CO HB1091

Establishes comprehensive data privacy protections for homeowner's insurance consumers effective January 1, 2028, requiring insurers, producers, and surplus line insurers to obtain affirmative opt-in consent before selling personal data, engaging in targeted advertising, or sharing data unrelated to insurance transactions

Grants consumers rights to confirm, access, correct, and delete their personal data held by insurers, and requires licensees to provide clear privacy notices detailing what data is collected, how it's used, and with whom it's shared

Prohibits insurers from basing adverse underwriting decisions solely on the loss history of a previous property owner or solely on data from processors without independent verification, and requires written disclosure of specific reasons for adverse decisions

Requires insurers to maintain written contracts with data processors that include confidentiality requirements, security safeguards, breach notification obligations, and data deletion provisions, with annual audits to verify compliance

Creates a private right of action allowing consumers to sue for $3,000 per violation or actual damages (treble damages for bad faith), plus attorney fees, and designates violations as unfair or deceptive insurance practices subject to Commissioner enforcement and civil penalties