HOUSE BILL 24-1130
BY REPRESENTATIVE(S) Daugherty and Lynch, Amabile, Bacon, Bird,
Boesenecker, Brown, deGruy Kennedy, Duran, Hamrick, Herod, Jodeh,
Kipp, Lieder, Lindsay, Mabrey, Marshall, Marvin, Parenti, Rutinel, Sirota,
Titone, Valdez, Weinberg, Weissman, Young, McCluskie, Clifford, Frizell,
Joseph, Martinez, Ricks, Soper, Story;
also SENATOR(S) Lundeen and Hansen, Baisley, Bridges, Buckner,
Cutter, Gardner, Ginal, Gonzales, Hinrichsen, Michaelson Jenet, Pelton B.,
Priola, Van Winkle, Will.
C
ONCERNING PROTECTING THE PRIVACY OF AN INDIVIDUAL 'S BIOMETRIC
DATA
.
Be it enacted by the General Assembly of the State of Colorado:
SECTION 1. Legislative declaration. (1) The general assembly
finds that:
(a) Businesses increasingly use biometric identifiers to attempt to
verify customer identities, streamline transactions, control access to secure
areas, and maximize revenues;
(b) Biometric identifiers are unlike other unique identifiers that are
NOTE: This bill has been prepared for the signatures of the appropriate legislative
officers and the Governor. To determine whether the Governor has signed the bill
or taken other action on it, please consult the legislative status sheet, the legislative
history, or the Session Laws.
________
Capital letters or bold & italic numbers indicate new material added to existing law; dashes
through words or numbers indicate deletions from existing law and such material is not part of
the act. used to verify identity or to access finances or other sensitive information
because, unlike social security numbers, for example, biometric identifiers
cannot be changed; they are unique to an individual, and once an
individual's biometric identifiers are compromised, the individual has no
recourse, is at heightened risk for identity theft, and may no longer feel safe
participating in biometric-facilitated transactions;
(c) The public has grown wary of the use of biometric identifiers
due to recent data breaches that have exposed many individuals' biometric
identifiers, leaving those individuals vulnerable to harm; and
(d) Biometric identifiers can be collected without an individual's
knowledge, applied instantaneously to identify the individual in
circumstances where the individual has an expectation of privacy and
anonymity, and used to identify and track the individual's movements,
activities, and associations.
(2) The general assembly further finds that:
(a) One increasingly prevalent biometric collection and matching
technology, facial recognition technology, has been shown to have higher
rates of misidentification and misclassification when it is used on faces of
color, of women, of children, of the elderly, and of transgender and
nonbinary persons; and
(b) This misidentification and misclassification has led to
documented cases of businesses refusing admission or service to individuals
because facial recognition systems incorrectly "matched" the individuals to
photos of suspected shoplifters or other individuals who had been barred
from the premises.
(3) While increasing protections for individuals' biometric
identifiers is of the utmost importance, critical privacy protections must be
balanced with the use of biometric data to support public safety as outlined
in state and federal statutes. The "Colorado Privacy Act", part 13 of article
1 of title 6, Colorado Revised Statutes, includes a variety of exceptions to
the requirements established in this act, including permitted uses of
biometric data for public safety needs, and all of the exceptions that apply
to the entirety of the "Colorado Privacy Act" apply to the protections
established for biometric data and biometric identifiers in this act.
PAGE 2-HOUSE BILL 24-1130 (4) Therefore, the general assembly declares that the public welfare,
security, and safety will be served by regulating the collection, use,
safeguarding, handling, storage, retention, and destruction of biometric
identifiers.
