Utah appears poised to be the next state with a comprehensive privacy law on its books, following California, Virginia, and Colorado.  On March 2nd, the Utah House of Representatives voted unanimously to approve an amended version of the legislative proposal, and the Senate concurred with the House amendment on the following day.  Formalities are now being completed to send the bill to Governor Spencer Cox for signature.

The Utah Consumer Privacy Act (“UCPA”) provides for consumer rights and responsibilities for controllers and processors.  Although the bill generally tracks the comprehensive privacy law passed in Virginia last year, the VCDPA, there are some notable differences.  Key provisions in the bill include the following:

  • Scope of the Law: The UCPA would apply to controllers or processors that (1) conduct business in the state or produce a product or service that is targeted to Utah consumers, (2) have annual revenue of $25,000,000 or more, and (3) satisfy one or more of the following thresholds:  (a) during a calendar year, controls or processes personal data of 100,000 or more consumers or (b) derives over 50% of its gross annual revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.  Notably, the law would not apply to nonprofits, institutions of higher education, covered entities under HIPAA, several types of health data, or financial institutions or an affiliate of a financial institution governed by, or data regulated by, the GLBA.
  • Consumer Rights: The UCPA provides consumers with rights to confirm whether a controller is processing the consumer’s personal data, access personal data, delete the consumer’s personal data that the consumer provided to the controller, and obtain a portable copy of the consumer’s personal data that the consumer previously provided.  The right to delete only applies to personal data provided by the consumer and not all data the controller has obtained about the consumer.  The bill also grants consumers a non-discrimination right, and the bill does not include a consumer right to correct inaccuracies in personal data.
  • Opt-out Rights for “Sale” and “Targeted Advertising”: Consistent with the VCDPA, the UCPA would provide Utah consumers with rights to opt-out of the “sale” of their personal data and targeted advertising.  However, it would not provide consumers with the right to opt-out of certain “profiling” activities, distinguishing it from the VCDPA.  The definitions of “sale” and “targeted advertising” generally follow the VCDPA’s approach, though “sale” is arguably narrower under the UCPA.  Notably, the UCPA does not require controllers to undertake data protection assessments for these (or any other) activities.
  • Sensitive Data Processing: Prior to processing the consumer’s sensitive data, the controller must first present the consumer with a clear notice and the opportunity to opt-out of such processing, or in the case of a known child, process the data in accordance with the Children’s Online Privacy Protection Act.  This opt-out approach notably diverges from the VCDPA and Colorado Privacy Act, which require consent prior to processing sensitive data.  “Sensitive data” is defined as  data that reveals racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status; or reflects information regarding medical history, conditions, or treatment; genetic or biometric data, if that data is used to identify a person; or specific geolocation data.  Notably, “sensitive data” does not include personal data that reveals an individual’s racial or ethnic origin “if the personal data is processed by a video communications service” or by a person licensed to provide healthcare.  Video communications service is not defined in the bill.
  • Enforcement: The law would not provide consumers a private right of action to enforce the law’s requirements.  Instead, the law empowers a division within state government to establish and administer a system to receive and investigate consumer complaints.  If the division has “reasonable cause to believe that substantial evidence exists” that an entity is in violation of the law’s requirements, the division may refer the matter to the Attorney General.  Once the matter is referred to the Attorney General, there is a 30-day notice and cure period.
  • Effective Date: If signed by the governor, the bill would take effect on December 31, 2023.
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.