Alert

March 25, 2022

Utah Governor Signs Nation's Fourth Comprehensive Consumer Data Privacy Law

Yesterday, March 24, 2022, Utah Governor Spencer Cox signed into law the Utah Consumer Privacy Act ("UCPA"). By enacting the UCPA, Utah becomes the fourth state in the nation to implement a generally applicable consumer data privacy law, after California (the California Consumer Privacy Act or CCPA), Virginia (the Virginia Consumer Data Protection Act), and Colorado (the Colorado Privacy Act). While the UCPA is similar to these other state laws, businesses subject to the law may face different obligations than they do under other state laws. Regardless, the continued expansion of the state data privacy regulation patchwork complicates data privacy compliance efforts. We will continue to monitor developments in other states, including regulatory developments in California related to changes to the CCPA set for January 2023.

The UCPA applies to any controller or processor that conducts business in Utah or produces a product or service that is targeted to Utah consumers; has an annual revenue of $25 million or more; and either (1) during a calendar year controls or processes personal data of 100,000 or more Utah residents or (2) derives over 50% of its gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more Utah residents. The UCPA applies to information that is linked or reasonably linkable to an identified or readily identifiable individual. The law also provides special protections for sensitive data, which includes personal data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional. Sensitive data also includes the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual, as well as specific geolocation data.

However, the UCPA does not apply to, among other things:

• financial institutions or their affiliates governed by, or personal data processed in accordance with, the federal Gramm-Leach-Bliley Act;
• certain activities regulated by the Fair Credit Reporting Act;
• information on persons acting in a commercial or employment context;
• deidentified data, aggregated data, or, in some contexts, pseudonymous data; or
• certain publicly available information.

The UCPA also does not restrict a controller's or processor's ability to comply with other law, engage in certain fraud prevention and detection and security activities, or engage in certain internal processing uses, among other limited activities.

Consumer Rights

The UCPA provides consumers with a number of rights related to their personal data. Under the UCPA, consumers have the right:

• to confirm whether or not a controller (the person that determines the purpose and means of processing personal data) is processing personal data;
• to access their personal data;
• to delete personal data that the consumer provided to the controller;
• to obtain a portable copy of personal data that the consumer previously provided to the controller in a format that is readily usable and allows the consumer to transmit the data to another controller without impediment; and
• to opt out of the processing of personal data for (1) targeted advertising or (2) the sale of personal data.

Controller Obligations

The UCPA imposes different obligations depending on whether the business is a controller or a processor (the entity processing personal data on behalf of the controller). Therefore, a business will need to analyze whether it is acting as a controller or a processor when engaging in any personal data processing.

Under the UCPA, controllers must, among other things:

• provide a Privacy Notice containing specific disclosures, including the categories of personal data processed, the purposes for which personal data are processed, how a consumer may exercise a right, the categories of personal data that the controller shares with third parties, the categories of third parties with whom the controller shares personal data, and—if selling personal data or processing personal data for targeted advertising—a clear and conspicuous disclosure of how a consumer can opt out;
• establish, implement, and maintain reasonable administrative, technical, and physical data security practices commiserate with the controller's business size, scope, and type that are designed to protect the confidentiality and integrity of personal data, reduce reasonably foreseeable risks of harm to consumers relating to the processing of personal data, and are appropriate for the volume and nature of the personal data at issue;
• not process sensitive data without first presenting the consumer with clear notice and an opportunity to opt out of the processing or, in the case of a child, processing the data in accordance with the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501 et seq.; and
• not discriminate against a consumer for exercising a right by denying a good or service to the consumer, charging the consumer a different price or rate for a good or service, or providing the consumer a different level of quality of a good or service.

Processor Obligations

A processor must follow a controller's instructions and must assist the controller in meeting the controller's obligations, including obligations related to data security and breach notification obligations.

There are also requirements for contracts between controllers and processors as well as requirements for engaging subcontractors.

Enforcement

The Utah attorney general has the exclusive authority to enforce the UCPA. The attorney general may seek civil penalties of up to $7,500 for each violation of the UCPA, in addition to actual damages for the consumer. The UCPA provides for a 30-day right to cure.

The UCPA does not provide for a private right of action.

Effective Date

The UCPA will become effective on December 31, 2023.