On February 20, 2024, House Bill 24-1130 for an Act concerning protecting the privacy of an individual's biometric data, was passed with amendments after a third reading in the House. If enacted, the bill will amend the Colorado Privacy Act (CPA) to add protections for biometric data. The amended bill as passed contains several updates in comparison to the bill as introduced. 

What did the amended bill update? 

The bill as amended requires a controller to maintain a written policy when in possession of a biometric identifier to include guidelines that require the permanent destruction of the biometric identifier within 45 days after receiving a verified request to delete the data. In the original bill, the timeline for deletion was 30 days after receiving a verified deletion request. 

The amended bill also states that a data controller may not refuse to provide a good or service to a consumer based on the consumer's refusal to consent to the collection of their biometric identifier unless the collection is necessary for the provision of the good or service. The amended bill further states that controllers are not permitted to purchase biometric identifiers unless:  

• the controller pays the consumer for their biometric identifier; 

• the purchase is unrelated to the provision of a product or service to the consumer; and 

• the controller has obtained consent as outlined in the bill. 

Specific to employee data, an employer may not collect and process an employee or prospective employee's biometric identifier for uses other than those described throughout the bill or with the consent of the employee or prospective employee. Consent to collection may not be considered a condition of employment nor is an employer permitted to retaliate if consent to the collection or processing is not provided. 

Lastly, the bill clarifies the types of information that will not be considered biometric identifiers which include: 

• digital or physical photographs; 

• audio or voice recordings; or 

• any data generated from a digital or physical photograph or an audio or video recording. 

You can read the amended bill here and track its progress here.