The UCPA excludes the following exchanges of personal data from the definition of a sale: (1) disclosure of personal data to a processor that processes personal data on behalf of the controller; (2) disclosure of personal data to an affiliate of the controller; (3) considering the context in which the consumer provided the personal data to the controller, disclosure of personal data to a third party if the purpose is consistent with a consumers reasonable expectations; (4) disclosure of personal data when a consumer (a) directs the controller to disclose the data (b) or interacts with one or more third parties; (5) disclosure of information that the consumer intentionally made available to the general public via a channel of mass media and does not restrict to a specific audience; or, (6) disclosure or transfer to a third party of personal data as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controllers assets.[10]. The UCPA was introduced on February 17, 2022, and sped through the state legislature, receiving final passage on March 3, 2022. This cookie is set by GDPR Cookie Consent plugin. The Utah Consumer Privacy Act applies to "Personal Data," which is defined as "information that is linked or reasonably linkable to an identified individual or an identifiable individual." 2 Personal Data does not include information that is de-identified or that is publicly available. The Utah Consumer Privacy Act (UCPA) was signed into law by Governor Spencer Cox on March 24th, 2022, joining a growing list of U.S. states with comprehensive . Classify360s inverted index provides a rapid, thorough search of connected data sources without making copies and the associated additional risk. We expect to see additional states adopt Utahs model, though state regulation will continue to remain a patchwork system. With the recent signing of the Utah Consumer Privacy Act ( UCPA) by Gov. Analytical cookies are used to understand how visitors interact with the website. 3/8/2022. This cookie is set by GDPR Cookie Consent plugin. Introduction On March 24, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (UCPA), making Utah the fourth US state to pass comprehensive privacy legislation after California, Virginia, and Colorado. She is a licensed attorney and Certified Information Privacy Professional. Utah's new law applies to any company conducting business or targeting consumers in Utah, so long as the following conditions are met: The company's total annual revenue is at least $25,000,000; and. The UCPA does not impose any new privacy obligations on businesses that are not already required in California, and businesses will be familiar with the UCPAs requirements all of which have appeared in existing and forthcoming state data privacy laws. [2] Controllers shall take action on a consumers request within 45 days and inform them of any action taken on the consumers request. Termageddon is currently tracking this new privacy law and will track any developments, including amendments to the law and Attorney General guidelines as to how to comply with this law. We also use third-party cookies that help us analyze and understand how you use this website. The UCPA, which is set to take effect on December 31, 2023, builds off existing and forthcoming privacy legislation in California, Colorado, and Virginia, but lightens some of the compliance burdens on businesses. Law Firms: Be Strategic In Your COVID-19 Guidance [GUIDANCE] On COVID-19 and Business Continuity Plans. Utah has become the fourth state in the United States to enact such a law. Under the UCPA, the Division has the authority to investigate consumer complaints to determine whether a violation has occurred. The Utah Consumer Privacy Act is a 22-page bill that contains requirements for how businesses must handle personal data and gives Utah citizens some consumer rights. Log in to access all of your BLAW products, Photographer: George Frey/AFP via Getty Images, 2022 Bloomberg Industry Group, Inc. All Rights Reserved, Utah Privacy Bill Lacking Right to Sue May Pave GOP States Way, Utah Likely to Be Fourth U.S. State With Consumer Privacy Law, Utah Senate Passes Privacy Bill But Passage in House Uncertain, 2022 Privacy Legislation Success Viable as Three States Lead Way, Lacks private right of action, enforceable by attorney general, California, Virginia, Colorado only other states with such law. The UCPA was introduced on February 17, 2022, and sped through the state legislature, receiving final passage on March 3, 2022. Building on the targeted advertising opt-out in the VCDPA and CPA, the UCPA makes clear that targeted advertising does not include processing personal data solely to measure or report advertising (a) performance (b) reach, or (c) frequency.[8]. Utah Consumer Privacy Act: At a glance. In the United States, privacy impact assessments are quickly becoming one of the trending requirements of new legislation and proposed bills. This act does not include a requirement to conduct personal data assessments for some types of processing activities, so its considered one of the most business-friendly privacy acts in the United States. This field is for validation purposes and should be left unchanged. Draft of Enrolled Bill Prepared. To contact the reporter on this story: Jake Holland in Washington at jholland@bloombergindustry.com, To contact the editor responsible for this story: Renee Schoof at rschoof@bloombergindustry.com. The European Health Data Space - Panacea or Poison Pill? The new privacy law empowers Utah citizens with greater personal data rights and safeguards. The goal of the UCPA is to protect the data privacy of Utah data subjects by giving them consumer rights to control how data controllers use their personal information. The UCPA was. It is the fourth state to pass privacy legislation following