by Marian A. Waldmann Agarwal, Cynthia J. Rich, and Robert N. Famigletti
With the passage of SB21-190, Colorado is poised to become the third U.S. state—behind California and, most recently, Virginia—to enact a comprehensive consumer privacy law. On June 8, 2021, the Colorado Senate approved House amendments to the bill, which previously sailed through full Senate and House votes with overwhelming approval. The bill will soon be transmitted to Governor Jared Polis for his approval and, if enacted, the Colorado Privacy Act (CPA) will become operative on July 1, 2023.
The CPA tracks closely with the recently-enacted Virginia Consumer Data Protection Act (VCDPA), including by distinguishing between data “controllers” (i.e., businesses that determine the purpose and means of processing personal data) and “processors” (i.e., businesses that process personal data on behalf of a controller), and by prescribing GDPR-like obligations. However, the CPA’s enforcement regime would mark a significant departure from the other state consumer privacy laws, empowering both the Colorado Attorney General (AG) and district attorneys to enforce violations of the Act and prescribing civil penalties of up to $20,000 per violation.