Ask Reggi Your Question Now
Can I ignore consumer requests for information or deletion in Colorado? What are the requirements?
Requirements for Responding to Consumer Requests for Information or Deletion in Colorado
In Colorado, covered entities that maintain paper or electronic documents containing personal identifying information must develop a written policy for the destruction or proper disposal of those documents [1.1]. Additionally, the Colorado Privacy Act (CPA) provides consumers with certain rights regarding their personal data, including the right to access, correct, delete, and obtain a copy of their personal data [1.3].
If a consumer submits a request to exercise their rights under the CPA, the covered entity must inform the consumer of any action taken on the request without undue delay and, in any event, within forty-five days after receipt of the request [1.3]. The covered entity may extend the forty-five-day period by forty-five additional days where reasonably necessary, taking into account the complexity and number of the requests [1.3].
A covered entity is not required to comply with a request to exercise any of the rights under the CPA if the covered entity is unable to authenticate the request using commercially reasonable efforts, in which case the covered entity may request the provision of additional information reasonably necessary to authenticate the request [1.3].
However, ignoring consumer requests for information or deletion in Colorado is not allowed. Covered entities in Colorado must comply with consumer requests for information or deletion under the CPA, unless they are unable to authenticate the request or require additional information to do so [1.3].
Source(s):
- [1.1] Disposal of personal identifying information - policy - definitions.
- [1.3] Consumer personal data rights - repeal.
Jurisdiction
Colorado