SECTION 2. In Colorado Revised Statutes, add 6-1-1314 as
follows:
6-1-1314. Biometric data and biometric identifiers - controllers
- duties and requirements - written policy - prohibited acts - right to
correct biometric identifiers - right to access biometric identifiers -
remedies and civil actions - definitions. (1) A
S USED IN THIS SECTION,
UNLESS THE CONTEXT OTHERWISE REQUIRES :
(a) "C
OLLECT", "COLLECTION", OR "COLLECTING" MEANS TO ACCESS,
ASSEMBLE, BUY, RENT, GATHER, PROCURE, RECEIVE, CAPTURE, OR
OTHERWISE OBTAIN ANY BIOMETRIC IDENTIFIER OR BIOMETRIC DATA
PERTAINING TO A CONSUMER BY ANY MEANS
, ONLINE OR OFFLINE,
INCLUDING:
(I) A
CTIVELY OR PASSIVELY RECEIVING A BIOMETRIC IDENTIFIER OR
BIOMETRIC DATA FROM THE CONSUMER OR FROM A THIRD PARTY
; AND
(II) OBTAINING BIOMETRIC DATA BY OBSERVING THE CONSUMER 'S
BEHAVIOR
.
(b) "E
MPLOYEE" MEANS AN INDIVIDUAL WHO IS EMPLOYED
FULL
-TIME, PART-TIME, OR ON-CALL OR WHO IS HIRED AS A CONTRACTOR ,
SUBCONTRACTOR, INTERN, OR FELLOW.
(c) "L
EGALLY AUTHORIZED REPRESENTATIVE " MEANS A PARENT OR
LEGAL GUARDIAN OF A MINOR OR A LEGAL GUARDIAN OF AN ADULT
.
(2) Written policy required. (a) A
CONTROLLER THAT CONTROLS
OR PROCESSES ONE OR MORE BIOMETRIC IDENTIFIERS SHALL ADOPT A
WRITTEN POLICY THAT
:
(I) E
STABLISHES A RETENTION SCHEDULE FOR BIOMETRIC
IDENTIFIERS AND BIOMETRIC DATA
;
PAGE 3-HOUSE BILL 24-1130 (II) INCLUDES A PROTOCOL FOR RESPONDING TO A DATA SECURITY
INCIDENT THAT MAY COMPROMISE THE SECURITY OF BIOMETRIC IDENTIFIERS
OR BIOMETRIC DATA
, INCLUDING A PROCESS FOR NOTIFYING A CONSUMER
WHEN THE SECURITY OF THE CONSUMER
'S BIOMETRIC IDENTIFIER OR
BIOMETRIC DATA HAS BEEN BREACHED
, PURSUANT TO SECTION 6-1-716; AND
(III) INCLUDES GUIDELINES THAT REQUIRE THE DELETION OF A
BIOMETRIC IDENTIFIER ON OR BEFORE THE EARLIEST OF THE FOLLOWING
DATES
:
(A) T
HE DATE UPON WHICH THE INITIAL PURPOSE FOR COLLECTING
THE BIOMETRIC IDENTIFIER HAS BEEN SATISFIED
;
(B) T
WENTY-FOUR MONTHS AFTER THE CONSUMER LAST INTERACTED
WITH THE CONTROLLER
; OR
(C) THE EARLIEST REASONABLY FEASIBLE DATE , WHICH DATE MUST
BE NO MORE THAN FORTY
-FIVE DAYS AFTER A CONTROLLER DETERMINES
THAT STORAGE OF THE BIOMETRIC IDENTIFIER IS NO LONGER NECESSARY
,
ADEQUATE, OR RELEVANT TO THE EXPRESS PROCESSING PURPOSE IDENTIFIED
BY A REVIEW CONDUCTED BY THE CONTROLLER AT LEAST ONCE ANNUALLY
.
T
HE CONTROLLER MAY EXTEND THE FORTY -FIVE-DAY PERIOD DESCRIBED IN
THIS SUBSECTION
(2)(a)(III)(C) BY UP TO FORTY-FIVE ADDITIONAL DAYS IF
SUCH AN EXTENSION IS REASONABLY NECESSARY
, TAKING INTO ACCOUNT
THE COMPLEXITY AND NUMBER OF BIOMETRIC IDENTIFIERS REQUIRED TO BE
DELETED
.
