Concord Privacy News: 6/20/23

The Colorado Privacy Act takes effect July 1 - what companies should consider for compliance; in other news, Texas passes data privacy act and Indigenous groups are leading the way on data privacy.

Colorado Privacy Act Takes Effect July 1 - What Companies Need to Know

Colorado recently passed broad consumer privacy legislation, with Governor Polis signing the Colorado Privacy Act (CPA) into law in July 2021. The CPA will go into effect on July 1, 2023. The act provides Colorado residents with the right to opt out of targeted advertising, the sale of their personal data, and certain types of profiling.

To comply with the CPA, businesses will need to provide consumers with clear privacy notices and conduct data protection assessments for any personal data processing that presents a heightened risk of harm to consumers. The CPA does not offer much guidance as to what may or may not qualify as a “heightened risk of harm,” but the Colorado Attorney General could promulgate clarifying rules before the CPA goes into effect.

To comply, businesses covered by the CPA should consider:

Implementing cybersecurity safeguards

Developing and publicizing a process for consumers to submit requests regarding their personal data
Provide clear notice to consumers that they have the right to opt out of targeted advertising and sales of their personal data;
Update their Privacy Policy to explain their collection and use of data
Update contracts with third parties to ensure they comply with the law
Establish a procedure to determine when to conduct a data protection assessment

Concord can help companies easily comply with the CPA and other data privacy laws. Find out more at concord.tech.

‍

Other Privacy News of Note

Texas Legislature Passes Data Privacy and Security Act

On May 29, H.B. 4, also known as the Texas Data Privacy and Security Act, passed in the Texas legislature. The bill will now land on the desk of Gov. Greg Abbott for signature. Texas joins the growing number of states that have passed or enacted legislation in 2023, including Iowa, Indiana, Tennessee and Montana, and more are expected in the coming months. Five states already have comprehensive privacy laws in place or set to become effective soon: California, Virginia, Colorado, Connecticut, and Utah. If enacted, businesses will have less than a year to prepare for the Texas Data Privacy and Security Act before it goes into effect on March 1, 2024. Read more.

How Indigenous Groups Are Leading the Way on Data Privacy

Even as Indigenous communities find increasingly helpful uses for digital technology, many worry that outside interests could take over their data and profit from it, much like colonial powers plundered their physical homelands. But now some Indigenous groups are reclaiming control by developing their own data protection technologies—work that demonstrates how ordinary people have the power to sidestep the tech companies and data brokers who hold and sell the most intimate details of their identities, lives and cultures. Read more.