The Colorado Privacy Act (CPA), passed by the Colorado Legislature in 2021, takes effect on July 1, 2023, with enforcement beginning in 2024. The CPA provides consumers the right to access, correct, and delete personal data and the right to opt out, not only of the sale of personal data but also of the collection and use of personal data.
As an employer, you may be wondering what impact the CPA will have on the employment relationship. Employee data is not covered by the new law, nor are employees or applicants, since the law defines a consumer as an individual who is a Colorado resident acting only in an individual or household context. It does not include an individual acting in an employment context, as a job applicant, or as a beneficiary of an employee.
The CPA does not include any protected health information under the Health Insurance Portability and Accountability Act (HIPAA) or any consumer information under the Fair Credit Reporting Act (FCRA). The legislature did not want to have any Colorado legislation interfere with those or other federal laws that regulate the protection of information for unique purposes.
The new law imposes an obligation on companies to safeguard personal data and to provide information to consumers about how their personal data is used. It also requires data protection assessments in the collection and use of personal data. Additionally, it empowers the attorney general and district attorneys to access and evaluate a company’s data protection assessments, impose penalties where violations occur, and prevent future violations.
The CPA builds on current Colorado law that requires companies, including employers, to alert consumers or employees if their data, including personal information, is breached. (Colo. Rev. Stat. § 6-1-716)
#DataManagementandCybersecurity#Colorado