Colorado Amends Colorado Privacy Act to Address Biological and Neural Data | Practical Law

Colorado Amends Colorado Privacy Act to Address Biological and Neural Data | Practical Law

Colorado has amended the Colorado Privacy Act to add biological data, including neural data, to its definition of sensitive information.

Colorado Amends Colorado Privacy Act to Address Biological and Neural Data

Practical Law Legal Update w-043-0201 (Approx. 3 pages)

Colorado Amends Colorado Privacy Act to Address Biological and Neural Data

by Practical Law Data Privacy & Cybersecurity
Published on 18 Apr 2024 • Colorado
Colorado has amended the Colorado Privacy Act to add biological data, including neural data, to its definition of sensitive information.
On April 17, 2024, Colorado Governor Jared Polis signed HB 1058, which expands the Colorado Privacy Act's (CPA) definition of sensitive data to include biological and neural data (Colo. Rev. Stat. Ann. §§ 6-1-1301 to 6-1-1313).
HB 1058 defines biological data to include data that is:
  • Used or intended to be used in identifying an individual, alone or with other data.
  • Generated by technologically processing, measuring, or analyzing an individual's:
    • biological, genetic, biochemical, physiological, or neural properties, compositions, or activities; or
    • body or bodily functions.
The novel definition of biological data explicitly includes neural data, which is information generated by measuring an individual's nervous system activity that can be processed using a device.
The amendment:
  • Takes effect 90 days after the Colorado legislature adjourns, currently scheduled for May 8, unless a referendum petition is filed within that timeframe.
  • Applies only to data processed on or after the effective date.
For more information on the CPA, see Practice Note, Colorado Privacy Act (CPA) Quick Facts: Overview.