4 Colo. Code Regs. § 904-3-7.08

Current through Register Vol. 47, No. 16, August 25, 2024

Section 4 CCR 904-3-7.08 - REFRESHING CONSENT

A. When a Consumer has not interacted with a Controller in the prior twenty-four (24) months, the Controller must refresh Consent in compliance with all requirements of this Part 7 to:

1. Continue Processing Sensitive Data pursuant to C.R.S. § 6-1-1308(7); or

2. Continue Processing Personal Data for a Secondary Use pursuant to C.R.S. § 1308(4), if the Secondary Use involves Profiling for a decision that results in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health-care services, or access to essential goods or services.

B. Controllers are not required to refresh Consent under part A of this section where a Consumer has access and ability to update their opt-out preferences at any time through a user-controlled interface.

C. If a Processing purpose materially evolves such that the new purpose becomes a secondary use pursuant to C.R.S. § 6-1-1308(4), the Consumer's original Consent is no longer valid, and the Controller must obtain new Consent pursuant to Part 7 of these rules.

4 CCR 904-3-7.08

46 CR 06, March 25, 2023, effective 7/1/2023