Ban Government Purchase of Personal Data from Third Party

Second Regular Session Seventy-fifth General Assembly STATE OF COLORADO INTRODUCED HOUSE BILL 26-1037 LLS NO. 26-0292.02 Owen Hatch x2698 HOUSE SPONSORSHIP Bacon and DeGraaf, SENATE SPONSORSHIP Cutter, House Committees Senate Committees Judiciary A BILL FOR AN ACT CONCERNING PROHIBITING A GOVERNMENT ENTITY FROM OBTAINING CERTAIN PERSONAL DATA FROM A THIRD PARTY FOR USE BY A GOVERNMENT ENTITY IN EXCHANGE FOR ANYTHING OF VALUE.

Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.) The bill prohibits law enforcement and other government entities from purchasing, or otherwise obtaining for anything of value, certain personal data from third parties. Law enforcement agencies and other government entities are also prohibited from sharing individuals' personal data between themselves. Shading denotes HOUSE amendment. Double underlining denotes SENATE amendment.

Capital letters or bold & italic numbers indicate new material to be added to existing law. Dashes through the words or numbers indicate deletions from existing law.

Exceptions are created for obtaining personal data, including after obtaining a judicial warrant, subpoena, or court order, when an individual consents to sharing their data and, in the case of an emergency, involving a threat to a person's life or physical safety. The bill creates a private cause of action for an individual who has their personal data obtained or shared in violation of the prohibitions in the bill. Personal data obtained or shared is excluded from trial and other court proceedings, subject to certain exceptions.

Be it enacted by the General Assembly of the State of Colorado: SECTION 1. Short title. The short title of this act is the "Fourth Amendment is Not for Sale Act". SECTION 2. Legislative declaration. (1) The general assembly finds and declares that:

(a) The fourth amendment to the United States constitution guarantees that "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized";

(b) The United States supreme court has observed, "Few protections are as essential to individual liberty as the right to be free from unreasonable searches and seizures. The Framers made that right explicit in the Bill of Rights following their experience with the indignities and invasions of privacy wrought by general warrants and warrantless searches that had so alienated the colonists and had helped speed the movement for independence. Ever mindful of the Fourth Amendment and its history, the Court has viewed with disfavor practices that permit police officers unbridled discretion to rummage at will among a person's private effects." Byrd v. United States, 584 U.S. 395, 402-403 (2018). Accordingly, "As technology has enhanced the Government's capacity to encroach upon areas normally guarded from inquisitive eyes, [the United States Supreme] Court has sought to assure preservation of that degree of privacy against government that existed when the Fourth Amendment was adopted." Carpenter v. United States, 585 U.S. 296, 305

(c) In People v. Seymour, 536 P.3d 1260 (Colo. 2023), the Colorado supreme court stated that Colorado is not bound by the United States supreme court's interpretation of the fourth amendment when determining the scope of state constitutional protections. The court stated that article II, section 7 provides even greater privacy protections than the fourth amendment, and Colorado has "long rejected the third-party doctrine under that provision of the Colorado Constitution," further stating that "[g]iven the enduring and related privacy concerns presented by a search of an individual's online search history, we see no reason to change course here."

(d) Law enforcement has been able to effectively and efficiently enforce our criminal laws for more than 230 years without needing to evade fourth amendment warrant requirements that are essential to protecting Americans' liberty and privacy in the digital age.

SECTION 3. In Colorado Revised Statutes, add 16-3-303.3 as follows:

16-3-303.3. Prohibition on the bulk purchase of data from third parties by law enforcement - evidence inadmissible in court - definitions.

(1) AS USED IN THIS SECTION, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(a) "EXCHANGE FOR ANYTHING OF VALUE" MEANS TO OBTAIN OR RECEIVE ACCESS TO AN ITEM, DATA, OR INFORMATION:

(I) CONSIDERATION;

IN EXCHANGE FOR MONEY OR OTHER VALUABLE

(II) IN CONNECTION WITH SERVICES OR BENEFITS PROVIDED AS CONSIDERATION; OR

(III) AS PART OF THE PROVISION OF A FEE, INCLUDING AN ACCESS FEE, SERVICE FEE, MAINTENANCE FEE, OR LICENSING FEE.

(b) "GOVERNMENT ENTITY" HAS THE SAME MEANING SET FORTH IN SECTION 16-3-303.5, INCLUDING A POLITICAL SUBDIVISION.

(c) "LAW ENFORCEMENT ENTITY" MEANS AN AGENCY OR OTHER INSTRUMENTALITY OF A GOVERNMENT ENTITY, INCLUDING AN EMPLOYEE OR AGENT OF THE ENTITY, THAT IS AUTHORIZED BY LAW, REGULATION, OR GOVERNMENTAL POLICY TO ENGAGE IN OR SUPERVISE THE PREVENTION, DETECTION, INVESTIGATION, OR PROSECUTION OF A VIOLATION OF CRIMINAL LAW.