(b) A
CONTROLLER SHALL MAKE ITS POLICY ADOPTED PURSUANT TO
SUBSECTION
(2)(a) OF THIS SECTION AVAILABLE TO THE PUBLIC ; EXCEPT
THAT A CONTROLLER IS NOT REQUIRED TO MAKE AVAILABLE TO THE PUBLIC
:
(I) A
WRITTEN POLICY THAT APPLIES ONLY TO CURRENT EMPLOYEES
OF THE CONTROLLER
;
(II) A
WRITTEN POLICY THAT IS USED SOLELY BY EMPLOYEES AND
AGENTS OF THE CONTROLLER FOR THE OPERATION OF THE CONTROLLER
; OR
(III) THE INTERNAL PROTOCOL FOR RESPONDING TO A DATA
SECURITY INCIDENT THAT MAY COMP ROMISE THE SECURITY OF BIOMETRIC
IDENTIFIERS OR BIOMETRIC DATA
.
PAGE 4-HOUSE BILL 24-1130 (3) Processors - security breach protocols. A PROCESSOR OF
BIOMETRIC IDENTIFIERS OR BIOMETRIC DATA MUST HAVE A PROTOCOL FOR
RESPONDING TO A DATA SECURITY INCIDENT THAT MAY COMPROMISE THE
SECURITY OF BIOMETRIC IDENTIFIERS OR BIOMETRIC DATA
, INCLUDING A
PROCESS FOR NOTIFYING THE CONTROLLER WHEN THE SECURITY OF A
CONSUMER
'S BIOMETRIC IDENTIFIER OR BIOMETRIC DATA HAS BEEN
BREACHED
, PURSUANT TO SECTION 6-1-716.
(4) Collection and retention of biometric identifiers -
requirements - prohibited acts. (a) A
CONTROLLER SHALL NOT COLLECT
OR PROCESS A BIOMETRIC IDENTIFI ER OF A CONSUMER UNLESS THE
CONTROLLER FIRST
:
(I) S
ATISFIES ALL DUTIES REQUIRED BY SECTION 6-1-1308;
(II) I
NFORMS THE CONSUMER OR THE CONSUMER 'S LEGALLY
AUTHORIZED REPRESENTATIVE IN A CLEAR
, REASONABLY ACCESSIBLE, AND
UNDERSTANDABLE M ANNER THAT A BIOMETRIC IDENTIFIER IS BEING
COLLECTED
;
(III) I
NFORMS THE CONSUMER OR THE CONSUMER 'S LEGALLY
AUTHORIZED REPRESENTATIVE IN A CLEAR
, REASONABLY ACCESSIBLE, AND
UNDERSTANDABLE MANNER OF THE SPECIFIC PURPOSE FOR WHICH A
BIOMETRIC IDENTIFIER IS BEING COLLECTED AND THE LENGTH OF TIME THAT
THE CONTROLLER WILL RETAIN THE BIOMETRIC IDENTIFIER
; AND
(IV) INFORMS THE CONSUMER OR THE CONSUMER 'S LEGALLY
AUTHORIZED REPRESENTATIVE IN A CLEAR
, REASONABLY ACCESSIBLE, AND
UNDERSTANDABLE MANNER IF THE BIOMETRIC IDENTIFIER WILL BE
DISCLOSED
, REDISCLOSED, OR OTHERWISE DISSEMINATED TO A PROCESSOR
AND THE SPECIFIC PURPOSE FOR WHICH THE BIOMETRIC IDENTIFIER IS BEING
SHARED WITH A PROCESSOR
.
(b) A
CONTROLLER THAT PROCESSES A CONSUMER 'S BIOMETRIC
IDENTIFIER SHALL NOT
:
(I) S
ELL, LEASE, OR TRADE THE BIOMETRIC IDENTIFIER WITH ANY
ENTITY
; OR
(II) DISCLOSE, REDISCLOSE, OR OTHERWISE DISSEMINATE THE
PAGE 5-HOUSE BILL 24-1130 BIOMETRIC IDENTIFIER UNLESS:
(A) T
HE CONSUMER OR THE CONSUMER 'S LEGALLY AUTHORIZED
REPRESENTATIVE CONSENTS TO THE DISCLOSURE
, REDISCLOSURE, OR OTHER
DISSEMINATION
;
(B) T
HE DISCLOSURE, REDISCLOSURE, OR OTHER DISSEMINATION IS
REQUESTED OR AUTHORIZED BY THE CONSUMER OR THE CONSUMER
'S
LEGALLY AUTHORIZED REPRESENTATIVE FOR THE PURPOSE OF COMPLETING
A FINANCIAL TRANSACTION
;
(C) T
HE DISCLOSURE, REDISCLOSURE, OR OTHER DISSEMINATION IS
TO A PROCESSOR AND IS NECESSARY FOR THE PURPOSE FOR WHICH THE
BIOMETRIC IDENTIFIER WAS COLLECTED AND TO WHICH THE CONSUMER OR
THE CONSUMER
'S LEGALLY AUTHORIZED REPRESENTATIVE CONSENTED ; OR
(D) THE DISCLOSURE, REDISCLOSURE, OR OTHER DISSEMINATION IS
REQUIRED BY STATE OR FEDERAL LAW
.
