Privacy of Biometric Identifiers & Data

The act amends the "Colorado Privacy Act" to add protections for individuals' biometric data by requiring a person that controls or processes one or more biometric identifiers (controller) to adopt a written policy that: Establishes a retention schedule for biometric identifiers and biometric data; Includes a protocol for responding to a data security incident that may compromise the security of biometric identifiers or biometric data; and Includes guidelines that require the deletion of a biometric identifier on or before certain dates. With certain exceptions, a controller must make its written policy available to the public. The act also: Prohibits a controller from collecting a biometric identifier unless the controller first satisfies certain disclosure and consent requirements; Specifies certain prohibited acts and requirements for controllers that process biometric identifiers and biometric data; Requires a controller to disclose to a consumer certain information concerning the collection and use of the consumer's biometric identifier; Restricts an employer's permissible reasons for obtaining an employee's consent for the collection of biometric identifiers; and Authorizes the attorney general to promulgate rules to implement the act. APPROVED by Governor May 31, 2024 EFFECTIVE July 1, 2025(Note: This summary applies to this bill as enacted.)