Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party file sharing tools that collect personal information in Colorado? What are the requirements?

Personal Information Protection in Colorado

Colorado has enacted laws to protect personal information of its residents. The Colorado Consumer Protection Act (CCPA) [2.1] and the Personal Information Protection Act (PIPA) [3.1] are two such laws that regulate the collection, use, and disclosure of personal information.

Record Keeping and Reporting Requirements

Colorado has also enacted laws that require state agencies to keep records of requests for personal identifying information [1.1]([2.1]:). If a third party makes a request for a record from a state agency and the record contains personal identifying information, the state agency shall retain a written record containing the following information:

  • The request
  • The date of the request
  • Whether the request was granted or denied
  • The name and title of the state agency employee who granted or denied the request
  • A description of the articulated purpose of the request
  • The identity of the requestor, including the federal office or agency or other entity that requested information, the name of the individual requestor, and, if the requestor is a law enforcement officer, the individual’s badge number
  • A summary of why the request was granted or denied.

Beginning January 1, 2022, and on a quarterly basis thereafter, each state agency shall submit to the governor’s office of legal counsel the information specified above. The governor’s office shall provide a report to the joint budget committee containing quarterly and year-to-date summaries of the information in subsection (2) of this section [1.1]([2.1]:).

Third-Party File Sharing Tools

Colorado law does not explicitly prohibit the use of third-party file sharing tools that collect personal information. However, if a third party makes a request for personal identifying information from a state agency, the state agency must keep a record of the request [1.1]([2.1]:).

If you are a business or organization that collects personal information from Colorado residents, you must comply with the CCPA and PIPA [2.1][3.1]. These laws require businesses to provide notice to consumers about the collection, use, and disclosure of their personal information. Businesses must also implement reasonable security measures to protect personal information from unauthorized access, use, or disclosure.

State Agencies Sharing Federal Tax Information

State agencies that receive federal tax information from the federal government and share that information with another state agency may authorize and require that state agency by written agreement to conduct fingerprint-based criminal history record checks in accordance with section 24-50-1002 for all applicants, state employees, state contractors, or other individuals who have or may have access to the shared federal tax information [2.1][3.1]. A state agency that receives federal tax information from the federal government shall not share that information with another state agency that fails or refuses to comply with the requirements of this section or section 24-50-1002 [2.1][3.1].

Conclusion

Colorado law requires state agencies to keep records of requests for personal identifying information. If you are a business or organization that collects personal information from Colorado residents, you must comply with the CCPA and PIPA. While Colorado law does not explicitly prohibit the use of third-party file sharing tools that collect personal information, businesses must implement reasonable security measures to protect personal information. State agencies that receive federal tax information from the federal government and share that information with another state agency must conduct fingerprint-based criminal history record checks in accordance with section 24-50-1002 for all applicants, state employees, state contractors, or other individuals who have or may have access to the shared federal tax information.

[3.1]:

Source(s):
Jurisdiction

Colorado