July 19, 2021 – Colorado became the third state to enact comprehensive data privacy legislation – after California and Virginia – when Gov. Jared Polis (D) signed the Colorado Privacy Act into law on July 8. The Colorado law is similar to the two other states’ laws, in that it grants individuals greater control over how their personal information is collected, stored, and used, and it mandates specific rights to access, correct and delete personal data.
Colorado’s law requires a universal opt-out mechanism “for the processing of personal data for purposes of targeted advertising or the sale of personal data”; bars some opt-in mechanisms that are considered misleading; and has a slightly narrower definition of what constitutes personal data, according to Coalition for Healthcare Communication Executive Director Jon Bigelow, who explained in a CHC Industry Leaders Alert that the Colorado law will be enforced entirely by the state Attorney General and district attorneys (similar to Virginia’s law), and that individuals do not have a “private right of action” to sue under this law.
According to a June 17 article in the Colorado Sun, “the proposal started as a compromise between the interests of consumers and businesses, and it’s based on similar laws passed by two other states. The California law, considered more consumer friendly, isn’t opt-in either. The Virginia law also doesn’t let consumers sue violators.”
In a statement regarding the new law, Polis said that “as our economy continues to evolve and innovate in response to the demands of technology and the internet, new protections are needed to prevent fraud, abuse and misuse.”
Bigelow noted that in data privacy legislation, “the devil is in the details. The fact that there are significant differences among the California, Virginia, and Colorado laws – not to mention among the proposals being considered in a host of other states – again points to the importance of having the federal government create one national standard for regulating data privacy and security.”
Polis added in his statement that the new Colorado data privacy law “will keep consumers safe from harmful practices and hopefully will become a template for a nationwide standard passed by Congress in the future.”