(d) "PERSONAL DATA" MEANS INFORMATION COLLECTED FROM OR GENERATED BY A SPECIFIC PERSON AS PART OF A CONSUMER TRANSACTION OR THE USE OF A CONSUMER PRODUCT OR SERVICE, WHETHER THE INFORMATION WAS COLLECTED BY THE ORIGINAL THIRD PARTY OR OBTAINED BY A DIFFERENT THIRD PARTY, THAT IS CONNECTED OR REASONABLY CONNECTED TO THE SPECIFIC PERSON OR THE SPECIFIC PERSON'S ELECTRONIC DEVICE. PERSONAL DATA INCLUDES, BUT IS NOT LIMITED TO, A PERSON'S:

(I) NAME;

(II) BILLING INFORMATION OR ADDRESS;

(III) SOCIAL SECURITY NUMBER;

(IV) HOME ADDRESS;

(V) DEMOGRAPHIC DATA;

(VI) WEB BROWSING OR SEARCH HISTORY;

(VII) APPLICATION USAGE HISTORY;

(VIII) PRECISE GEOLOCATION DATA, AS DEFINED IN SECTION

(IX) FINANCIAL INFORMATION;

(X) HEALTH INFORMATION;

(XI) BIOMETRIC IDENTIFIER, AS DEFINED IN SECTION 6-1-1303;

(XII) BIOLOGICAL DATA, AS DEFINED IN SECTION 6-1-1303;

(XIII) CHARACTERISTICS OF PROTECTED CLASSIFICATIONS UNDER STATE OR FEDERAL LAW;

(XIV) DEVICE IDENTIFIER, INCLUDING A MEDIA ACCESS CONTROL ADDRESS, INTERNATIONAL MOBILE EQUIPMENT IDENTIFIER, OR INTERNET PROTOCOL ADDRESS;

(XV) COMMUNICATIONS CONTENT; AND

(XVI) PROFILES OR INFERENCES ABOUT AN INDIVIDUAL BASED ON DATA POINTS COLLECTED OR ACQUIRED FROM THIRD PARTIES.

(e) "THIRD PARTY" MEANS A PERSON WHO:

(I) IS NOT A GOVERNMENT ENTITY; AND

(II) IS NOT THE PERSON TO WHOM THE PERSONAL DATA PERTAINS.

(f) "WIDELY DISTRIBUTED MEDIA" MEANS CONTENT THAT IS MADE AVAILABLE TO A LARGE, GENERAL AUDIENCE THROUGH CHANNELS THAT ALLOW BROAD ACCESS AND REGULAR DISSEMINATION, AS OPPOSED TO PRIVATE, NICHE, OR RESTRICTED COMMUNICATIONS.

IN CONNECTION WITH A CRIMINAL, CIVIL, OR OTHER INVESTIGATORY OR ENFORCEMENT ACTIVITY:

(a) A LAW ENFORCEMENT ENTITY SHALL NOT OBTAIN OR RECEIVE ACCESS TO AN INDIVIDUAL'S PERSONAL DATA FROM A THIRD PARTY IN EXCHANGE FOR ANYTHING OF VALUE;

(b) A LAW ENFORCEMENT ENTITY SHALL NOT REQUEST, OBTAIN, OR RECEIVE ACCESS TO AN INDIVIDUAL'S PERSONAL DATA FROM A FEDERAL, STATE, OR LOCAL LAW ENFORCEMENT OR OTHER GOVERNMENT AGENCY OR DEPARTMENT IF THE DATA WAS OBTAINED FROM A THIRD PARTY IN EXCHANGE FOR ANYTHING OF VALUE;

(c) A LAW ENFORCEMENT ENTITY SHALL NOT SHARE ON A THIRD-PARTY PLATFORM OR SELL, IN EXCHANGE FOR ANYTHING OF VALUE, AN INDIVIDUAL'S PERSONAL DATA TO A FEDERAL, STATE, OR LOCAL LAW ENFORCEMENT OR OTHER GOVERNMENT AGENCY OR DEPARTMENT, OR A THIRD PARTY IF THE PERSONAL DATA WAS DIRECTLY OR INDIRECTLY COLLECTED BY THE LAW ENFORCEMENT AGENCY; AND

(d) A GOVERNMENT ENTITY, INCLUDING A LAW ENFORCEMENT ENTITY, SHALL NOT PROVIDE OR SHARE WITH A FEDERAL, STATE, OR LOCAL LAW ENFORCEMENT AGENCY OR DEPARTMENT AN INDIVIDUAL'S PERSONAL DATA OBTAINED FROM A THIRD PARTY IN EXCHANGE FOR ANYTHING OF VALUE.

