Security Breach Issues

If you have a possible security breach and you determine that the type of information that has been misused or is reasonably likely to be misused is a Colorado resident’s username or email address in combination with a password or security questions and answers, that would allow access to an online account, you must direct the affected person to promptly change his or her password and security question or answer, as applicable, or to take other steps appropriate to protect the online account(s) that use the same username, email address, password, security question or answer. This notice must occur as quickly as possible and without unreasonable delay, but must occur no later than 30 days after the date the security breach was determined to have occurred. Notice may be delayed if a law enforcement agency determines that the notice will impede a criminal investigation. There are alternative disclosure requirements if you provided the Colorado resident with log-in credentials for an email account that you furnished.

Notification rights and responsibilities cannot be waived, and the cost to make the notification cannot be passed on to the affected Colorado residents. If the security breach appears to have affected 500 Colorado residents or more, you are required to notify the Colorado Attorney General as quickly as possible, but no later than 30 days after the security breach is determined to have occurred. If you must notify more than 1,000 Colorado residents of a security breach, you are also required to notify all consumer reporting agencies, which compile and maintain files on consumers on a nation-wide basis, of the anticipated date of the notification to the residents and the approximate number of residents who are to be notified. You are not required to provide the names or other personal identifying information of the security breach notice recipients to the consumer reporting agencies. The consumer reporting agency provision does not apply if you are a financial institution subject to Title V of the Gramm-Leach-Bliley Act.

Remember

This article doesn’t summarize all aspects of the law and the Division recommends that you consult with an attorney regarding how best to comply with its requirements. If you are an independent or employing broker, you will need to update your office policy manual to address the maintenance, protection and destruction of personal identifying information, along with the notification requirements. The Real Estate Commission updated Commission Position Statement 21 on December 4, 2018 to include the data privacy requirements to your office policy manuals.