Does the Colorado Privacy Act apply to churches with memberships (ex: Jehovah’s Witnesses)?
<p>Suppose a person living in Colorado is a registered member of a church. In this church, certain “blessings” are considered contingent on your membership. Membership is recorded on a digital system.</p>
<p>This church also considers donations to it a commandment.</p>
<p>It also has over 100,000 members.</p>
<p>Suppose this person wanted to officially leave the church and request that this membership data be deleted. Is the church in question obligated under the <a href="https://coag.gov/app/uploads/2022/01/SB-21-190-CPA_Final.pdf" rel="nofollow noreferrer">Colorado Privacy Act</a> to comply with said request?</p>

<p>Probably not.</p>
<p>The Act applies to:</p>
<blockquote>
<p>(1)  EXCEPT AS SPECIFIED IN SUBSECTION (2) OF THIS SECTION, THIS PART
13
APPLIES TO A CONTROLLER THAT: (a)  CONDUCTS BUSINESS IN COLORADO OR
PRODUCES OR DELIVERS COMMERCIAL PRODUCTS OR SERVICES THAT ARE
INTENTIONALLY TARGETED TO RESIDENTS OF COLORADO; AND (b)  SATISFIES
ONE OR BOTH OF THE FOLLOWING THRESHOLDS: (I)  CONTROLS OR PROCESSES
THE PERSONAL DATA OF ONE HUNDRED THOUSAND CONSUMERS OR MORE DURING A
CALENDAR YEAR; OR (II)  DERIVES REVENUE OR RECEIVES A DISCOUNT ON THE
PRICE OF GOODS OR SERVICES FROM THE SALE OF PERSONAL DATA AND
PROCESSES OR CONTROLS THE PERSONAL DATA OF TWENTY-FIVE THOUSAND
CONSUMERS OR MORE.</p>
</blockquote>
<p>Colo. Rev. Stat. § 6-1-1304(1).</p>
<p>The <a href="https://coag.gov/app/uploads/2023/03/FINAL-CLEAN-2023.03.15-Official-CPA-Rules.pdf" rel="noreferrer">Rules</a> contain the following related definition:</p>
<blockquote>
<p>“Commercial product or service” as referred to in C.R.S. §
6-1-1304(1)(a) means a product or service bought, sold, leased,
joined, provided, subscribed to, or delivered in exchange for monetary
or other valuable consideration in the course of a Controller’s
business, vocation, or occupation.</p>
</blockquote>
<p>There is no case law on point, but generally speaking a house of worship or a church is not considered a business, so it is probably not within the scope of the Act.</p>

privacy data-protection colorado data data-protection-act