On May 26, 2021, the Colorado State Senate unanimously passed the Colorado Privacy Act bill (CPA) through the state Senate. On June 7, 2021, the Colorado House passed the CPA (by a vote of 57-7). The House amended the Senate version of the CPA, so the bill will now return to the Senate for consideration of the House amendments. Specifically, the House adopted nine total amendments to the CPA. Amendments of note include:
-
Consumer rights to access, correction, deletion and data portability do not apply to pseudonymous data;
-
The CPA does not provide a private right of action;
-
The CPA does not apply to data maintained by a state institution of higher education, the state and other government entities; and
-
By January 1, 2025, the Colorado Attorney General may adopt rules to help businesses interpret the CPA. The rules must become effective by July 1, 2025.
Although the CPA is yet to be scheduled to the Senate’s calendar for a final vote, the Colorado legislature closes on June 12, 2021, so the CPA’s fate is likely to be decided within the coming days. If the Senate passes the CPA, it will move onto Governor Polis for his signature. If signed by Governor Polis, the CPA would go into effect on July 1, 2023, making Colorado the third U.S. state to enact a comprehensive privacy law.
