The Utah House of Representatives unanimously passed a consumer privacy bill which the Senate passed earlier this year. The governor is expected to sign it and has 20 days to veto it.
This bill has a higher threshold – it targets businesses who target Utah residents, have an annual gross revenue of over $25 million and either control or process data on at least 100,000 residents.
It exempts higher education, nonprofits, and HIPAA and GLBA covered entities.
It is scheduled to take effect December 31, 2023.
Other features of the bill are similar to other states –
- The rights of notice, access, portability and deletion
- The right to opt out of the use of their data for things like targeted advertising
- The concept of “non-public” information goes away. Now information that is linked or reasonably linkable to a person is covered
- It excludes employee data and business to business CONTACT information
- It creates a category of sensitive information such as race, ethic origin, religion, sexual orientation and a number of other categories, but rather than these categories to be opt-in, they are opt-out
- There is no private right of action; only the AG can enforce this law
- But it does grant the Utah Department of Commerce, Division of Consumer Protection the power to investigate complaints and refer them to the AG.
I anticipate more laws coming this year. Credit: National Law Review
