In 2021, the general assembly enacted Senate Bill 21-190, concerning additional protection of data relating to personal privacy, which established the "Colorado Privacy Act" (privacy act) as part of the "Colorado Consumer Protection Act". The privacy act protects the privacy of individuals' personal data by establishing certain requirements for entities that process personal data. The privacy act also describes certain rights that consumers may exercise regarding the processing of their personal data. The privacy act includes additional protections for sensitive data.
For the purposes of the privacy act, the act expands the definition of "sensitive data" to include biological data, which is data generated by the technological processing, measurement, or analysis of an individual's biological, genetic, biochemical, physiological, or neural properties, compositions, or activities or of an individual's body or bodily functions, which data is used or intended to be used, singly or in combination with other personal data, for identification purposes. Biological data includes neural data, which is information that is generated by the measurement of the activity of an individual's central or peripheral nervous systems and that can be processed by or with the assistance of a device.
APPROVED by Governor April 17, 2024
EFFECTIVE August 7, 2024(Note: This summary applies to this bill as enacted.)

Statutes affected:
Final Act (04/09/2024): 6-1-1303