(3) SUBSECTION (2) OF THIS SECTION DOES NOT APPLY WHEN:

(a) A LAW ENFORCEMENT ENTITY HAS OBTAINED A VALID JUDICIAL WARRANT, SUBPOENA, OR COURT ORDER, AND ANY ACCOMPANYING AFFIDAVIT TO EACH PARTY, PURSUANT TO RULE 16 OF THE COLORADO RULES OF CRIMINAL PROCEDURE, OR ANY SUCCESSOR RULE, FOR THE PERSONAL DATA OF THE SPECIFICALLY IDENTIFIED INDIVIDUAL;

(b) THE LAW ENFORCEMENT ENTITY ASSERTS IN GOOD FAITH THAT AN EMERGENCY SITUATION EXISTS THAT INVOLVES THE RISK OF DEATH OR SERIOUS BODILY INJURY TO A PERSON THAT REQUIRES IMMEDIATE DISCLOSURE;

(c) THE PERSONAL DATA IS LAWFULLY AVAILABLE TO THE PUBLIC THROUGH GOVERNMENT RECORDS OR WIDELY DISTRIBUTED MEDIA;

(d) THE PERSONAL DATA PERTAINS TO A SPECIFIC INDIVIDUAL, WAS VOLUNTARILY MADE AVAILABLE TO THE PUBLIC BY THE SPECIFIC INDIVIDUAL, AND WAS OBTAINED IN COMPLIANCE WITH ALL APPLICABLE LAWS, REGULATIONS, CONTRACTS, PRIVACY POLICIES, AND TERMS OF SERVICE;

(e) THE SPECIFIC INDIVIDUAL TO WHOM THE PERSONAL DATA PERTAINS INTENDED LAW ENFORCEMENT TO BE A RECIPIENT OF THE PERSONAL DATA, AS EVIDENCED BY CASE-SPECIFIC, EXPRESS CONSENT FROM THE SPECIFIC INDIVIDUAL;

(f) THE THIRD PARTY PROVIDING THE PERSONAL DATA WAS AUTHORIZED BY THE SPECIFIC INDIVIDUAL TO WHOM THE PERSONAL DATA PERTAINS TO PROVIDE THE DATA TO THE LAW ENFORCEMENT ENTITY, AS EVIDENCED BY CASE-SPECIFIC, EXPRESS CONSENT FROM THE SPECIFIC INDIVIDUAL; OR

(g) THE PERSONAL DATA IS PROVIDED TO OR BY THE NATIONAL CENTER FOR MISSING AND EXPLOITED CHILDREN OR ITS SUCCESSOR ENTITY AND IS RELATED TO AN INVESTIGATION INVOLVING A MISSING OR EXPLOITED CHILD.

(4) SUBSECTIONS (3)(d) TO (3)(f) OF THIS SECTION DO NOT VIOLATE SUBSECTION (2) OF THIS SECTION IF THE PERSON MADE THEIR PERSONAL DATA PUBLICLY AVAILABLE, EVEN IF A LAW ENFORCEMENT ENTITY PURCHASES THE PERSONAL DATA FROM A THIRD PARTY.

(5) (a) A VIOLATION OF THIS SECTION CONSTITUTES AN INJURY, AND A PERSON WHO IS INJURED MAY BRING A LEGAL ACTION FOR INJUNCTIVE RELIEF, DECLARATORY RELIEF, OR OTHER RELIEF DEEMED NECESSARY TO ENFORCE THIS SECTION IN A COURT OF COMPETENT JURISDICTION. A PLAINTIFF MAY SEEK REASONABLE ATTORNEY FEES PURSUANT TO THIS SECTION.

(b) (I) A COURT SHALL NOT ADMIT PERSONAL DATA ACQUIRED IN VIOLATION OF THIS SECTION OR EVIDENCE DERIVED FROM THAT INFORMATION AT A TRIAL, HEARING, OR OTHER PROCEEDING UNLESS THE PARTY SEEKING TO INTRODUCE THE EVIDENCE PROVIDES A COPY OF THE VALID JUDICIAL WARRANT, SUBPOENA, OR COURT ORDER AND ANY ACCOMPANYING AFFIDAVIT TO EACH PARTY PURSUANT TO RULE 16 OF THE COLORADO RULES OF CRIMINAL PROCEDURE, OR ANY SUCCESSOR RULE.

(II) A COURT MAY WAIVE THE REQUIREMENT IN SUBSECTION (5)(b)(I) OF THIS SECTION IF THE COURT FINDS THAT IT WAS NOT POSSIBLE TO PROVIDE A PARTY WITH THE VALID JUDICIAL WARRANT, SUBPOENA, OR COURT ORDER AND ANY ACCOMPANYING APPLICATION WITHIN THE TIME REQUIRED BY RULE 16 OF THE COLORADO RULES OF CRIMINAL PROCEDURE, OR ANY SUCCESSOR RULE, AND THE COURT FINDS THAT THE PARTY WILL NOT BE PREJUDICED BY THE DELAY IN RECEIVING THE INFORMATION.

SECTION 4. In Colorado Revised Statutes, 16-3-303.5, add (9) as follows: 16-3-303.5. Location information - search warrant required - definitions.

(9) NOTHING IN THIS SECTION AUTHORIZES A GOVERNMENT ENTITY TO OBTAIN LOCATION INFORMATION OF AN ELECTRONIC DEVICE IN EXCHANGE FOR ANYTHING OF VALUE IN VIOLATION OF SECTION

SECTION 5.

Safety clause. The general assembly finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, or safety or for appropriations for the support and maintenance of the departments of the state and state institutions.