EveryAILaw.comDoes Colorado Privacy Act Rules (4 CCR 904-3) require Human Oversight?
Colorado • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 6 specific requirements for Human Oversight across 1 provision:
- Solely Automated Processing — Automated processing of Personal Data with no human review, oversight, involvement or intervention (Rule 2.02)
- Human Reviewed Automated Processing — Human review of automated processing that does not rise to Human Involved Automated Processing; review of output without meaningful consideration is insufficient (Rule 2.02)
- Human Involved Automated Processing — Meaningful consideration of available data used in processing or any output, and authority to change or influence the processing outcome (Rule 2.02)
- Profiling opt-out effect — For covered profiling of statutory consumer personal data in furtherance of a decision with legal or similarly significant effects, Rule 9.04(B) requires honoring opt-out requests based on solely or human reviewed processing. Rule 9.04(C) allows a controller to decline a request based on human involved processing, with the required notice and information.
- Employment boundary — “Employment opportunities” remains one listed significant-effect domain, but the consumer definition excludes the employment context, job applicants, and employment-context beneficiaries, and § 6-1-1304(2)(k) exempts employment records
- Separate biometric rule — Rule 7.09 separately governs employer consent for employee or prospective-employee biometric identifiers under C.R.S. § 6-1-1314(6)
Automated Processing Definitions (Rule 2.02)
These definitions govern profiling within the CPA's controller, personal-data, and statutory-consumer scope. The significant-effects definition includes employment opportunities, but “Consumer” excludes a person acting in a commercial or employment context, a job applicant, and a beneficiary of someone acting in an employment context; C.R.S. § 6-1-1304(2)(k) separately exempts data maintained for employment records purposes. Rule 7.09 creates a distinct employee biometric-identifier consent regime and does not expand Part 9 profiling duties to ordinary employment records. Rule 9.04(B)-(C) applies the three processing definitions to profiling opt-out requests within the CPA’s covered scope.
Requirements
| Requirement | Details |
|---|---|
| Solely Automated Processing | Automated processing of Personal Data with no human review, oversight, involvement or intervention (Rule 2.02) |
| Human Reviewed Automated Processing | Human review of automated processing that does not rise to Human Involved Automated Processing; review of output without meaningful consideration is insufficient (Rule 2.02) |
| Human Involved Automated Processing | Meaningful consideration of available data used in processing or any output, and authority to change or influence the processing outcome (Rule 2.02) |
| Profiling opt-out effect | For covered profiling of statutory consumer personal data in furtherance of a decision with legal or similarly significant effects, Rule 9.04(B) requires honoring opt-out requests based on solely or human reviewed processing. Rule 9.04(C) allows a controller to decline a request based on human involved processing, with the required notice and information. |
| Employment boundary | “Employment opportunities” remains one listed significant-effect domain, but the consumer definition excludes the employment context, job applicants, and employment-context beneficiaries, and § 6-1-1304(2)(k) exempts employment records |
| Separate biometric rule | Rule 7.09 separately governs employer consent for employee or prospective-employee biometric identifiers under C.R.S. § 6-1-1314(6) |
Penalties
| Violation | Fine |
|---|---|
| Per violation | Up to USD 20,000 per violation (deceptive trade practice) |