Section 7-90-107 - Protection of member-specific data - nonprofit entities - rights and remedies - legislative declaration(1) The general assembly finds and declares that: (a) Given the long-held protection of the fundamental rights of association and privacy under the constitutions of the United States and the state of Colorado, it is in the public interest to prohibit public agencies from collecting or disclosing member-specific data about members of, volunteers of, and financial and nonfinancial donors to nonprofit entities that are exempt from taxation under the federal "Internal Revenue Code of 1986", 26 U.S.C. sec. 501 (c), as amended, except as such collection or disclosure is permitted by law or rule or is necessary to enforce or ensure compliance with the law or rules of the state; and(b) The provisions of this section concerning a public agency's access to or use of member-specific data are consistent with: (I) Section 7-136-105, which prohibits any person from obtaining or using a nonprofit corporation's membership list for any purpose unrelated to a member's interest as a member; and(II) Section 24-73-102, which requires governmental entities to protect access to certain types of personal identifying information.(2) Except as provided in subsection (3) of this section or as otherwise permitted by law or as is necessary to enforce or ensure compliance with the state constitution or an applicable federal, state, or local statute, charter provision, resolution, ordinance, rule, or regulation, a public agency shall not: (a) Require any person, including a nonprofit entity or an officer, director, employee, or agent of a nonprofit entity, to provide the public agency with member-specific data or otherwise compel the disclosure of Member-specific data;(b) Disclose to any person one or more items of member-specific data, including a complete or partial list of nonprofit entity members who are employed by a public agency or any information included in a nonprofit entity member's personnel files as defined in section 24-72-202 (4.5); or(c) Request or require a current or prospective contractor or a current or prospective grantee of a grant program administered by the public agency to provide a list of nonprofit entities to which the current or prospective contractor or grantee has provided financial or nonfinancial support.(3) This section does not preclude a public agency from requiring production of a nonprofit entity's member-specific data if: (a) The member-specific data is specifically identified in a lawful subpoena or warrant that is: (I) Issued by a court of competent jurisdiction or is issued under the agency's statutory or constitutional authority in an administrative, civil, or criminal matter or for an administrative proceeding before an administrative law judge, a hearing officer, or other duly authorized, quasi-judicial official, including the independent ethics commission as authorized by article XXIX of the state constitution; or(II) Served upon a state or local agency for purposes of facilitating a lawful investigation, subject to the conditions of a protective order as directed by the court or agency that issued the subpoena;(b)(I) The member-specific data is produced in discovery under the Colorado rules of civil procedure before a court of competent jurisdiction or as authorized by jurisdiction, an administrative law judge, a hearing officer, or other duly authorized, quasi-judicial official, including the independent ethics commission as authorized by article XXIX of the state constitution, so long as the presiding official enters a protective order prohibiting or limiting the disclosure of the Member-specific data to the public.(II) A protective order may be issued as described in this subsection (3)(b) at the court's discretion in discovery by state or local agencies engaged in securities and commodities enforcement, licensing, or examination procedures.(c) The member-specific data is admitted into evidence as relevant to proving or disproving the claims or defenses at issue before a court of competent jurisdiction, an administrative law judge, a hearing officer, or other duly authorized, quasi-judicial official, including the independent ethics commission as authorized by article XXIX of the state constitution;(d) The member-specific data is voluntarily and publicly disclosed by the person or the nonprofit entity to which it relates;(e) The member-specific data is sought by a nonprofit entity that requests information concerning its own members from a public agency by which the members are employed;(f) Information disclosing the identity of any director, officer, registered agent, or incorporator of a nonprofit entity in a report or disclosure is required by statute to be filed with the secretary of state or, for unincorporated associations, an agency that is designated by law; except that information that directly identifies a person solely because the person is a financial donor to a nonprofit entity shall not be disclosed unless disclosure is required by subsection (3)(g) of this section;(g) The member-specific data is required to be made public because disclosure of a contribution or donation made by one or more members of a nonprofit entity is expressly required by federal, state, or local campaign finance laws;(h) The member-specific data is required by statute or regulation in order for an applicant to qualify for or to operate a business activity in the state or in order for licensees or registrants to comply with ongoing regulatory requirements, so long as the member-specific data is used only in connection with lawful regulatory or enforcement activity to which the request relates and for any related proceedings;(i) The member-specific data is necessary to determine compliance with federal or state antitrust statutes;(j) The member-specific data is sought by a public agency investigating alleged violations of state or local civil or criminal laws as permitted or expressly required by law;(k) The member-specific data is collected and used for the purpose of evaluating the suitability of applicants for, and any potential conflicts of interest resulting from, employment by a public agency or appointments to state or local boards, commissions, advisory committees, task forces, grant application review committees, or comparable entities, so long as the member-specific data is used only in connection with the specific application for an appointment to which the request relates and for any related proceedings;(l) The member-specific data is collected and used in order to determine whether a person that is applying for or being evaluated for any grant, benefits, financing, or payments from or through, or any contract with, a public agency should be awarded the grant, benefits, financing, payments, or contract and includes information pertaining to persons related to or affiliated with the applicant, as well as persons conducting the evaluation, so long as the member-specific data is used only in connection with the specific application for, or evaluation for, a grant, benefits, financing, or payments to which the request relates and for any related proceedings;(m) The member-specific data is collected and used by the office of the state auditor for the purpose of performing the functions of that office or in an audit, evaluation, or study conducted by a public agency to perform its functions, so long as the member-specific data is used only for official state business;(n) The member-specific data is collected and used by a public agency that is formed as a nonprofit entity where such member-specific data is used, either directly by the public agency or through its authorized agent, solely to contact, inform, or solicit its dues-paying members or donors, or to seek updates of their member-specific data;(o) The member-specific data is sought by the department of revenue to determine a taxpayer's compliance with laws relating to the deduction or credits arising from contributions to a nonprofit entity from a person's taxable income;(p) The member-specific data is produced for the purposes of enforcement, examination, or other securities and commodities regulatory matters, including collaboration with other securities and commodities enforcement and regulatory agencies, including, but not limited to, international, foreign, federal, state, and self-regulatory agencies, such as the financial industry regulatory authority;(q) The member-specific data concerns a member who has been issued or is practicing under any class of license under section 44-20-108 or 44-20-408; or(r) The member-specific data was voluntarily released to the public agency by the person or the nonprofit entity to which the data relates.(4)(a) A nonprofit entity or any of its members affected adversely by a violation of this section may initiate a civil action in district court for injunctive relief, damages, or such other relief as is appropriate to address the violation. Such an action must be initiated against the public agency that sought and obtained, or improperly disclosed, member-specific data of the nonprofit entity in violation of this section.(b) Notwithstanding the limitations of the "Colorado Governmental Immunity Act", article 10 of title 24, damages may be awarded to compensate a person for injury or loss caused by a public agency wrongfully requiring the production of, or wrongfully disclosing, Member-specific data as follows: (I) Except as described in subsection (4)(b)(II) of this section, not less than two thousand five hundred dollars for each reckless violation of this section; and(II) Not less than seven thousand five hundred dollars for each intentional violation of this section.(c) A court may award the costs of litigation, including reasonable attorney fees and witness fees, to a complainant that prevails in an action described in this subsection (4).Added by 2024 Ch. 272,§ 2, eff. 8/7/2024, app. to the collection and disclosure of data concerning members of a nonprofit entity by a public agency on or after the applicable effective date.2024 Ch. 272, was passed without a safety clause. See Colo. Const. art. V, § 1(3).