Duty to avoid unlawful discrimination; and
Duty regarding sensitive data.
In addition, while Consumers may request access to their personal data, Controllers may not require that a Consumer create a new account in order to exercise this right (or retaliate with increased cost or decreased availability of a product or service ). When responding to Consumer data requests, Controllers must:
Take action on the Consumer’s request without undue delay and within 45 days of receiving the request—with few exceptions.
Develop an internal process for Consumers to appeal refusals of data requests.
Notify the Consumer that it may contact the Colorado Attorney General if the Consumer has concerns about the result of the response and outcome of appeal.