In 2021, the general assembly enacted Senate Bill 21-190, which
established the Colorado Privacy Act (privacy act) as part of the Colorado Consumer Protection Act. The privacy act protects the privacy of individuals' personal data by establishing certain requirements for entities that process personal data. The privacy act also describes certain rights that consumers may exercise regarding the processing of their personal data. The privacy act includes additional protections for sensitive data.
For the purposes of the privacy act, the bill expands the definition
of sensitive data to include biological data, which is data that provides a characterization of the biological, genetic, biochemical, or physiological properties, compositions, or activities of an individual's body or bodily functions. Biological data includes neural data, which is information that concerns the activity of an individual's central nervous system or peripheral nervous systems, including the brain and spinal cord, and that can be processed by or with the assistance of a device.