(c) A
CONTROLLER SHALL NOT:
(I) R
EFUSE TO PROVIDE A GOOD OR SERVICE TO A CONSUMER , BASED
ON THE CONSUMER
'S REFUSAL TO CONSENT TO THE CONTROLLER 'S
COLLECTION
, USE, DISCLOSURE, TRANSFER, SALE, RETENTION, OR
PROCESSING OF A BIOMETRIC IDENTIFIER UNLESS THE COLLECTION
, USE,
DISCLOSURE, TRANSFER, SALE, RETENTION, OR PROCESSING OF THE
BIOMETRIC IDENTIFIER IS NECESSARY TO PROVIDE THE GOOD OR SERVICE
;
(II) C
HARGE A DIFFERENT PRICE OR RATE FOR A GOOD OR SERVICE OR
PROVIDE A DIFFERENT LEVEL OF QUALITY OF A GOOD OR SERVICE TO ANY
CONSUMER WHO EXERCISES THE CONSUMER
'S RIGHTS UNDER THIS PART 13;
OR
(III) PURCHASE A BIOMETRIC IDENTIFIER UNLESS THE CONTROLLER
PAYS THE CONSUMER FOR THE COLLECTION OF THE CONSUMER
'S BIOMETRIC
IDENTIFIER
, THE PURCHASE IS UNRELATED TO THE PROVISION OF A PRODUCT
OR SERVICE TO THE CONSUMER
, AND THE CONTROLLER HAS OBTAINED
CONSENT AS DESCRIBED IN SUBSECTION
(4)(a) OF THIS SECTION.
(d) A
CONTROLLER OR PROCESSOR SHALL STORE , TRANSMIT, AND
PAGE 6-HOUSE BILL 24-1130 PROTECT FROM DISCLOSURE ALL BIOMETRIC IDENTIFIERS USING THE
STANDARD OF CARE WITHIN THE CONTROLLER
'S INDUSTRY AND IN
ACCORDANCE WITH SECTIONS
6-1-1305 (4) AND 6-1-1308 (5).
(e) A
CONTROLLER SHALL OBTAIN CONSENT FROM A CONSUMER OR
FROM THE CONSUMER
'S LEGALLY AUTHORIZED REPRESENTATIVE BEFORE
COLLECTING THE CONSUMER
'S BIOMETRIC DATA, AS REQUIRED BY SECTION
6-1-1308 (7).
(5) Right to access biometric data - applicability - definition.
(a) E
XCEPT AS DESCRIBED IN SUBSECTION (5)(b) OF THIS SECTION, AT THE
REQUEST OF A CONSUMER OR A CONSUMER
'S LEGALLY AUTHORIZED
REPRESENTATIVE
, A CONTROLLER THAT COLLECTS THE CONSUMER 'S
BIOMETRIC DATA SHALL DISCLOSE TO THE CONSUMER
, FREE OF CHARGE, THE
CATEGORY OR DESCRIPTION OF THE CONSUMER
'S BIOMETRIC DATA AND THE
FOLLOWING INFORMATION
:
(I) T
HE SOURCE FROM WHICH THE CONTROLLER COLLECTED THE
BIOMETRIC DATA
;
(II) T
HE PURPOSE FOR WHICH THE CONTROLLER COLLECTED OR
PROCESSED THE BIOMETRIC DATA AND ANY ASSOCIATED PERSONAL DATA
;
(III) T
HE IDENTITY OF ANY THIRD PARTY WITH WHICH THE
CONTROLLER DISCLOSED OR DISCLOSES THE BIOMETRIC DATA AND THE
PURPOSES FOR DISCLOSING
; AND
(IV) THE CATEGORY OR A DESCRIPTION OF THE SPECIFIC BIOMETRIC
DATA THAT THE CONTROLLER DISCLOSES TO THIRD PARTIES
.
