Colorado “Protections For Consumer Data Privacy” Law Kelly Schroeder - Bastion Technology Consulting

Introduction Who is Kelly Schroeder and Bastion Technology Consulting? Over 15 years of IT security and compliance experience Managed Department of Defence compliance for contractor Implemented NIST SP 800-171 What is House Bill 18-1128: “Protections For Consumer Data Privacy”? Expands responsibilities of companies retaining information on Colorado residents Signed into law May 29th, 2018 Effective September 1st, 2018

What is a Covered Entity? ...a person...that maintains, owns, or licenses personal identifying information (PII) in the course of the person's business, vocation, or occupation… "Person" means an individual, corporation, business trust, estate, trust, partnership, unincorporated association, or two or more thereof having a joint or common interest, or any other legal or commercial entity. Every business has the potential of being a covered entity

Personal Identifying Information (PII) social security number PIN password pass code driver's license or ID card number passport number biometric data employer, student, or military ID number financial transaction device At a minimum every company who has ever taken an I-9 or W-2 has this information on their employees

Third Parties "Third-party service provider" means an entity that has been contracted to maintain, store, or process personal identifying information on behalf of a covered entity. What tools do you use to store information that might fall under the law?

Third Party Management Who is handling your customers’ PII? What are their written policies? How do you evaluate a vendor’s protection of your customers’ information? Do your agreements or contracts specify compliance?

Third Party Management (Continued) Unless a covered entity agrees to provide its own security protection for the information it discloses to a third-party service provider, the covered entity shall require that the third-party service provider implement and maintain reasonable security procedures and practices that are: appropriate to the nature of the PII reasonably designed to help protect the PII from unauthorized access, use, modification, disclosure, or destruction

Notifications 30 days after a determination that information was subject to “unauthorized access, use, modification, disclosure, or destruction” How Postal Mail Phone calls Email Notify the Attorney General’s office if more than 500 Colorado residents are affected

Notification - Personal Information "Personal information" means a colorado resident's first name or first initial and last name in combination with any one or more of the following social security number student, military, or passport identification number driver's license number or identification card number medical information health insurance identification number biometric data username or email address, in combination with a password or security questions and answers that would permit access to an online account account number or credit or debit card number in combination with any required security code, access code or password that would permit access to that account

Written Policy Document Retention (Electronic and physical) Document Destruction “Reasonable Security Procedures and Practices” Employee Training Breach Detection Access Rights and Responsibilities Notification process

Reasonable Security Procedures and Practices “...appropriate to the nature of the personal identifying information and the nature and size of the business and its operations.” Encryption Firewall/Antivirus Passwords Mobile Devices

Now What? "Personal identifying information" social security number PIN password pass code driver's license or ID card number passport number biometric data employer, student, or military ID number financial transaction device Discover what customer information you are storing and if it is PII Determine what, if any, PII is stored with third parties Examine your processes for how PII is stored and exchanged Create a written policy Obtain written third party PII policies Involve your IT team Contact Bastion Technology Consulting for further information or assistance

Thank you for your time! Any questions? Kelly Schroeder Bastion Technology Consulting kelly@bastiontechconsulting.com (970) 795-2770