Effect of Senate Bill 21-190 on Colorado Internet Privacy.
“This one trick will help you lose belly fat!”
“Erase wrinkles, now! Click here to find out how.”
We have all had it happen: You’re scrolling through a social media site, reading about the latest foods your friends are consuming, and you get hit with an ad that’s just a little too personal. For example, the other day, I looked for pajamas and happened upon Tommy John’s site. I did not buy anything or enter my personal information, but now whenever I am reading Fox News or browsing Instagram, I’m bombarded with Tommy John ads. Creepy, right?
The fact is big tech companies, like Google and Facebook, track and store your data and then sell that information or use it to help further their business ventures. And it’s not just information about the sites you frequent that they keep. Google goes so far as to store information like payment information, emails you write and receive, search terms, videos watched, people you communicate with, and even your GPS, according to Security.org. And that’s not an exhaustive list — there are over 40 ways Google stores and collects your data.
To combat this concerning violation of privacy, Colorado lawmakers passed Senate Bill 21-190, “Concerning additional protection of data relating to personal privacy,” and Gov. Polis is expected to sign it into law.
SB 21-190
When tech companies collected and stored your information at the beginning of the digital age, there was not much you could do. However, that all started to change in 2016 when the European Union passed the far-reaching General Data Protection Regulation (GDPR).
Indeed, since the GDPR became enforceable three years ago, EU citizens have become empowered when it comes to digital privacy, and the regulation is considered a huge success, according to a recent report by the European Commission. In fact, the GDPR is so successful, many other countries and states have started to follow suit by passing their own privacy rules.
In 2018, California passed the California Consumer Privacy Act, and it went into effect January 1st, 2020. Nevada passed the Nevada Privacy of Information Collected on the Internet from Consumers Act in June 2019, and it went into effect on October 1st, 2019. And, in March 2021, Virginia Passed the Consumer Data Protection Act, which goes into effect January 1, 2023. And last, but certainly not least, Colorado passed SB 190 on June 8, 2021, a bipartisan bill that’ll give you more control over your data, starting July 1, 2023. So, what does SB 190 entail?
SB 190 and personal data
SB 190 creates personal data privacy rights — “personal data” being any information that helps identify a person — that will apply to companies that target Colorado residents, and “control or process personal data of more than 100,000 consumers per calendar year,” or “derive revenue from the sale of personal data and control or process the personal data of at least 25,000 consumers.”
In other words, if a company, like Google or Facebook, collects personal data of 100,000 or more consumers per year or gets discounts or money from selling personal data of 25,000 consumers per year, Colorado consumers can opt-out of having their data collected.
Additionally, consumers can access the data collected, correct it or delete it, and obtain copies of it. And, companies will have to disclose what data they gather, how long they store it, how they use it, and ensure any data collected that could lead to discrimination or identity theft is protected.
SB 190 creates sensitive data
Further, SB 190 creates a particular category for “sensitive data,” which is anything that reveals the race, sexual orientation, ethnic origin, religious status, citizenship, and mental or physical health conditions. If a company wants to collect sensitive data, it will first have to get the clear consent of the consumer (meaning clearly present the consumer’s choice allowing the consumer to “opt in” to this collection of data and not just a default setting), and then have enhanced control of that sensitive information — meaning it cannot disseminate it and must ensure that it’s protected.
Plus, starting in January 2024, Colorado consumers will be able to select a “universal opt-out” mechanism or setting for browsers that collect personal data to sell or use it for targeted advertising.
Finally, the Colorado attorney generals or district attorneys will enforce SB 190, and any violations will result in a monetary fine.
What SB 190 does not cover
SB 190 gives Colorado consumers enhanced control over their data, but some businesses and entities are exempt. This includes banks and financial institutions, healthcare facilities and entities that store health care information. It also includes personal data governed by state and federal laws, such as HIPAA and the Fair Credit Reporting Act.
For example, the Colorado Department of Public Health and Environment maintains the Colorado Immunization Information System (CIIS). This is a computerized system that, unless you opt-out, stores you and your child’s vaccine records, as well as information related to your vaccine record.
This includes your gender, parent/guardian names, date of birth, Vaccines for Children eligibility status, and the office where each vaccine was given. Because CIIS is an entity that stores health care information, SB 190 will not affect it.
Why this matters
Living in a digital age does not mean we should give up our privacy rights, but for years that is what has happened. Furthermore, the collection and storage of personal data is not just a violation of privacy — it also leads to several issues, including identity theft and fraud. Thus, states have started passing digital privacy laws to help protect their citizens.
With the passage of SB 190, Colorado joins California, Nevada, and Virginia, where companies like Google and Facebook will be held to account whenever they violate digital rights. Consequently, SB 190 is likely a win for Colorado residents. Keep in mind, however, that because it does not go into effect until 2023, there may be unintended ramifications that we will not know about until after 2023. As such, SB 190 is something The Maverick Observer will continue to follow.
