Page 1
February 9, 2024 HB 24-1130
Legislative Council Staff
Nonpartisan Services for Colorado’s Legislature
Fiscal Note
Drafting Number:
Prime Sponsors:
LLS 24-0534
Rep. Daugherty; Lynch
Sen. Lundeen; Hansen
Date:
Bill Status:
Fiscal Analyst:
February 9, 2024
House Judiciary
Kristine McLaughlin | 303-866-4776
kristine.mclaughlin@coleg.gov
Bill Topic: PRIVACY OF BIOMETRIC IDENTIFIERS & DATA
Summary of
Fiscal Impact:
☒ State Revenue
☒ State Expenditure
☐ State Transfer
☐ TABOR Refund
☒ Local Government
☐ Statutory Public Entity
The bill amends the Colorado Privacy Act to require protections for biometric data.
The bill minimally increases state workload on an ongoing basis.
Appropriation
Summary:
No appropriation is required.
Fiscal Note
Status:
The fiscal note reflects the introduced bill.
Summary of Legislation
Senate Bill 21-190 enacted the Colorado Privacy Act, which made it a deceptive trade practice
for entities who control the personal data of at least 25,000 people to process sensitive data
without consent.
The bill amends the Colorado Privacy Act to require protections for biometric data. Specifically,
the bill requires controllers of biometric data to:
disclose specified information;
destroy data within a year or upon request;
not disseminate the data to other parties (with certain exceptions);
not price discriminate;
store the data with the same or greater level of security as confidential information; and
update the data upon request.
State Revenue and Expenditures
Workload in the Department of Law may minimally increase if additional or more complicated
deceptive trade practice complaints involving the requirements are filed. The department will
review complaints under the bill and prioritize investigations as necessary within the overall
number of deceptive trade practice complaints and available resources. Depending on the Page 2
February 9, 2024 HB 24-1130
outcome of any new cases, revenue from civil penalties may increase. Adjudication of these
complaints may also increase workload and filing fees for the trial courts in the Judicial
Department. Civil penalties under the Consumer Protect Act are classified as damage awards
and not subject to TABOR; court filing sees are subject to TABOR.
Since state agencies are exempt from the Colorado Privacy Act, the changes under this bill are
not expected to affect other state agencies that may control covered types of data.
Local Government
While deceptive trade practice complaints may be filed with local district attorneys, it is assumed
that any additional complaints received under the bill will be referred to the Attorney General
for investigation. Thus, thus any local impact will be minimal.
Effective Date
The bill takes effect 90 days following adjournment of the General Assembly sine die, assuming
no referendum petition is filed.
State and Local Government Contacts
District Attorneys Information Technology Law
The revenue and expenditure impacts in this fiscal note represent changes from current law under the bill for each
fiscal year. For additional information about fiscal notes, please visit the General Assembly website.