United States of America: Announced Attorney General Amendments to Colorado Privacy Act Rules including data protection authority governance

On 13 September 2024, the Colorado Attorney General announced Amendments to the Colorado Privacy Act (CPA) Rules. Under the CPA, the Attorney General can promulgate rules governing privacy, including general rules for the purpose of carrying out the CPA. The proposed Amendments include a section on interpretive guidance and opinion letters which set out processes for a number of regulatory powers. Specifically, the section sets out a process for the Attorney General to issue Opinion Letters to clarify how the Colorado Privacy Act applies to particular proposed activities upon request by businesses. Businesses can rely on these letters for a Good Faith Defense if they comply with the guidance. However, this defence only applies to the party that requested the Opinion Letter and is valid if the facts remain consistent. The Amendments also set out the process by which the Attorney General can issue Interpretative Guidelines, providing general information on how the Colorado Privacy Act is to be interpreted an applied, in response to requests for general information.