4 Colo. Code Regs. § 904-3-7.08

Current through Register Vol. 48, No. 1, January 10, 2025
Section 4 CCR 904-3-7.08 - [Effective 1/30/2025] REFRESHING CONSENT
A. When a Consumer has not interacted with a Controller in the prior twenty-four (24) months, the Controller must refresh Consent in compliance with all requirements of this Part 7 to:
1. Continue Processing Sensitive Data pursuant to C.R.S. § 6-1-1308(7); or
2. Continue Processing Personal Data for a Secondary Use pursuant to C.R.S. § 13-8(4), if the Secondary Use involves Profiling for a decisions that results in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health-care services, or access to essential goods or services.
B. Controllers are not required to refresh Consent under part A of this section where a Consumer has access and ability to update their opt-out preferences at any time through a user-controlled interface.
C. If a Processing purpose materially evolves such that the new purpose becomes a secondary use pursuant to C.R.S. § 6-1-1308(4), the Consumer's original Consent is no longer valid, and the Controller must obtain new Consent pursuant to Part 7 of these rules.
D. Employers required to obtain Consent pursuant to C.R.S. § 6-1-1314(6)(b) are not required to refresh Consent under part A of this section.
1. Employers required to obtain Consent pursuant to C.R.S. § 6-1-1314(6)(b) must refresh Consent in compliance with all requirements of this Part 7 when:
a. Processing additional categories of an Employee's Biometric Identifier for which the Employee has not yet provided consent; and
b. Processing an Employee's Biometric Identifier for a Secondary Use.
2. To comply with C.R.S. § 6-1-1314(6)(b), Consent must be obtained from an Employee. Consent obtained from a prospective Employee during the hiring process is not sufficient to fulfill the requirements of C.R.S. § 6-1-1314(6)(b).

4 CCR 904-3-7.08

46 CR 06, March 25, 2023, effective 7/1/2023
48 CR 01, January 10, 2025, effective 1/30/2025