What to know about the CPA

The Colorado Privacy Act, signed on July 8, 2021, is a Colorado state data privacy law that protects Colorado residents from misuse or unauthorized access to their personal information.

The Colorado privacy act introduces multiple data protection requirements for sensitive personal information on residents, including a requirement that no person or entity may collect or maintain personal information on an individual who resides in Colorado without first being permitted by law to do so or having obtained written permission from the Colorado resident.

Businesses must provide consumers with a privacy notice, and it must include

• Categories of sensitive personal information (PI) collected or processed by controller or processor.
• Purpose(s) of processing personal information.
• How to exercise consumer privacy rights and right to appeal if a request is denied.
• Categories of personal information shared.
• Categories of third parties with whom personal information is shared.
• If personal information is sold to a third party or processed for targeted advertising, the controller shall clearly and conspicuously disclose the sale or processing as well as the opt-out mechanism.

The Colorado Data Privacy Act is important to Colorado residents but also to businesses that maintain private information on Colorado residents. CPA imposes data protection requirements for businesses and government entities that maintain personal information of Colorado residents and provides for fines if businesses are found not complying with it. It also allows Colorado citizens affected by certain Colorado data breaches to seek damages in court. Finally, this act expands privacy into the social media realm, limiting what employers can do with employees’ social media accounts while ensuring that worker’s benefits aren’t diminished because they use such online platforms.

The Colorado privacy act (CPA) impacts businesses that maintain personal data on Colorado residents and Colorado residents themselves. The CPA applies to any controller that:

• Conducts business in Colorado or produces or delivers commercial products or services that are targeted to residents of Colorado; and
• Controls or processes the personal data of at least 100,000 consumers or more during a calendar year; or
• Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of 25,000 consumers or more.

CPA Provides Colorado Consumer Rights

Consumer data privacy rights provided by CPA as part of processing of personal data include:

1. Right of access. Like the California Consumer Protection Act (CCPA), CPA gives Consumers the right to confirm and access their personal data.
2. Right to correction. Consumers have the right to request a company to correct inaccuracies in their personal data.
3. Right to delete. Consumers have the right to request a company to delete their personal data.
4. Right to data portability. Consumers have the right to obtain a personal data in a portable and readily usable format that allows the consumer to transmit the data to another entity without hindrance.
5. Right to opt out. Consumers have the right to opt out of the processing of their personal data

Like CCPA, under the CPA, a business must identify all personal data that belongs to a requestor and respond to a consumer request within 45 days of receipt and with an ability to extend that deadline by an additional 45 days. If a business elects to extend that deadline it must notify the consumers within the initial 45-day response period and provide legitimate reason for extension.

The Colorado Attorney General (AG) and district attorneys are tasked with enforcing CPA; They may seek civil remedies for violations by imposing fines and obtaining injunctions to require compliance with Colorado law. Non-compliant entity could be fined up to $20,000 per violation.

CYTRIO is helping all organizations meet the burden of the Colorado Privacy Act (CPA) with an easy-to-use privacy rights management platform. Using CYTRIO, organizations can eliminate 80%+ of manual tasks, resulting in significant time and cost-saving, with CPA compliance response SLAs and minimization risk of regulatory fines, all the while building consumer trust.

Using CYTRIO CPA compliance software, organizations can operationalize and automate Privacy Right Management , enabling organizations to meet a complex set of CPA compliance requirements through a secure data request intake portal, identity verification, AI-driven PI data discovery, classification, identity correlation, data subject access request (DSAR) response orchestration, and detailed audit records. Learn more on CYTRIO’s NextGen Privacy Rights Solution.

 Colorado Attorney General.

Any individual who has a permanent address in Colorado

 Customers of household goods and services, employees, and those who make business-to-business transactions

45 days

If my business is not in Colorado, do I have to comply? Yes, if you have customer/client who resides Colorado you must comply with CPA

 Consumers may only make information requests twice a year and only for a 12-month look-back

 An individual whose data is collected and processed

 An organization that collects data from one or more sources, provides some value-added processing, and repackages the result in a usable form

 the process of matching fields from one database to another.

The process of matching fields from one database to another

 A person who determines the purposes and means of the processing of personal data

 A third-party who processes personal data on behalf of the controller

A business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship