Colorado has taken a significant step towards strengthening the data privacy of its residents with the introduction of House Bill 24-1130 (HB24-1130), the Colorado Biometrics Identifiers Privacy Act (BIPA). This bill, which heavily resembles Illinois’s own BIPA statute, aims to fortify protections around biometric data, including unique identifiers such as fingerprints, facial recognition data, and retinal scans, through amendments to the Colorado Privacy Act.
The bill contains several key provisions that, if signed into legislation, could drastically improve data privacy protection for the state’s 5.8 million residents, including:
- Written Policy Requirement:
Entities that collect or store biometric data must establish a written policy. This policy should outline a retention schedule for biometric identifiers, a breach response protocol, and guidelines for the permanent destruction of biometric data at the earliest possible time.
- Disclosure and Consent:
Before collecting biometric identifiers, companies must meet specific disclosure and consent requirements, ensuring individuals are fully informed about the collection and usage of their biometric data.
- Access and Update Rights:
The bill grants consumers the right to access and update their biometric data, enhancing transparency and giving individuals greater control over their personal information.
- Restrictions on Employers:
There are strict limitations on employers regarding the collection of biometric data from employees, ensuring that such data is only collected for legitimate and necessary purposes.
- Enforcement and Rulemaking:
The Attorney General is empowered to declare rules to enforce the bill’s provisions, which includes ensuring compliance and addressing violations effectively.
How HB24-1130 Compares to Illinois’ BIPA Law
Colorado HB24-1130 is similar to Illinois’s BIPA in several key aspects, primarily focusing on the protection and regulation of biometric data. Both laws require entities that collect biometric identifiers to adhere to stringent consent and disclosure requirements. They mandate that individuals must be informed about the collection, use, and storage of their biometric data and must provide explicit consent before any data is collected.
Additionally, both laws include provisions for the establishment of retention schedules and protocols for the destruction of biometric data after it is no longer needed. Both bills also empower individuals with rights to access and update their biometric data and impose limitations on the circumstances under which employers can collect such data from employees.
Perhaps the biggest difference between the two is that, unlike Illinois’s BIPA, the Colorado statute does not contain a private right of action for injured parties. The absence of a private right of action from the Colorado law is significant, as it means that Colorado residents are not able to sue companies that violate the law for harms or losses they have suffered due to the defendant’s unlawful actions. While both the Illinois Biometric Information Privacy Act and California’s Consumer Privacy Act contain provisions allowing for a private right of action, HB24-1130 The Colorado law instead leaves enforcement to the discretion of the Attorney General.
Illinois’s BIPA statute has been vigorously enforced through private actions brought Illinois residents. It is doubtful that the enforcement of Colorado’s BIPA will be as robust without Colorado residents having the ability to enforce the law through such private lawsuits.
Bipartisan Support Bolsters Colorado’s BIPA Legislation
HB24-1130 has seen robust bipartisan support, passing through various committees with unanimous or near-unanimous votes. Notably, it was referred to the Senate Committee of the Whole with a recommendation to place it on the consent calendar, indicating broad legislative backing.
The bill has also seen significant support from advocacy groups. The American Civil Liberties Union (ACLU) of Colorado has been a strong advocate for this bill, emphasizing its importance in preventing the commodification and exploitation of biometric data without individuals’ consent.
HB24-1130 represents a forward-thinking approach to data privacy, ensuring that as technology advances, the rights and protections of individuals are not left behind. And at a time when biometric privacy protections are being rolled back, it’s encouraging to see more states taking steps to protect its residents.
WBE is a leader in BIPA litigation. To learn more about the firm’s work, click here.
0 Comments