On March 19, 2024, House Bill 491 for the Government Data Privacy Act was signed by the Governor of Utah. This follows its introduction, on February 7, 2024, to the Utah House of Representatives.

In particular, the bill provides for the creation of a Utah Privacy Governing Board (the Board), composed of five members including the Governor, the President of the Senate, the President of the House of Representatives, the Attorney General, and the State auditor, or a designee of each.

The bill also provides for the creation of the Office of Data Privacy (the Office), which is responsible for assisting state agencies in implementing privacy practices, including compliance with legislation, facilitating data subject rights and individuals' control of their personal data, and enabling information sharing between state agencies.

On data breaches, the bill establishes breach notification requirements for government entities to notify the Utah Cyber Center and the Attorney General of a data breach affecting 500 or more individuals, with required contents of such notice, alongside requirements to notify affected individuals of a data breach.

Government entity obligations

Notably, the bill details requirements relating to government entities, including:

• implementing and maintaining a privacy program;
• operating on principles such as data minimization;
• not selling or sharing personal data unless permitted by law; and
• retaining and disposing of personal data in accordance with a documented data retention schedule.

In addition, government entities must provide a personal data request notice to an individual or the legal guardian of an individual from whom the government entity requests or collects personal data, with specified contents detailed under the bill. Government entities must also provide a process by which individuals may request an amendment or correction of the personal data furnished to the government entity.

The bill enters into effect on May 1, 2024.

You can read the bill and track its progress here.