Utah appears poised to be the next state with a comprehensive privacy law on its books, following California, Virginia, and Colorado.  On March 2nd, the Utah House of Representatives voted unanimously to approve an amended version of the legislative proposal, and the Senate concurred with the House amendment on the following day.  Formalities are now being completed to send the bill to Governor Spencer Cox for signature.

The Utah Consumer Privacy Act (“UCPA”) provides for consumer rights and responsibilities for controllers and processors.  Although the bill generally tracks the comprehensive privacy law passed in Virginia last year, the VCDPA, there are some notable differences.  Key provisions in the bill include the following:

• Scope of the Law: The UCPA would apply to controllers or processors that (1) conduct business in the state or produce a product or service that is targeted to Utah consumers, (2) have annual revenue of $25,000,000 or more, and (3) satisfy one or more of the following thresholds:  (a) during a calendar year, controls or processes personal data of 100,000 or more consumers or (b) derives over 50% of its gross annual revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.  Notably, the law would not apply to nonprofits, institutions of higher education, covered entities under HIPAA, several types of health data, or financial institutions or an affiliate of a financial institution governed by, or data regulated by, the GLBA.
• Consumer Rights: The UCPA provides consumers with rights to confirm whether a controller is processing the consumer’s personal data, access personal data, delete the consumer’s personal data that the consumer provided to the controller, and obtain a portable copy of the consumer’s personal data that the consumer previously provided.  The right to delete only applies to personal data provided by the consumer and not all data the controller has obtained about the consumer.  The bill also grants consumers a non-discrimination right, and the bill does not include a consumer right to correct inaccuracies in personal data.
• Opt-out Rights for “Sale” and “Targeted Advertising”: Consistent with the VCDPA, the UCPA would provide Utah consumers with rights to opt-out of the “sale” of their personal data and targeted advertising.  However, it would not provide consumers with the right to opt-out of certain “profiling” activities, distinguishing it from the VCDPA.  The definitions of “sale” and “targeted advertising” generally follow the VCDPA’s approach, though “sale” is arguably narrower under the UCPA.  Notably, the UCPA does not require controllers to undertake data protection assessments for these (or any other) activities.
• Sensitive Data Processing: Prior to processing the consumer’s sensitive data, the controller must first present the consumer with a clear notice and the opportunity to opt-out of such processing, or in the case of a known child, process the data in accordance with the Children’s Online Privacy Protection Act.  This opt-out approach notably diverges from the VCDPA and Colorado Privacy Act, which require consent prior to processing sensitive data.  “Sensitive data” is defined as  data that reveals racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status; or reflects information regarding medical history, conditions, or treatment; genetic or biometric data, if that data is used to identify a person; or specific geolocation data.  Notably, “sensitive data” does not include personal data that reveals an individual’s racial or ethnic origin “if the personal data is processed by a video communications service” or by a person licensed to provide healthcare.  Video communications service is not defined in the bill.
• Enforcement: The law would not provide consumers a private right of action to enforce the law’s requirements.  Instead, the law empowers a division within state government to establish and administer a system to receive and investigate consumer complaints.  If the division has “reasonable cause to believe that substantial evidence exists” that an entity is in violation of the law’s requirements, the division may refer the matter to the Attorney General.  Once the matter is referred to the Attorney General, there is a 30-day notice and cure period.
• Effective Date: If signed by the governor, the bill would take effect on December 31, 2023.