Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Utah: Bill for a Government Data Privacy Act introduced to House

On February 7, 2024, House Bill 491 for the Government Data Privacy Act was introduced to the Utah House of Representatives and subsequently read for the first time, on the same date.

In particular, the bill provides for the creation of a Utah Privacy Governing Board (the Board), composed of five members including the Governor, the President of the Senate, the President of the House of Representatives, the Attorney General, and the State auditor, or a designee of each. The Board is responsible for recommending changes to the state data privacy policy, alongside hearing issues regarding governmental entity privacy practices.

The bill also provides for the creation of the Office of Data Privacy (the Office), which is responsible for assisting state agencies in implementing privacy practices, including compliance with legislation, facilitating data subject rights and individuals' control of their personal data, and enabling information sharing between state agencies. In addition, the bill lays out that the Office is responsible for coordinating with the Utah Cyber Center on the development of an incident response plan for data breaches affecting government entities.

The Office will also be directed by a Chief Privacy Officer, whose post is also created under the bill and is responsible for making recommendations for legislation relating to data privacy.

Government entity obligations

Notably, the bill details requirements relating to government entities, including:

  • implementing and maintaining a privacy program;
  • operating on principles such as data minimization;
  • not selling or sharing personal data unless permitted by law;
  • retaining and disposing of personal data in accordance with a documented data retention schedule.

In addition, government entities must provide a personal data request notice to an individual or the legal guardian of an individual from whom the government entity requests or collects personal data, with specified contents detailed under the bill. Government entities must also provide a process by which individuals may request an amendment or correction of the personal data furnished to the government entity.

Data breach notification

On data breaches, the bill establishes breach requirements for government entities to notify the Utah Cyber Center and the Attorney General of a data breach affecting 500 or more individuals, with required contents of such notice, alongside requirements to notify affected individuals of a data breach.

The bill provides that it would enter into force on May 1, 2024.

You can read the bill and track its progress here.

Update: February 26, 2024

Bill proceeds to the Senate 

On February 23, 2024, the bill was read for the third time by the House and thereafter proceeded, on the same date, to the Utah State Senate.

You can read the bill and track its progress here.

Update: February 29, 2024

Bill passes Senate

On February 28, 2024, the bill was read for a second time by the Senate with amendments incorporated following its introduction, on February 26, 2024, to the Senate. The bill was subsequently signed by the President of the Senate and sent to the Speaker of the House to be signed.

You can read the bill and track its progress here.

Update: March 20, 2024

Bill signed by Governor

On March 19, 2024, the bill was signed by the Governor of Utah.

The bill enters into effect on May 1, 2024.

You can read the bill and track its progress here.

Update: May 1, 2024

Act enters into force

On May 1, 2024, the Act entered into force.

You can read the Act and view its legislative history here.