Protection of Personal Identifying Information

C.R.S. tit. 24, art. 74
in effect

C.R.S. § 24-74-101 Legislative declaration

24-74-101. Legislative declaration. (1) The general assembly hereby finds and declares that: (a) State agencies increasingly collect residents' personal information to be able to provide a variety of services, including education, healthcare, financial assistance, and regulatory and enforcement activities designed to ensure the safety of Colorado residents; (b) Colorado residents have a reasonable expectation that state agencies will not disclose this information with outside actors for unintended purposes; (c) Coloradans' access to government services, including services that can be crucial in a time of crisis, is key to the collective health and wellness of the state; (d) All Coloradans should feel welcome to be the recipients of state services without fear of abuse of their privacy or data; (e) Any role that a state agency plays in enforcing federal immigration laws can undermine public trust and deter persons from accessing these services offered by state agencies; (f) The United States and Colorado constitutions guarantee persons a legitimate expectation of privacy from unreasonable government intrusions; (g) The federal government does not have the authority to command state or local officials to enforce or administer a federal regulatory program, as doing so would violate the tenth amendment to the United States constitution; and (h) This article 74 is not intended to interfere with criminal investigations and proceedings authorized by judicial process or with the collection or sharing of information that may be necessary to provide Coloradans with government services and benefits. (2) The general assembly further finds and declares that it is necessary to adopt this article 74 to protect individual rights and to further the preservation of the peace, health, and safety of Colorado residents.

C.R.S. § 24-74-102 Definitions

24-74-102. Definitions. As used in this article 74, unless the context otherwise requires: (1) "Personal identifying information" means information that may be used, along or in conjunction with any other information, to identify a specific individual, including but not limited to a name; a date of birth; a place of birth; a social security number or tax identification number; a password or pass code; an official government-issued driver's license or identification card number; information contained in an employment authorization document; information contained in a permanent resident card; vehicle registration information; a license plate number; a photograph, electronically stored photograph, or digitized image; a fingerprint; a record of a physical feature, a physical characteristic, a behavioral characteristic, or handwriting; a government passport number; a health insurance identification number; an employer, student, or military identification number; a financial transaction device; a school or educational institution attended; a source of income; medical information; biometric data; financial and tax records; home or work addresses or other contact information; family or emergency contact information; status as a recipient of public assistance or as a crime victim; race; ethnicity; national origin; immigration or citizenship status; sexual orientation; gender identity; physical disability; intellectual and developmental disability; or religion. (2) "Publicly available information" means information that is available to the public online, in person, or through a request for records under part 2 or part 3 of article 72 of this title 24. (3) "State agency" means a department of the executive branch of state government, including any division, office, agency, or other unit created within a department or the governor's office, including institutions of higher education and the Colorado commission on higher education. (4) "State agency employee" means every person in the service of a state agency, including all officers and employees, whether full-time, part-time, or temporary, and whether classified in or exempt from the state personnel system. "State agency employee" also includes all independent contractors of a state agency when acting in their capacity as independent contractors for the state agency. (5) "Third party" means any person or entity, including any law enforcement officer or agency, that is not a state agency, a state agency employee, or otherwise part of the state government.

C.R.S. § 24-74-103 Personal identifying information shared by state agencies - limitation - responsibilities - state agency employee

24-74-103. Personal identifying information shared by state agencies - limitation - responsibilities - state agency employee. A state agency employee shall not disclose or make accessible, including through a database or automated network, personal identifying information that is not publicly available information for the purpose of investigating for, participating in, cooperating with, or assisting in federal immigration enforcement, including enforcement of civil immigration laws and 8 U.S.C. sec. 1325 or 1326, except as required by federal or state law or as required to comply with a court-issued subpoena, warrant, or order.

C.R.S. § 24-74-104 Reduce personal identifying information collected by state agencies

24-74-104. Reduce personal identifying information collected by state agencies. (1) Beginning January 1, 2022, a state agency employee shall not inquire into, or request information or documents to ascertain, a person's immigration status for the purpose of identifying if the person has complied with federal immigration laws, including civil immigration laws and 8 U.S.C. sec. 1325 or 1326, except as required by state or federal law or as necessary to perform state agency duties, or to verify a person's eligibility for a government funded program for housing or economic development if verification is a necessary condition of the government funding. (2) Beginning January 1, 2022, a state agency shall not collect the following, except as required by state or federal law or as necessary to perform state agency duties, or to verify a person's eligibility for a government funded program for housing or economic development if verification is a necessary condition of the government funding: (a) Place of birth; (b) Immigration or citizenship status; or (c) Information from passports, permanent resident cards, alien registration cards, or employment authorization documents. (3) This section does not apply to a database or automated network collecting data or documents that was activated by a state agency on or before December 31, 2021.