(b) T
HE REQUIREMENTS OF SUBSECTION (5)(a) OF THIS SECTION
APPLY ONLY TO
:
(I) A
SOLE PROPRIETORSHIP, A PARTNERSHIP, A LIMITED LIABILITY
COMPANY
, A CORPORATION, AN ASSOCIATION, OR ANOTHER LEGAL ENTITY
THAT
:
(A) C
ONDUCTS BUSINESS IN COLORADO OR PRODUCES OR DELIVERS
COMMERCIAL PRODUCTS OR SERVICES THAT ARE MARKETED TO
COLORADO
RESIDENTS
;
PAGE 7-HOUSE BILL 24-1130 (B) COLLECTS BIOMETRIC DATA OR HAS BIOMETRIC DATA
COLLECTED ON ITS BEHALF
; AND
(C) EITHER COLLECTS OR PROCESSES THE PERSONAL DATA OF ONE
HUNDRED THOUSAND INDIVIDUALS OR MORE DURING A CALENDAR YEAR OR
COLLECTS AND PROCESSES THE PERSONAL DATA OF TWENTY
-FIVE THOUSAND
INDIVIDUALS OR MORE AND DERIVES REVENUE FROM
, OR RECEIVES A
DISCOUNT ON THE PRICE OF GOODS OR SERVICES FROM
, THE SALE OF
PERSONAL DATA
;
(II) A
CONTROLLER THAT CONTROLS OR IS CONTROLLED BY ANOTHER
CONTROLLER AND THAT SHARES COMMON BRANDING WITH THE OTHER
CONTROLLER
. AS USED IN THIS SUBSECTION (5)(b)(II), "COMMON BRANDING"
MEANS A SHARED NAME, SERVICE MARK, OR TRADEMARK THAT A CONSUMER
WOULD REASONABLY UNDERSTAND TO INDICATE THAT TWO OR MORE
ENTITIES ARE COMMONLY OWNED
.
(III) A
JOINT VENTURE OR PARTNERSHIP CONSISTING OF NO MORE
THAN TWO BUSINESSES THAT SHARE CONSUMERS
' PERSONAL DATA WITH
EACH OTHER
.
(6) Use of consent by employers. (a) A
N EMPLOYER MAY REQUIRE
AS A CONDITION OF EMPLOYMENT THAT AN EMPLOYEE OR A PROSPECTIVE
EMPLOYEE CONSENT TO ALLOWING THE EMPLOYER TO COLLECT AND
PROCESS THE EMPLOYEE
'S OR THE PROSPECTIVE EMPLOYEE 'S BIOMETRIC
IDENTIFIER ONLY TO
:
(I) P
ERMIT ACCESS TO SECURE PHYSICAL LOCATIONS AND SECURE
ELECTRONIC HARDWARE AND SOFTWARE APPLICATIONS
; EXCEPT THAT AN
EMPLOYER SHALL NOT OBTAIN THE EMPLOYEE
'S OR PROSPECTIVE
EMPLOYEE
'S CONSENT TO RETAIN BIOMETRIC DATA THAT IS USED FOR
CURRENT EMPLOYEE LOCATION TRACKING OR THE TRACKING OF HOW MUCH
TIME THE EMPLOYEE SPENDS USING A HARDWARE OR SOFTWARE
APPLICATION
;
(II) R
ECORD THE COMMENCEMENT AND CONCLUSION OF THE
EMPLOYEE
'S FULL WORK DAY, INCLUDING MEAL BREAKS AND REST BREAKS
IN EXCESS OF THIRTY MINUTES
;
(III) I
MPROVE OR MONITOR WORKPLACE SAFETY OR SECURITY OR
PAGE 8-HOUSE BILL 24-1130 ENSURE THE SAFETY OR SECURITY OF EMPLOYEES ; OR
(IV) IMPROVE OR MONITOR THE SAFETY OR SECURITY OF THE PUBLIC
IN THE EVENT OF AN EMERGENCY OR CRISIS SITUATION
.
