1. Colorado “Protections For Consumer Data Privacy” Law
Kelly Schroeder - Bastion Technology Consulting

2. Introduction Who is Kelly Schroeder and Bastion Technology Consulting?
Over 15 years of IT security and compliance experience
Managed Department of Defence compliance for contractor
Implemented NIST SP
What is House Bill : “Protections For Consumer Data Privacy”?
Expands responsibilities of companies retaining information on Colorado residents
Signed into law May 29th, 2018
Effective September 1st, 2018

3. What is a Covered Entity?
...a person...that maintains, owns, or licenses personal identifying information (PII) in the course of the person's business, vocation, or occupation…
"Person" means an individual, corporation, business trust, estate, trust, partnership, unincorporated association, or two or more thereof having a joint or common interest, or any other legal or commercial entity.
Every business has the potential of being a covered entity

4. Personal Identifying Information (PII)
social security number
PIN
password
pass code
driver's license or ID card number
passport number
biometric data
employer, student, or military ID number
financial transaction device
At a minimum every company who has ever taken an I-9 or W-2 has this information on their employees

5. Third Parties
"Third-party service provider" means an entity that has been contracted to maintain, store, or process personal identifying information on behalf of a covered entity.
What tools do you use to store information that might fall under the law?

6. Third Party Management
Who is handling your customers’ PII?
What are their written policies?
How do you evaluate a vendor’s protection of your customers’ information?
Do your agreements or contracts specify compliance?

7. Third Party Management (Continued)
Unless a covered entity agrees to provide its own security protection for the information it discloses to a third-party service provider, the covered entity shall require that the third-party service provider implement and maintain reasonable security procedures and practices that are:
appropriate to the nature of the PII
reasonably designed to help protect the PII from unauthorized access, use, modification, disclosure, or destruction

8. Notifications
30 days after a determination that information was subject to “unauthorized access, use, modification, disclosure, or destruction”
How
Postal Mail
Phone calls
Notify the Attorney General’s office if more than 500 Colorado residents are affected

9. Notification - Personal Information
"Personal information" means a colorado resident's first name or first initial and last name in combination with any one or more of the following
social security number
student, military, or passport identification number
driver's license number or identification card number
medical information
health insurance identification number
biometric data
username or address, in combination with a password or security questions and answers that would permit access to an online account
account number or credit or debit card number in combination with any required security code, access code or password that would permit access to that account

10. Written Policy Document Retention (Electronic and physical)
Document Destruction
“Reasonable Security Procedures and Practices”
Employee Training
Breach Detection
Access Rights and Responsibilities
Notification process

11. Reasonable Security Procedures and Practices
“...appropriate to the nature of the personal identifying information and the nature and size of the business and its operations.”
Encryption
Firewall/Antivirus
Passwords
Mobile Devices

12. Now What? "Personal identifying information"
social security number
PIN
password
pass code
driver's license or ID card number
passport number
biometric data
employer, student, or military ID number
financial transaction device
Discover what customer information you are storing and if it is PII
Determine what, if any, PII is stored with third parties
Examine your processes for how PII is stored and exchanged
Create a written policy
Obtain written third party PII policies
Involve your IT team
Contact Bastion Technology Consulting for further information or assistance

13. Thank you for your time! Any questions? Kelly Schroeder
Bastion Technology Consulting
(970)