{"id":1772,"date":"2022-05-02T00:00:00","date_gmt":"2022-05-02T06:00:00","guid":{"rendered":"https:\/\/dev.epicsrv.com\/km\/data-privacy-protections-come-to-utah\/"},"modified":"2025-12-15T10:43:32","modified_gmt":"2025-12-15T17:43:32","slug":"data-privacy-protections-come-to-utah","status":"publish","type":"post","link":"https:\/\/www.kirtonmcconkie.com\/zh\/news\/data-privacy-protections-come-to-utah\/","title":{"rendered":"Data Privacy Protections Come to Utah"},"content":{"rendered":"

DATA PRIVACY PROTECTIONS COME TO UTAH<\/strong><\/p>\n

On March 24, 2022, Utah became the fourth state to pass a comprehensive data privacy law, the Utah Consumer Privacy Act (UCPA), which will become effective December 31, 2023. It blends elements of the California, Virginia, and Colorado privacy laws that preceded it. This legal alert provides a brief overview of the scope of the UCPA, the obligations it imposes, the rights it grants, and its enforcement mechanisms.<\/p>\n

Scope<\/strong><\/p>\n

The UCPA applies to a subset of organizations doing business in Utah or that target their services or products to Utah residents. The UCPA does not apply to nonprofits, indigenous tribes, higher education institutions, government entities, and third parties under contract with government. For the UCPA to apply, the business must have annual revenues of at least $25 million and:<\/p>\n

    \n
  1. Control or process the data of at least 25,000 consumers and generate over 50 percent of its gross revenue from selling data; or<\/li>\n
  2. Control or process 100,000 or more Utah residents\u2019 personal data in calendar year.<\/li>\n<\/ol>\n

    The UCPA defines \u201cpersonal data\u201d broadly as any \u201cinformation that is linked or reasonably linked to an identified individual or an identifiable individual.\u201d True to its name, the UCPA only regulates consumer data and excludes personal data gathered in employment or business-to-business scenarios. Exemptions also exist for publicly available data, deidentified data[1]<\/a>, and data already subject to certain laws or regulations, like the Gramm-Leach-Bliley Act.<\/p>\n

    The UCPA affords special protections to sensitive data. Sensitive data \u201cincludes personal data that reveals\u201d religious beliefs, racial or ethnic origin, citizenship or immigration status, sexual orientation, health and medical treatment or conditions, geolocation data, and individually identifiable biometric or genetic data. Controllers must provide notice and an opportunity to opt out prior to processing consumers\u2019 sensitive data.<\/p>\n

    Obligations of Controllers and Processors<\/strong><\/p>\n

    The UCPA requires data controllers to minimize the data collected and put in place suitable security measures to protect personal data that has been collected. A controller \u201cdetermines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others,\u201d while a processor \u201cprocesses personal data on behalf of a controller.\u201d<\/p>\n

    Data controllers must post a privacy notice that contains disclosures about their personal data practices, such as the categories of personal data processed, purposes of processing, categories of disclosures to third parties, and how consumers may exercise their rights. The notice must be accessible and clear.<\/p>\n

    For transactions between controllers and\/or processors involving personal data, the parties must enter a written agreement that specifies the details of processing (e.g., data to be processed), the purpose of processing, and the parties\u2019 obligations and rights. Among the obligations included in the agreement, processors must agree to follow controllers\u2019 instructions when processing personal data. Processors must also contractually require sub-processors to adhere to the same obligations of the processor.<\/p>\n

    Rights of Consumers<\/strong><\/p>\n

    Like the California Consumer Privacy Act, the UCPA gives consumers specific rights. Some of these rights include:<\/p>\n