Colorado Code
Part 7 - Specific Provisions
§ 6-1-716. Notification of Security Breach

(I) Direct the person whose personal information has been breached to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account with the covered entity and all other online accounts for which the person whose personal information has been breached uses the same username or e-mail address and password or security question or answer.
(II) For log-in credentials of an e-mail account furnished by the covered entity, the covered entity shall not comply with this section by providing the security breach notification to that e-mail address, but may instead comply with this section by providing notice through other methods, as defined in subsection (1)(f) of this section, or by clear and conspicuous notice delivered to the resident online when the resident is connected to the online account from an internet protocol address or online location from which the covered entity knows the resident customarily accesses the account.


















Source: L. 2006: Entire section added, p. 536, § 1, effective September 1. L. 2010: (2)(d) amended, (HB 10-1422), ch. 419, p. 2064, § 9, effective August 11. L. 2018: (1) R&RE, (2), (3), and (4) amended, and (5) added, (HB 18-1128), ch. 266, p. 1634, § 3, effective September 1.

Structure Colorado Code