(b) A
N EMPLOYER AND ITS PROCESSOR MAY COLLECT AND PROCESS
AN EMPLOYEE
'S OR PROSPECTIVE EMPLOYEE'S BIOMETRIC IDENTIFIER FOR
USES OTHER THAN THOSE DESCRIBED IN SUBSECTION
(6)(a) OF THIS SECTION
ONLY WITH THE EMPLOYEE
'S OR PROSPECTIVE EMPLOYEE'S CONSENT. AN
EMPLOYER MAY NOT REQUIRE THAT AN EMPLOYEE OR PROSPECTIVE
EMPLOYEE CONSENT TO SUCH COLLECTION OR PROCESSING AS A CONDITION
OF EMPLOYMENT OR RETALIATE AGAINST AN EMPLOYEE OR PROSPECTIVE
EMPLOYEE WHO DOES NOT CONSENT TO SUCH COLLECTION OR PROCESSING
.
(c) S
O LONG AS CONSENT THAT IS OBTAINED FOR COLLECTION AND
PROCESSING AS DESCRIBED IN THIS SECTION SATISFIES THE DEFINITION OF
CONSENT PROVIDED IN SECTION
6-1-1303 (5), CONSENT IS CONSIDERED TO
BE FREELY GIVEN AND VALID FOR THE PURPOSES DESCRIBED IN SUBSECTION
(6)(a) OF THIS SECTION.
(d) N
OTHING IN THIS SECTION RESTRICTS AN EMPLOYER OR ITS
PROCESSOR
'S ABILITY TO COLLECT AND PROCESS AN EMPLOYEE 'S OR
PROSPECTIVE EMPLOYEE
'S BIOMETRIC IDENTIFIER FOR USES ALIGNED WITH
THE REASONABLE EXPECTATIONS OF
:
(I) A
N EMPLOYEE BASED ON THE EMPLOYEE 'S JOB DESCRIPTION OR
ROLE
; OR
(II) A PROSPECTIVE EMPLOYEE BASED ON A REASONABLE
BACKGROUND CHECK
, APPLICATION, OR IDENTIFICATION REQUIREMENTS IN
ACCORDANCE WITH THIS SECTION
.
(7) Rules. T
HE DEPARTMENT OF LAW MAY PROMULGATE RULES FOR
THE IMPLEMENTATION OF THIS SECTION
, INCLUDING RULES PROMULGATED
IN CONSULTATION WITH THE OFFICE OF INFORMATION TECHNOLOGY AND THE
DEPARTMENT OF REGULATORY AGENCIES ESTABLISHING APPROPRIATE
SECURITY STANDARDS FOR BIOMETRIC IDENTIFIERS AND BIOMETRIC DATA
THAT ARE MORE STRINGENT THAN THE REQUIREMENTS DESCRIBED IN THIS
SECTION
.
PAGE 9-HOUSE BILL 24-1130 SECTION 3. In Colorado Revised Statutes, 6-1-1303, add (2.2)
and (2.4) as follows:
6-1-1303. Definitions. As used in this part 13, unless the context
otherwise requires:
(2.2) (a) "B
IOMETRIC DATA" MEANS ONE OR MORE BIOMETRIC
IDENTIFIERS THAT ARE USED OR INTENDED TO BE USED
, SINGLY OR IN
COMBINATION WITH EACH OTHER OR WITH OTHER PERSONAL DATA
, FOR
IDENTIFICATION PURPOSES
.
