Law note · Colorado
C.R.S. 6-1-716, Notification of Security Breach
Requires a person or commercial entity that maintains computerized personal identifying information of Colorado residents to notify affected residents of a security breach in the most expedient time possible, without unreasonable delay, and within 30 days of determining a breach occurred, subject to a delay while a law-enforcement investigation is pending.
A breach affecting 500 or more residents must also be reported to the Colorado Attorney General; one affecting more than 1,000 residents must also be reported to nationwide consumer reporting agencies. A separate statute, C.R.S. 24-73-103, covers a governmental entity's own breach-notification duty. HB 24-1130 cross-references this section for the biometric-specific breach-response protocol a controller's written policy must include.
What it asks of an app
- If you experience unauthorized acquisition of unencrypted computerized personal information of Colorado residents, notify affected residents without unreasonable delay and within 30 days of determining a breach occurred.
- Notify the Colorado Attorney General if 500 or more residents are affected, and nationwide consumer reporting agencies if more than 1,000 are affected.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_voice, processes_biometrics