includes personal information, then the third-party service provider shall give notice to and cooperate with the covered entity in the event of a security breach that compromises such computerized data, including notifying the covered entity of any security breach in the most expedient time possible, and without unreasonable delay following discovery of a security breach, if misuse of personal information about a Colorado resident occurred or is likely to occur. Cooperation includes sharing with the covered entity information relevant to the security breach; except that such cooperation does not require the disclosure of confidential business information or trade secrets.

If an investigation by the covered entity into the security breach determines that the type of personal information described in subsection (1)(g)(I)(B) of this section has been misused or is reasonably likely to be misused, then the covered entity shall, in addition to the notice otherwise required by subsection (2)(a.2) of this section and in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system:<br>(I) Direct the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the covered entity and all other online accounts for which the person whose personal information has been breached uses the same username or email address and password or security question or answer.<br>(II) For log-in credentials of an email account furnished by the covered entity, the covered entity shall not comply with this section by providing the security breach notification to that email address, but may instead comply with this section by providing notice through other methods, as defined in subsection (1)(f) of this section, or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an internet protocol address or online location from which the covered entity knows the resident customarily accesses the account.

A covered entity that is required to provide a breach notification to affected Colorado residents is prohibited from charging the cost of providing such notice to such residents.

Data Disposal and Security: Colo. Rev. Stat. § 6-1-713 and 713.5.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal identifying information” means a Social Security number; a personal identification number; a password; a pass code; an official state or government-issued driver’s license or identification card number; a government passport number; biometric data, as defined in Section 6-1-716(1)(a); an employer, student, or military identification number; or a financial transaction device, as defined in Section 18-5-701(3).

The term “biometric data” means unique biometric data generated from measurements or analysis of human body characteristics for the purpose of authenticating the individual when he or she accesses an online account.

The term “financial transaction device” means any instrument or device whether known as a credit card, banking card, debit card, electronic fund transfer card, or guaranteed check card, or account number representing a financial account or affecting the financial interest, standing, or obligation of or to the account holder, that can be used to obtain cash, goods, property, or services or to make financial payments, but shall not include a “check,” a “negotiable order of withdrawal,” and a “share draft” as defined in Section 18-5-205.

The term “third-party service provider” means an entity that has been contracted to maintain, store, or process personal identifying information on behalf of a covered entity.

To protect personal identifying information from unauthorized access, use, modification, disclosure, or destruction, a covered entity that maintains, owns, or licenses personal identifying information of an individual residing in the state shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal identifying information and the nature and size of the business and its operations.

Unless a covered entity agrees to provide its own security protection for the information it discloses to a third-party service provider, the covered entity shall require that the third-party service provider implement and maintain reasonable security procedures and practices that are: (a) appropriate to the nature of the personal identifying information disclosed to the third-party service provider; and (b) reasonably designed to help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction.

A disclosure of personal identifying information does not include disclosure of information to a third party under circumstances where the covered entity retains primary responsibility for implementing and maintaining reasonable security procedures and practices appropriate to the nature of the personal identifying information and the covered entity implements and maintains technical controls that are reasonably designed to: (a) Help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction; or (b) Effectively eliminate the third party’s ability to access the personal identifying information, notwithstanding the third party’s physical possession of the personal identifying information.

Each covered entity in the state that maintains paper or electronic documents during the course of business that contain personal identifying information shall develop a written policy for the destruction or proper disposal of those paper and electronic documents containing personal identifying information. Unless otherwise required by state or federal law or regulation, the written policy must require that, when such paper or electronic documents are no longer needed, the covered entity shall destroy or arrange for the destruction of such paper and electronic documents within its custody or control that contain personal identifying information by shredding, erasing, or otherwise modifying the personal identifying information in the paper or electronic documents to make the personal identifying information unreadable or indecipherable through any means.

A covered entity that is regulated by state or federal law and that maintains procedures for disposal of personal identifying information pursuant to the laws, rules, regulations, guidances, or guidelines established by its state or federal regulator is in compliance with this section.

Unless an entity specifically contracts with a recycler or disposal firm for destruction of documents that contain personal identifying information, nothing in the law shall require a recycler or disposal firm to verify that the documents contained in the products it receives for disposal or recycling have been properly destroyed or disposed of as required by this section.

A covered entity that is regulated by state or federal law and that maintains procedures for protection of personal identifying information pursuant to the laws, rules, regulations, guidances, or guidelines established by its state or federal regulator is in compliance with this section.