Biometric Data Amendment Creates New Requirements for Employees under the Colorado Privacy Act

Kathryn Bennett, Law Clerk

            On May 31, 2024, Governor Polis signed into law HB-1130, amending and expanding the reach of the Colorado Privacy Act (“CPA”) by imposing specific requirements on employers regarding their handling of biometric data. [1] Adopted by the Colorado Legislature in late April, this new law will take effect on July 1, 2025.

Legal Development

            The CPA as originally enacted was intended to protect Colorado citizens’ security interests in the use of biometric data; however, it did not address protection of those interests in a commercial or employment context.  Biometric data is “one or more biometric identifiers,” which is “data generated by the technological processing, measurement, or analysis of a consumer’s biological, physical, or behavioral characteristics,” including things such as fingerprint or facial recognition maps.[2]

            Prior to HB-1130, the CPA only governed controllers’ collection and processing of sensitive information, and did not address  or define biometric data.[3]  Now, employers are implicated in the new broad protections over the use and control of employees’ biometric data.  The new law’s broader definition of employees includes full time and part time workers, those on-call or hired as contractors, subcontractors, interns, or fellows. [4]  Typically, contractors and subcontractors are not considered employees.   

HB-1130 Restricts Employer Use of Biometric Data

The central provision of the CPA amendment affecting employers is a restriction that limits the use of biometric data as a condition of employment.[5]  In pertinent part, the amendment confines the reasons for which employers may seek consent from an employee or prospective employee for the collection of biometric data.   

The amendment expressly prohibits employers from conditioning employment on an applicant’s consenting to the collection and processing of biometric data, except for the limited purposes of: 1) permitting access to secure physical locations and secure electronic hardware and software applications; or 2) recording the start and end of an employee’s work day, including meal and rest breaks in excess of thirty minutes.[6]  However, an employer shall not obtain the employee’s or prospective employee’s consent to retain biometric data that is used for current employee location tracking, or tracking of how much time that employee spends using a hardware or software application.[7]  Employers with remote workers that may have used facial recognition or some other biometric data to determine when employees are working online from their computers, other than monitoring for beginning and ending work, may run afoul of the new law and should evaluate their policies and practices to ensure conformance with HB-1130.[8]

Employer Considerations

Employers may consider reviewing their hiring policies and practices to ensure compliance with the new amendment’s requirements.  If the collection or processing of biometric data is implicated in the hiring process, employers should ensure the use of that information is restricted to the two reasons listed above.  Campbell Litigation, P.C. is available to assist in the navigation of this new legal development.

[1] Colo. Rev. Stat. § 6-1-1301 et. seq. 

[2] Colo. Rev. Stat. § 6-1-1303(2.2)(a); § 6-1-1303(2.4)(a), (d).

[3] “Controller” means a person that, alone or jointly with others, determines the purposes for and means of processing personal data.  Colo. Rev. Stat. § 6-1-1303(7).

[4] Colo. Rev. Stat. § 6-1-1314(1)(b). 

[5] Colo. Rev. Stat. § 6-1-1314.

[6] Id. at § 6-1-1314(6)(a).

[7] Id.

[8] See Colo. Rev. Stat. § 6-1-1314(6)(a)(I).