Colorado Attorney General Philip Weiser gave his first public comments since April last Thursday at Ballard Spahr LLP’s 2022 Annual Colorado Privacy Summit.  In an hour-long fireside chat with Ballard Spahr’s Co-Chair of Privacy and Data Security Greg Szewczyk, AG Weiser discussed the rulemaking process under the Colorado Privacy Act.  A recording of the interview is available here.   

The forthcoming Colorado regulations are particularly important because of the four non-California states with privacy laws going into effect in 2023—all of which follow the same general model—Colorado is the only state with implementing regulations.  Accordingly, AG Weiser’s approach is likely to have widespread influence across the nation. 

AG Weiser laid out his philosophy of “accessible, transparent, and thoughtful” rulemaking.  First, he noted that public participation—particularly participation sooner than later—is key to harmonizing the law with business and technology.  The Colorado AG emphasized that regulators give serious consideration to stakeholder input; he hopes that such a rulemaking process will make stakeholders “proud” of democracy at work. 

Second, AG Weiser discussed transparency by laying the groundwork for enforcement efforts.  He stated that the majority of the enforcement focus will be on organizations that are willfully non-compliant, rather than playing a game of “gotcha” with organizations aiming for compliance in good faith.

Next, adding to the thoughtfulness of the process, AG Weiser seeks to harmonize compliance with the patchwork of other state privacy laws.  Instead of importing the California rules, AG Weiser’s office aims to “show the world there’s another way” without contradicting those preexisting frameworks.

Beyond the Colorado Privacy Act and its regulations, AG Weiser highlighted the importance of other consumer protection laws in Colorado such as the auto-renewal law.  With the proposed regulations lurking on the horizon sometime “soon,” this fireside chat gives viewers a helpful lens for approaching compliance with the Colorado Privacy Act.