(b) "B
IOMETRIC DATA" DOES NOT INCLUDE THE FOLLOWING UNLESS
THE BIOMETRIC DATA IS USED FOR IDENTIFICATION PURPOSES
:
(I) A
DIGITAL OR PHYSICAL PHOTOGRAPH;
(II) A
N AUDIO OR VOICE RECORDING; OR
(III) ANY DATA GENERATED FROM A DIGITAL OR PHYSICAL
PHOTOGRAPH OR AN AUDIO OR VIDEO RECORDING
.
(2.4) "B
IOMETRIC IDENTIFIER" MEANS DATA GENERATED BY THE
TECHNOLOGICAL PROCESSING
, MEASUREMENT , OR ANALYSIS OF A
CONSUMER
'S BIOLOGICAL, PHYSICAL, OR BEHAVIORAL CHARACTERISTICS ,
WHICH DATA CAN BE PROCESSED FOR THE PURPOSE OF UNIQUELY
IDENTIFYING AN INDIVIDUAL
. "BIOMETRIC IDENTIFIER" INCLUDES:
(a) A
FINGERPRINT;
(b) A
VOICEPRINT;
(c) A
SCAN OR RECORD OF AN EYE RETINA OR IRIS;
(d) A
FACIAL MAP, FACIAL GEOMETRY, OR FACIAL TEMPLATE; OR
(e) OTHER UNIQUE BIOLOGICAL , PHYSICAL, OR BEHAVIORAL
PATTERNS OR CHARACTERISTICS
.
SECTION 4. In Colorado Revised Statutes, 6-1-1304, amend (1)
as follows:
PAGE 10-HOUSE BILL 24-1130 6-1-1304. Applicability of part. (1) Except as specified in
subsection (2) of this section, this part 13 applies to a controller that:
(a) (I) Conducts business in Colorado or produces or delivers
commercial products or services that are intentionally targeted to residents
of Colorado; and
(b)
(II) Satisfies one or both of the following thresholds:
(I) (A) Controls or processes the personal data of one hundred
thousand consumers or more during a calendar year; or
(II) (B) Derives revenue or receives a discount on the price of goods
or services from the sale of personal data and processes or controls the
personal data of twenty-five thousand consumers or more;
OR
(b) CONTROLS OR PROCESSES ANY AMOUNT OF BIOMETRIC
IDENTIFIERS OR BIOMETRIC DATA REGARDLESS OF THE AMOUNT OF
BIOMETRIC IDENTIFIERS OR BIOMETR IC DATA CONTROLLED OR PROCESSED
ANNUALLY
; EXCEPT THAT A CONTROLLER THAT MEETS THE QUALIFICATIONS
OF THIS SUBSECTION
(1)(b) BUT DOES NOT MEET THE QUALIFICATIONS OF
SUBSECTION
(1)(a) OF THIS SECTION SHALL COMPLY WITH THIS PART 13 ONLY
FOR THE PURPOSES OF A BIOMETRIC IDENTIFIER OR BIOMETRIC DATA THAT
THE CONTROLLER COLLECTS AND PROCESSES
.
SECTION 5. Act subject to petition - effective date -
applicability. (1) This act takes effect July 1, 2025; except that, if a
referendum petition is filed pursuant to section 1 (3) of article V of the state
constitution against this act or an item, section, or part of this act within the
ninety-day period after final adjournment of the general assembly, then the
act, item, section, or part will not take effect unless approved by the people
at the general election to be held in November 2024 and, in such case, will
take effect July 1, 2025, or on the date of the official declaration of the vote
thereon by the governor, whichever is later.
(2) This act applies to the collection, retention, processing, and use
PAGE 11-HOUSE BILL 24-1130 of biometric identifiers and biometric data on and after the applicable
effective date of this act.
____________________________ ____________________________
Julie McCluskie Steve Fenberg
SPEAKER OF THE HOUSE PRESIDENT OF
OF REPRESENTATIVES THE SENATE
____________________________ ____________________________
Robin Jones Cindi L. Markwell
CHIEF CLERK OF THE HOUSE SECRETARY OF
OF REPRESENTATIVES THE SENATE
APPROVED________________________________________
(Date and Time)
_________________________________________
Jared S. Polis
GOVERNOR OF THE STATE OF COLORADO
PAGE 12-HOUSE BILL 24-1130