Polis Signs Final Flurry of Business Bills Despite Veto Pushes

Written by Ed Sealover, Denver Business Journal

Gov. Jared Polis finished off a monthlong bill-signing tour over the past week and a half by inking 18 business-focused laws that create a groundbreaking data privacy law, ban certain types of plastic containers and delay the implementation of a new tax revenue calculation system for small businesses, among other things.

The actions capped a period since the Legislature adjourned on June 8 in which the Democratic governor has occasionally weighed in with cautionary statements about some measures — and in one case implemented an executive order to prevent a law from going too far — but declined to veto any business-related legislation passed by the Democratic-majority General Assembly. That resistance came despite veto pushes made both by the American Chemistry Council on the plastics ban and by the insurance sector on a bill that would allow the Colorado Insurance Commissioner to bar rate-setting factors that the state views as potentially discriminatory.

Arguably the bill in the last round of Polis signings that will affect the most businesses is Senate Bill 190, which makes Colorado just the third state in the U.S. to enact a broad-based data privacy act allowing consumers to know what information companies have collected on them and request that most data be deleted. Polis issued a special signing statement Wednesday warning that while he believes the protections offered by the bipartisan bill are needed, he expects legislators to clean up several aspects of the law next year that carry the risk of “stifling innovation and Colorado’s position as a top state to do business.”

Applicable to all companies that process the personal data of 100,000 customers a year or collect and sell the personal data of 25,000 customers, the bill allows customers to inspect the personal data companies have on them and opt out, particularly in cases of data sales. It also requires companies to audit their records and prepare for the state a report on how they are complying with the law.

Justin Antonipillai, a former U.S. Department of Commerce official now operating a firm, WireWheel, that helps companies comply with data regulations, said that any company that does business via a website must comb their records now to understand what data they have and be able to explain it and delete it if requested. While he said that many larger companies, in particular, have put practices in place over the past five years that leave them in a good position for compliance, others may have to invest in systems that explain easily to consumers how they can opt out of data collection.

“If a human being can’t understand what’s going to happen with their data when they visit your website … you’re painting a big red mark on your back,” he said of the law, effective come 2023, that can be enforced by the Colorado Attorney General’s office and district attorneys.

Colorado also is breaking ground with House Bill 1162, which bars restaurants from offering to-go polystyrene containers and stores from offering single-use plastic bags beginning in 2024 and also allows local governments in July 2024 to enact stricter rules than the state. It contains a plastic-bag exception for locally owned businesses with three or fewer locations.

With the law, Colorado becomes the 10th state with a plastic-bag ban, the eighth with a polystyrene container ban and the first to reverse its ban on municipal preemption, noted Danny Katz, executive director of the Colorado Public Interest Research Group (CoPIRG). While restaurant officials particularly fought it, warning of increased costs to an already struggling industry, environmental groups like Katz’s said it will mark a big step in keeping plastic waste from ending up in rivers and on roadsides.

Future proof your privacy program with WireWheel’s Trust Access and Consent Center and WireWheel’s Privacy Operations Manager.

Request Demo