Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I collect personal information from participants in Colorado? What are the requirements?

Personal Information Collection Requirements in Colorado

If you are collecting personal information from participants in Colorado, you must comply with the state’s record-keeping and reporting requirements [1.1]. Beginning January 1, 2022, if a third party makes a request for a record from a state agency and the record contains personal identifying information, the state agency must retain a written record containing specific information [1.1]. Additionally, beginning March 1, 2022, if you make a request through Colorado DRIVES, the Department of Revenue must comply with reporting requirements or submit a report including the identity of the third party and the reason for the inability to report [1.1].

Furthermore, if you are a licensee providing nonpublic personal financial information to a nonaffiliated third party to perform services for you or functions on your behalf, you must provide the initial notice in accordance with Section 5 and enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed the information [3.2].

It is important to note that nothing in the regulation preempts or supersedes existing Colorado law related to medical records, health, or insurance information privacy [3.4].

In addition, beginning January 1, 2022, a state agency shall not collect certain personal identifying information, including place of birth, immigration or citizenship status, or information from passports, permanent resident cards, alien registration cards, or employment authorization documents, except as required by state or federal law or as necessary to perform state agency duties [1.2].

In summary, if you are collecting personal information from participants in Colorado, you must comply with the state’s record-keeping and reporting requirements and ensure that any nonpublic personal financial information you provide to a nonaffiliated third party is protected by a contractual agreement. Additionally, beginning January 1, 2022, certain personal identifying information cannot be collected by state agencies, except as required by law or necessary to perform state agency duties.

Source(s):
Jurisdiction

Colorado