On December 21, the Colorado Attorney General released a revised draft of the Colorado Privacy Act Rules.
We will be providing in-depth analysis in coming days and weeks, but at first review, the revised rules appear to represent a fine-tuning as opposed to a complete overhaul. Some of these changes – such as additional flexibility on Data Protection Assessments – will likely be welcome news to businesses. Others – such as the definitions of commercial product or service and noncommercial purpose – may be less welcome by non-profit and governmental entities hoping to avoid the CPA’s application.
The Colorado Attorney General will now accept another round of comments from the public before the February 1, 2023 formal rulemaking hearing.