0

The Colorado Privacy Act defines personal data rather vaguely. It is data that can "REASONABLY BE USED TO INFER INFORMATION ABOUT, OR OTHERWISE BE LINKED TO, AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL, OR A DEVICE LINKED TO SUCH AN INDIVIDUAL"

It almost seems as if any piece of information, or combination of information, that can be used to link an individual to a real-life identity constitutes personal data under the Act.

For example, if a published dataset of customers reveals that one of them lives in Grand Junction and has 172 great-grandchildren, and there is only one person in Grand Junction that has that many great-grandchildren, that information might be personal data.

Improve this question
1
  • 1
    A weather forecast does not count for example. Are you asking for an exhaustive list or what?
    – Greendrake
    Commented Jun 2, 2022 at 1:00

1 Answer 1

Reset to default
2

Yes, "any piece of information, or combination of information, that can be used to link an individual to a real-life identity constitutes personal data under the Act."

That's the point.

Note that the act only applies to businesses that control or process the personal data of 100,000 or more consumers per year or 25,000 if they derive revenue or receive a discount on the price of goods or services from the sale of personal data. Deidentified data and publicly available information are not personal data under the Act.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .