Law: Utah Consumer Privacy Act ('UCPA')
Regulator: The Utah Attorney General ('AG')
Summary: The Utah Governor signed, on 24 March 2022, the UCPA, making Utah the fourth State to enact comprehensive privacy legislation. The UCPA establishes consumers' rights around access, deletion, portability, and provides for the right to opt-out of targeted advertising and sale of personal data. The UCPA also establishes various controller and processor obligations, privacy notice requirements, and grants the AG exclusive authority to enforce its provisions. The UCPA will enter into effect on 31 December 2023.
In addition, House Bill 57 for the Electronic Information or Data Privacy Act ('the Act') entered into force on 14 May 2019, and protects third-party electronic information or data and provides that the presumed owner of the data, and therefore the person who may maintain a reasonable expectation of privacy in relation to the data, is the individual transmitting such data to a third party. Furthermore, Utah requires the notification of breaches of personal data to affected data subjects, with violations facing civil penalties of injunctive relief sought by the AG.