Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party cloud storage services that collect personal information in Colorado? What are the requirements?

Using Third-Party Cloud Storage Services that Collect Personal Information in Colorado

Based on the context documents, if you are a governmental entity that maintains, owns, or licenses personal identifying information, you can use third-party cloud storage services that collect personal information in Colorado, but you must require that the third-party service provider implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal identifying information disclosed to the third-party service provider and reasonably designed to help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction [1.1].

There are no specific requirements for using third-party cloud storage services that collect personal information in Colorado other than the requirement to implement and maintain reasonable security procedures and practices. However, if you are a state agency, beginning January 1, 2022, you are prohibited from collecting certain personal identifying information, including immigration or citizenship status, except as required by state or federal law or as necessary to perform state agency duties, or to verify a person’s eligibility for a government-funded program for housing or economic development if verification is a necessary condition of the government funding [2.3].

If you are a self-service storage facility owner in Colorado, you may enforce a lien on personal property stored at your facility, but you must provide notice to the occupant and any lienholder with an interest in the property to be sold or otherwise disposed of, of whom you have knowledge through the disclosure provision on the rental agreement, as evidenced by a financing statement filed with the secretary of state, or through your receipt of other written notice of such interest from the lienholder. You must also implement reasonable security procedures and practices appropriate to the nature of the personal identifying information and the nature and size of the governmental entity [3.1].

Therefore, if you are a governmental entity that maintains, owns, or licenses personal identifying information, you can use third-party cloud storage services that collect personal information in Colorado, but you must require that the third-party service provider implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal identifying information disclosed to the third-party service provider and reasonably designed to help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction.

If you are not a governmental entity, there are no specific requirements for using third-party cloud storage services that collect personal information in Colorado other than the requirement to implement and maintain reasonable security procedures and practices. However, you are not considered a governmental entity and are not subject to the requirements of section 24-73-102 [1.2].

Therefore, if you are not a governmental entity, you are not required to verify that the documents contained in the products you receive for disposal or recycling have been properly destroyed or disposed of as required by section 24-73-101 [1.2].

If you have any further questions or concerns, it is recommended that you consult with a legal professional.

Source(s):
Jurisdiction

Colorado