Utah Legislature Passes Consumer Privacy Law

Following the lead of California, Colorado, and Virginia, Utah is set to become the fourth state to pass a comprehensive privacy law.

As of March 4, the Utah Consumer Privacy Act (SB 227) cleared both houses of the Utah legislature.  The UCPA closely resembles the Virginia Consumer Data Privacy Act, but with some interesting changes.  The law applies to controllers or processors that do processors that do business in Utah, or produce a product or service that is targeted to consumers who are Utah residents; have annual revenue of $25 million or more; and either (a) control or process personal data of 100,000 or more consumers in Utah during a calendar year, or (b) derive over 50% of the entity’s gross revenue from the sale of personal data and control or process the personal data of 25,000 or more consumers.  The law does not include a private right of action; rather, it will be enforced by the Utah AG.  If signed, the law will go into effect on December 31, 2023.

The law would vest consumers with rights such as the right to confirm whether a controller is processing their personal data, access and deletion rights, and opt-out rights.  The law would require controllers and processors to provide notice that (1) identifies categories of and purposes for which personal data are processed, (2) informs consumers how they may exercise a right, (3) categories of personal data the controller shares with third parties, and (4) the categories of third parties with whom the controller shares personal data.