Colorado

Notification of Security Breach
CITATION	Colorado Rev. Stat. § 6-1-716
ENACTED	2006
SUMMARY	Act requires individuals or commercial entities to provide consumer notification of data breaches. Act is limited to residents of Colorado.
DATA COVERED	“Personal Information” which means a Colorado resident’s first name or first initial and last name in combination with any one or more of the following data elements that related to the resident, when the data elements are not encrypted, redacted, or secured by any other method rendering the name or the element unreadable or unusable: Social Security number; Driver’s license number or identification card number; Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a resident’s financial account.
INDUSTRY	An individual or a commercial entity that conducts business in Colorado and that owns or licenses computerized data that includes personal information about a resident of Colorado.
PENALTIES	The attorney general may bring an action in law or equity to address violations of this section and for other relief that may be appropriate to ensure compliance with this section or to recover direct economic damages resulting from a violation, or both. The provisions of this section are not exclusive and do not relieve an individual or a commercial entity subject to this section from compliance with all other applicable provisions of law.