HB 18-1128 Summary: Strengthening Protections for Consumer Data Privacy

• Requires public and private covered entities to develop written policies for securely destroying paper and electronic documents containing personal identifying information through shredding, erasing, or other methods that render information unreadable.

• Establishes security requirements for covered entities that maintain personal identifying information, requiring implementation of reasonable security procedures and practices appropriate to the nature and size of the business.

• Mandates notification of affected Colorado residents within 30 days of determining a security breach occurred, requiring specific information including breach date, description of compromised information, and resources for fraud protection.

• Requires notification to the Colorado Attorney General within 30 days if a breach affects 500 or more Colorado residents, and notification to consumer reporting agencies if more than 1,000 residents are affected.

• Applies similar requirements to governmental entities for disposal of personal identifying information, protection of information in their custody, and notification procedures following security breaches.