On May 29, 2018, Governor Hickenlooper signed HB—1128 into law. Importantly, the Bill amends the State’s data breach notification law to require that affected Colorado residents be notified within 30 days of a data breach, and specifies the information that must be included in the data breach notice. The new law, which takes effect September 1, 2018, applies to “covered entities,” (if your business maintains, owns, or licenses information of Colorado residents, regardless of where the business or data is based, it is a “covered entity”), also sets forth certain data security requirements, and adds requirements regarding the disposal of personal identifying information.
The California Senate narrowly passed a bill earlier this week that would allow businesses to be sued for data breaches without proof of any injury. As this bill moves to the Assembly, there is already talk among legislators about amending it to include a safe harbor provision. But will any safe harbor address opponents’ concerns?