Last week, the Utah Consumer Privacy Act (“UCPA”) passed both houses of the state legislature. Once Governor Spencer Cox signs the bill, Utah will become the fourth state—after California, Virginia, and Colorado—to enact comprehensive privacy legislation.

As reported by Patterson Belknap Webb & Tyler LLP here, the law applies to businesses (termed “controllers” or “processors,” a framework borrowed from the VCDPA ) that (1) conduct business in Utah or produce a product or service that is targeted to consumers who are residents of Utah; (2) has annual revenue of $25,000,000 or more; and (3) control or process personal data of 100,000 or more consumers, or derive over 50% of their gross revenues from the sale of personal data and control or process the personal data of 25,000 or more consumers. It also addresses key rights, including:

• Right to Access – Consumers have the right to confirm that a business is processing their personal data and to access that data.
• Right of Deletion – Consumers have the right to delete their personal data that they provided to the business.
• Right to Data Portability – Consumers have the right to obtain a copy of the data that the business controls and it must be readily portable, usable, and transmittable to other businesses.
• Right to Opt-Out – Consumers have the right to opt-out of the processing of their data for purposes of targeted advertising or the sale of their data.

Notably, it doesn’t create a private right of action, but the state Attorney General may seek statutory damages of up to $7,500 per violation or for actual damages. Before enforcing the UCPA, the Attorney General must provide 30 days’ notice to allow the company to cure any violations.

The text of the Utah Consumer Privacy Act is here: S.B. 227. The bill was first introduced just over a month ago, so it was passed quickly! And even if Governor Cox vetoes the bill, it passed both houses unanimously, so it should become law one way or another. Once signed into law, the UCPA would take effect on December 31, 2023.

Two other states – Florida and Oklahoma – have bills “In Cross Committee”, so we’re starting to pick up steam in terms of more states gearing up to enact data privacy laws.

So, what do you think of the Utah Consumer Privacy Act? Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.