C.R.S. § 24-74-105 Access to state agency records - limitations

24-74-105. Access to state agency records - limitations. (1) Beginning January 1, 2022, to be granted access to personal identifying information through a database or automated network that is not publicly available information, a third party must have, within the past year, certified under penalty of perjury that: (a) The third party will not use personal identifying information obtained from the database or automated network for the purpose of investigating for, participating in, cooperating with, or assisting in federal immigration enforcement, including enforcement of civil immigration laws and 8 U.S.C. sec. 1325 or 1326, unless required by federal or state law or to comply with a court-issued subpoena, warrant, or order; and (b) The third party will not disclose personal identifying information obtained from the database or automated network to individuals or entities engaged in investigating for, participating in, cooperating with, or assisting in federal immigration enforcement, including enforcement of civil immigration laws and 8 U.S.C. sec. 1325 or 1326, unless required by federal or state law or to comply with a court-issued subpoena, warrant, or order. (2) The attorney general's office shall create a model certification form and provide it to state agencies within sixty days of June 25, 2021.

C.R.S. § 24-74-106 Record keeping and reporting - requests for records or information - definition

24-74-106. Record keeping and reporting - requests for records or information - definition. (1) For purposes of this section, "request" includes any time a third party, other than a person in interest as defined in section 24-72-202 (4), communicates, whether through written or electronic form, with a state agency or state agency employee for the purpose of obtaining records or information that includes personal identifying information. "Request" does not include: (a) A request made under the "Colorado Open Records Act", part 2 of article 72 of this title 24, or the "Colorado Criminal Justice Records Act", parts 2 and 3 of article 72 of this title 24; except that, for purposes of this section, "request" does include a request made under the "Colorado Open Records Act," part 2 of article 72 of this title 24, whether made by telephone or through written or electronic form, if the requester indicates or a state agency employee determines the request is made for the purpose of investigating for, participating in, cooperating with, or assisting in federal immigration enforcement, including enforcement of civil immigration laws and 8 U.S.C. sec. 1325 or 1326; (b) An inquiry made through a database or automated network; except that, beginning March 1, 2022, "request" includes a request through Colorado DRIVES, as defined in section 42-1-102 (16.5); (c) A request governed by a data-sharing agreement, as long as the agreement ensures that the parties otherwise comply with the provisions of this article 74; (d) A request related to the conduct of federal, state, and local elections; (e) A request made to the department of public safety; or (f) A request for personal identifying information that is protected by the "Family Educational Rights and Privacy Act of 1974", as amended, 20 U.S.C. sec. 1232g, or the "Health Insurance Portability and Accountability Act of 1996", as amended, Pub.L. 104-191. (g) A request from a government entity for purposes of determining a person's eligibility for a government funded program for housing or economic development. (2) Except as provided in subsection (3) of this section, beginning January 1, 2022, if a third party makes a request for a record from a state agency and the record contains personal identifying information, the state agency shall retain a written record containing the following information: (a) The request; (b) The date of the request; (c) Whether the request was granted or denied; (d) The name and title of the state agency employee who granted or denied the request; (e) A description of the articulated purpose of the request; (f) The identity of the requestor, including the federal office or agency or other entity that requested information, the name of the individual requestor, and, if the requestor is a law enforcement officer, the individual's badge number; and (g) A summary of why the request was granted or denied. (3) For a request through Colorado DRIVES, if the department of revenue cannot comply with the reporting requirements of this section for requests from a third party because it would require technological or programming changes outside the control of the department of revenue, the department of revenue shall: (a) Continue to allow access to Colorado DRIVES if access for that third party is required to comply with state or federal law or is a condition of receiving federal or state funding; (b) At least once quarterly, submit a report including the identity of the third party and the reason for the inability to report; and (c) At least once quarterly, attest that the department of revenue and the third party are in compliance with the requirements of section 24-74-105. (4) Beginning January 1, 2022, and on a quarterly basis thereafter, each state agency shall: (a) Submit to the governor's office of legal counsel the information specified in subsection (2) of this section; and ason for the inability to report; and (c) At least once quarterly, attest that the department of revenue and the third party are in compliance with the requirements of section 24-74-105. (4) Beginning January 1, 2022, and on a quarterly basis thereafter, each state agency shall: (a) Submit to the governor's office of legal counsel the information specified in subsection (2) of this section; and (b) Attest that no request was granted for any purpose prohibited by this article 74. (5) Beginning March 1, 2022, and on a quarterly basis thereafter, the governor's office shall provide a report to the joint budget committee containing quarterly and year-to-date summaries of the information in subsection (2) of this section. The report shall include, at a minimum, quarterly and year-to-date summaries of the total number of requests, responses to requests, categories of reasons for requests, and categories of the third parties requesting information.

C.R.S. § 24-74-107 Data privacy breaches - accountability provisions

24-74-107. Data privacy breaches - accountability provisions. Any state agency employee who intentionally violates the provisions of this article 74 is subject to an injunction and is liable for a civil penalty of not more than fifty thousand dollars for each violation.

C.R.S. § 24-74-108 Severability

24-74-108. Severability. If any provision of this article 74 or its application to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of this article 74 which can be given effect without the invalid provision or application, and to this end the provisions of this article 74 are severable.
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-24.docxFetched: 10/6/2026