Colorado attorney general seeks input on rules for companies that collect personal information

The Colorado attorney general’s office released proposed Colorado Privacy Act rules onto the secretary of state’s website Monday in search of public feedback on the rules’ contents. 

The CPA, which Colorado Gov. Jared Polis signed into law in July last year, gives Coloradans the right to see what data companies collect about them and allows them to decide “whether and how companies can continue to collect, store, use, or sell their personal information,” according to a news release from Colorado Attorney General Phil Weiser’s office. 

The act also requires companies that collect personal data to “be transparent” about how it is used, and to take precautions to reduce risk of harming the consumers whose data is being used. The attorney general is authorized to create governing rules to provide guidance on compliance with the act’s requirements.

“Public input is vital to the creation of successful rules that ensure consumers are protected and businesses have guidance on how to comply with those rules,” Weiser said in a statement. “That is why the attorneys in my office are carefully considering all the input provided so far and will continue to do so.”

Prior to the start of the official rulemaking process, the Department of Law accepted informal input from the public while drafting. Now, comments will be included as part of the rulemaking record and displayed on the attorney general’s website. Also included in the rulemaking notice is a list of questions the office would like additional public input on. Opportunities to provide oral comment will take place virtually Nov. 10, 15 and 17, and a rulemaking hearing is scheduled at 10 a.m. Feb. 1, 2023, in person and virtually.

Specific areas of the 38-page document the office seeks specific input on include definitions of key terms, consumers’ personal data rights, universal opt-out mechanisms, duties of entities using consumers’ data, bona fide loyalty programs, consent, data protection assessments and profiling.