Colorado Legislature Signals That It May Create More Stringent Data Destruction Regulations And Tighten Breach Reporting Requirements

In January 2018, Colorado legislators sponsored a bill that, if passed, will change the state's existing data breach reporting laws in important ways. A House Committee Report detailing the current version of the bill can be found here. The bill would create a new statute, C.R.S. § 6-1-713.5, titled Protection of Personal Identifying Information, which amends the existing statutes C.R.S. § 6-1-713, governing the disposal of personal identifying information, and C.R.S. § 6-1-716, Notification of Security Breach. Included in these proposed changes are the following amendments:

Disposal of Personal Identifying Information

All "public and private entit[ies] in the state that maintain[] paper or electronic documents during the course of business that contain personal identifying information" will be required to develop a written policy for the destruction or disposal of such information once such documentation is "no longer needed."