4 Colo. Code Regs. § 904-3-6.08
Current through Register Vol. 47, No. 16, August 25, 2024
Section 4 CCR 904-3-6.08 - SECONDARY USEA. The specified Processing purpose is the purpose disclosed to Consumers at or before the time the Personal Data is collected or processed from Consumers. Such disclosure shall be included in any required privacy notice or Consent disclosure.B. Before Processing Personal Data for purposes that are not reasonably necessary to or compatible with specified Processing purpose(s) disclosed on or after July 1, 2023, the Controller must obtain Consent consistent with C.R.S. § 6-1-1308 and 4 CCR 904-3, Rules 7.02-7.05.C. When considering if the new Processing purpose is reasonably necessary to or compatible with the original specified purpose(s), Controllers may consider the following, as applicable: 1. The reasonable expectation of an average Consumer concerning how their Personal Data would be Processed once it was collected;2. The link between the original specified purpose(s) for which the data was collected and the purpose(s) of further Processing;3. The relationship between the Consumer and the Controller and the context in which the Personal Data was collected;4. The type, nature, and amount of the Personal Data subject to the new Processing purpose;5. The type and degree of possible consequence or impact to the Consumer of the new Processing purpose;6. The identity of the entity conducting the new Processing purposes, e.g., the same or different Controller, or a Third Party; and7. The existence of additional safeguards for the Personal Data, such as encryption or pseudonymization.46 CR 06, March 25, 2023, effective 7/1/2023