6-1-1302. Legislative declaration

6-1-1302. Legislative declaration. (1) The general assembly hereby:

(a) Finds that:

(I) The people of Colorado regard their privacy as a fundamental right and an essential element of their individual freedom;

(II) Colorado's constitution explicitly provides the right to privacy under section 7 of article II, and fundamental privacy rights have long been, and continue to be, integral to protecting Coloradans and to safeguarding our democratic republic;

(III) [Editor's note: This version of subsection (1)(a)(III) is effective until October 1, 2025.] Ongoing advances in technology have produced exponential growth in the volume and variety of personal data being generated, collected, stored, and analyzed, and these advances present both promise and potential peril;

(III) [Editor's note: This version of subsection (1)(a)(III) is effective October 1, 2025.] Ongoing advances in technology have produced exponential growth in the volume and variety of personal data from individuals, including minors, being generated, collected, stored, and analyzed, and these advances present both promise and potential peril;

(IV) The ability to harness and use data in positive ways is driving innovation and brings beneficial technologies to society, but it has also created risks to privacy and freedom; and

(V) [Editor's note: This version of subsection (1)(a)(V) is effective until October 1, 2025.] The unauthorized disclosure of personal information and loss of privacy can have devastating impacts ranging from financial fraud, identity theft, and unnecessary costs in personal time and finances to destruction of property, harassment, reputational damage, emotional distress, and physical harm;

(V) [Editor's note: This version of subsection (1)(a)(V) is effective October 1, 2025.] The unauthorized disclosure of personal information, including a minor's personal information, and loss of privacy can have devastating impacts ranging from financial fraud, identity theft, and unnecessary costs in personal time and finances to destruction of property, harassment, reputational damage, emotional distress, and physical harm;

(b) Determines that:

(I) Technological innovation and new uses of data can help solve societal problems and improve lives, and it is possible to build a world where technological innovation and privacy can coexist; and

(II) [Editor's note: This version of subsection (1)(b)(II) is effective until October 1, 2025.] States across the United States are looking to this part 13 and similar models to enact state-based data privacy requirements and to exercise the leadership that is lacking at the national level; and

(II) [Editor's note: This version of subsection (1)(b)(II) is effective October 1, 2025.] States across the United States are looking to this part 13 and similar models to enact state-based data privacy requirements, including data privacy requirements specifically targeted at minors' data, and to exercise the leadership that is lacking at the national level; and

acking at the national level; and

(II) [Editor's note: This version of subsection (1)(b)(II) is effective October 1, 2025.] States across the United States are looking to this part 13 and similar models to enact state-based data privacy requirements, including data privacy requirements specifically targeted at minors' data, and to exercise the leadership that is lacking at the national level; and

(c) Declares that:

(I) [Editor's note: This version of subsection (1)(c)(I) is effective until October 1, 2025.] By enacting this part 13, Colorado will be among the states that empower consumers to protect their privacy and require companies to be responsible custodians of data as they continue to innovate;

(I) [Editor's note: This version of subsection (1)(c)(I) is effective October 1, 2025.] By enacting this part 13, Colorado will be among the states that empower consumers, including minors, to protect their privacy and require companies to be responsible custodians of data as they continue to innovate;

(II) This part 13 addresses issues of statewide concern and:

(A) Provides consumers the right to access, correct, and delete personal data and the right to opt out not only of the sale of personal data but also of the collection and use of personal data;

(A.5) [Editor's note: Subsection (1)(c)(II)(A.5) is effective October 1, 2025.] Provides minors the right to control their personal data;

(B) Imposes an affirmative obligation upon companies to safeguard personal data; to provide clear, understandable, and transparent information to consumers about how their personal data are used; and to strengthen compliance and accountability by requiring data protection assessments in the collection and use of personal data; and

(C) Empowers the attorney general and district attorneys to access and evaluate a company's data protection assessments, to impose penalties where violations occur, and to prevent future violations.