§ 6-1-713 — Disposal of personal identifying information - policy - definitions

Colorado § 6-1-713

• Jurisdiction: Colorado
• Title 06: Consumer
• Art.: Colorado Consumer Protection Act

Text

(1) Each covered entity in the state that maintains paper or electronic documents
during the course of business that contain personal identifying information shall
develop a written policy for the destruction or proper disposal of those paper and
electronic documents containing personal identifying information. Unless otherwise
required by state or federal law or regulation, the written policy must require that,
when such paper or electronic documents are no longer needed, the covered entity
shall destroy or arrange for the destruction of such paper and electronic
documents within its custody or control that contain personal identifying
information by shredding, erasing, or otherwise modifying the personal identifying
information in the paper or electronic documents to make the personal identifying
information unreadable or indecipherable through any means.

(2) For the purposes of this section and section 6-1-713.5:

(a) Covered entity means a person, as defined in section 6-1-102 (6), that
maintains, owns, or licenses personal identifying information in the course of the
person's business, vocation, or occupation. Covered entity does not include a
person acting as a third-party service provider as defined in section 6-1-713.5.

(b) Personal identifying information means a social security number; a
personal identification number; a password; a pass code; an official state or
government-issued driver's license or identification card number; a government
passport number; biometric data, as defined in section 6-1-716 (1)(a); an employer,
student, or military identification number; or a financial transaction device, as
defined in section 18-5-701 (3).

(3) A covered entity that is regulated by state or federal law and that
maintains procedures for disposal of personal identifying information pursuant to
the laws, rules, regulations, guidances, or guidelines established by its state or
federal regulator is in compliance with this section.

(4) Unless an entity specifically contracts with a recycler or disposal firm for
destruction of documents that contain personal identifying information, nothing
herein shall require a recycler or disposal firm to verify that the documents
contained in the products it receives for disposal or recycling have been properly
destroyed or disposed of as required by this section.

Legislative History

Source: L. 2004: Entire section added, p. 1959, � 2, effective August 4. L. 2018: (1), (2), and (3) amended, (HB 18-1128), ch. 266, p. 1632, � 1, effective September 1.