What does Colorado's data breach law ask a business to do?

Who does this law apply to?

The law applies to a covered entity: a person that maintains, owns or licenses personal information in the course of its business, vocation or occupation.

When it becomes aware that a security breach may have occurred, it must investigate promptly and in good faith to find how likely it is that personal information has been or will be misused.

"Covered entity" means a person, as defined in section 6-1-102 (6), that maintains, owns, or licenses personal information in the course of the person's business, vocation, or occupation.

A covered entity that maintains, owns, or licenses computerized data that includes personal information about a resident of Colorado shall, when it becomes aware that a security breach may have occurred, conduct in good faith a prompt investigation to determine the likelihood that personal information has been or will be misused.

What counts as personal information?

Personal information is a Colorado resident's first name or first initial and last name joined with a Social Security number, a student, military or passport identification number, a driver's license or identification card number, medical information, a health insurance identification number or biometric data, where those items are not encrypted, redacted or otherwise made unreadable.

A username or email address with the password or security questions and answers for an online account is covered on its own, as is an account or card number with the code needed to use it.

"Personal information" means a Colorado resident's first name or first initial and last name in combination with any one or more of the following data elements that relate to the resident, when the data elements are not encrypted, redacted, or secured by any other method rendering the name or the element unreadable or unusable: Social security number; student, military, or passport identification number; driver's license number or identification card number; medical information; health insurance identification number; or biometric data;

(B) A Colorado resident's username or e-mail address, in combination with a password or security questions and answers, that would permit access to an online account;

How fast must people be told?

Notice to affected residents is due unless the investigation finds that misuse has not occurred and is not reasonably likely to occur.

The text says notice must be made in the most expedient time possible and without unreasonable delay, and not later than thirty days after the date the entity determined that a security breach occurred.

The covered entity shall give notice to the affected Colorado residents unless the investigation determines that the misuse of information about a Colorado resident has not occurred and is not reasonably likely to occur.

Notice must be made in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the computerized data system.

Who else must be told?

If the breach is reasonably believed to have affected five hundred Colorado residents or more, the Colorado attorney general must be told, also not later than thirty days after the determination.

If more than one thousand residents must be notified, the nationwide consumer reporting agencies must be told as well.

The covered entity that must notify Colorado residents of a data breach pursuant to this section shall provide notice of any security breach to the Colorado attorney general in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, if the security breach is reasonably believed to have affected five hundred Colorado residents or more,

If a covered entity is required to notify more than one thousand Colorado residents of a security breach pursuant to this section, the covered entity shall also notify, in the most expedient time possible and without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis,

Is encrypted information treated differently?

A breach of encrypted or otherwise secured information must be disclosed if the key or other means to decipher it was also acquired, or is reasonably believed to have been.

The breach of encrypted or otherwise secured personal information must be disclosed in accordance with this section if the confidential process, encryption key, or other means to decipher the secured information was also acquired in the security breach or was reasonably believed to have been acquired.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.