Comprehensive Guide to Utah Privacy Law | DataGrail

Utah’s Data Privacy Law Explained

Following California’s successful passage of its Consumer Privacy Act (CCPA), four other US states enacted similar consumer privacy laws.

On March 24th, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (UCPA) into law, making Utah the fourth state in the United States to enact comprehensive consumer privacy legislation. The UCPA shares many similarities with the US state privacy laws in Virginia, Colorado, and Connecticut; less so with California’s CCPA/CPRA.

Businesses that operate in or serve Utah residents—specifically, those entities that control or process personal data—need to prepare for compliance for the UCPA’s commencement on December 31st, 2023.

Scope

Who does UCPA apply to?

Generally speaking, it imposes obligations on two parties: “controllers” and “processors.” Additionally, UCPA applies to any controller or processor who:

1. Conducts business in Utah or produces a product or service that is targeted to Utah residents
2. Has annual revenue of $25M or more
3. Either:
   1. Controls or processes personal data of 100,000 or more consumers in a calendar year
   2. Derives more than 50% of its gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.

Controllers

The law defines a controller as an entity that “determines the purposes for which and means by which personal data is processed.” Controllers are required to:

• Provide a privacy notice that divulges the types of data used, the purpose for processing, consumer’s rights under the UCPA, and the third parties with whom the controller shares data.
• Disclose any sale of consumer data or use of targeted advertising.
• Install administrative, technical, and physical data security practices to protect consumer data.
• Provide Utah consumers with a notice of sensitive data processing and the opportunity to opt-out.

Processors

Processors are entities that process personal data on behalf of a controller. According to the UCPA, processors must follow many, if not all, of the same regulations governing controllers.

Furthermore, there are specific obligations the two must follow when working with one another. For example, to legally process consumer data, there must be a written contract between the controller and processor that details:

• The purposes behind data processing
• The data processing procedures (set by the controller)
• Consumer privacy provisions

Utah’s privacy law is unique in that controllers don’t need to obtain opt-in consent to collect and process sensitive data. Instead, they’re required to provide a clear notice and an opportunity to opt-out.

Defining and Distinguishing Personal Data and Sensitive Data

It’s important to note that there are two types of consumer data the bill applies to, with sensitive data having enhanced obligations and protections:

• Personal data– “Information that is linked or reasonably linkable to an identified individual or an identifiable individual.” That doesn’t include aggregate, publicly available, or de-identified data.
• Sensitive data – “Personal data that reveals an individual’s race, ethnicity, religious beliefs, sexual orientation, citizenship or immigration status, medical history, mental or physical health condition, medical treatment or diagnosis, genetic or biometric data.”

Consumer Rights

Under the new legal framework, Utah residents are granted the following six categories of rights:

1. Right to know – Consumers have the right to verify if a data controller is processing their personal data.
2. Right to access – Consumers have the right to access their personal data.
3. Right to deletion – Consumers have a limited right to request their personal data be deleted by the controller.
4. Right to copy – Consumers have the right to obtain a copy of their personal data in a format that’s both portable and legible.
5. Right to opt-out – Consumers have the right to opt-out of personal data processing if it’s used for targeted advertising or if the data is sold.
6. Right to avoid discrimination – Consumers have the right to avoid discrimination for exercising their UCPA rights.

Enforcement

Who’s in charge of enforcing this new consumer protection law?

Investigations will occur under the Utah Division of Consumer Protection. If they receive a complaint, they may escalate it to the Utah Attorney General (AG). From there, the Utah AG has exclusive enforcement authority.

If the AG’s office receives a complaint and decides to pursue the matter, the AG is required to provide the impacted entities with written notice of the allegations, with a 30-day window to rectify the problem. If the controller or processor fails to address the issue, the Utah Attorney General can pursue a civil suit that includes a $7,500 penalty for each violation.

Notable Differences

Unlike the other state laws, Utah:

• Makes a distinction under the sensitive data category to exclude personal information that reveals an individual’s race if a video communications company processes it.
• Excludes the right to correct inaccurate or incomplete data.
• Excludes the right to opt-out of profiling and automated decision-making.
• Does not require controllers subject to the UCPA to recognize universal opt-out signals (like GPC) as a method for consumers to opt-out of data sales.
• Does not require controllers subject to the UCPA to conduct privacy impact assessments (although the practical utility of such DPIA/PIAs does not go away).

Finally, the Utah privacy law does not provide for a private right of action. In other words, impacted citizens can’t privately sue a company under UCPA.

DataGrail—The Platform for Utah Data Privacy Law Compliance

Utah is just the fifth state in the United States to pass its own comprehensive consumer privacy law. It is unlikely to be the last.

Is your privacy program ready for a fragmented US privacy landscape?

DataGrail is your company’s privacy control center. Our integrated data privacy platform is a centralized solution you can use to manage your entire privacy program. From automating privacy requests to mapping all of your consumers’ data, we can help you maintain compliance with UCPA, VCDPA, CCPA, GDPR, and more.