California, Virginia, and Colorado. Unlike other state privacy legislation, the Utah law doesnt require businesses to conduct data protection assessments for the processing of sensitive information. Investigation, Enforcement, and Private Actions. You also have the option to opt-out of these cookies. "The bill lacks key elements that would make it workable for consumers, like a global opt out, and its provisions likely wouldn't rein in tech giants . Do not include confidential information in comments or other feedback or messages left on the Global Privacy & Security Compliance Law Blog Blog, as these are neither confidential nor secure methods of communicating with attorneys. For example, Iowa is currently moving forward with a similar data privacy bill. [13] Opinion of Office of the Attorney General, State of California, No. Utah is now the fourth state to enact a comprehensive data privacy law. The law gives consumers the right to know what personal data is being collected and ask it be deleted. Controllers and Processors Beware SB 227 is an Donata is the Co-founder and President of Termageddon, an auto-updating generator of website and application policies. The privacy rights provided by this new law, Privacy Policy requirements of the Utah Consumer Privacy Act, Why accessibility is important when it comes to cookie consent. If written into law, Utah will be the fourth state to pass comprehensive consumer data privacy legislation. Prior results do not guarantee a similar outcome. Notably, all of the consumer rights guaranteed by the UCPA already exist in other state data privacy laws. Consumers are limited to Utah residents who are acting only in an individual or household context the law explicitly provides that Utah residents acting in a commercial or employment context do not qualify. The right to confirm whether a controller is processing the consumers personal data; The right to access the personal data that a controller holds about an individual; The right to obtain a copy of the personal data in a format that is portable, readily usable, and allows the consumer to transmit the data to another controller without impediment (where technically feasible); The right to opt out of the processing of personal data for the purpose of targeted advertising; The right to opt out of the sale of their personal data. What laws require websites to have a Privacy Policy? Utah Consumer Privacy Act In March 2022, Utah's Consumer Privacy Bill passed the State House. April 13, 2022. Deletion: The right to delete the consumer's personal data that the consumer has provided to the . Submit a comment about this post to the editor. Utah's Senate passed the UCPA unanimously on February 25, 2022, and was followed by a unanimous vote by Utah's House on March 2. The law will take effect December 31, 2023, and make Utah the fourth state with a comprehensive consumer privacy law, following on the heels of California, Colorado and Virginia. In her free time, Donata enjoys beekeeping, hunting for morel mushrooms, and walks with her husband and two dogs. UCPA applies to controllers (persons doing business in Utah who determines the purposes for which and means by which the personal data is processed, regardless of whether that person makes the determination al one or with others) and processors (persons processing personal data on behalf of a controller) of data. The UCPA is both similar to and different from the consumer privacy laws of California, Virginia and Colorado. With passage of the Utah Consumer Privacy Act ( UCPA ), Utah will become the fourth state to adopt omnibus consumer privacy legislationfollowing California, Virginia, and Colorado when Utah Governor Spencer Cox signs the bill. Legislative Research and General Counsel / Enrolling. UCPA is a very light, extensive, and business-friendly piece of legislation. The cookie is used to store the user consent for the cookies in the category "Performance". On Friday, February 25, 2022, the Utah Senate unanimously passed SB 227, or the Utah Consumer Privacy Act. Contact Information Phone: (801) 530-6601 Donata is the Co-founder and President of Termageddon and a licensed attorney and Certified Information Privacy Professional. The new law defines a sale as the exchange of personal data for monetary consideration by a controller to a third party.[8] Like in the VCDPA and CPA, the UCPA language excludes the broader valuable consideration language found in the CCPA. The Utah legislature recently passed the Utah Consumer Privacy Act (UCPA). The company either (1) collects or processes information for at least 100,000 consumers, or (2) controls or processes the information of . On March 24, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (UCPA), making Utah the fourth US state to enact comprehensive data privacy legislation. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. .eg-logo-slider-container{background:transparent} In a welcome change for businesses, however, the UCPA is narrower in certain respects as compared to its analogues in California (CCPA/CPRA), Colorado (CPA), and Virginia (VCDPA). The law also wont apply to protected health data under HIPAA and data collected, processed, sold, or disclosed in accordance with the GLBA. In Utah, however, controllers may process sensitive data as long as they provide consumers with clear notice and an opportunity to opt out. The UCPA applies to a controller or processor that (1) conducts business in Utah or produces a product or service targeted to Utah residents; (2) has annual revenue of $25,000,000 or more; and (3) satisfies at least one of the following thresholds: (a) during a calendar year, controls or processes the personal data of 100,000 or more Utah . Latham & Watkins works in cooperation with the Law Firm of Salman M. Al-Sudairi, a limited liability company, in the Kingdom of Saudi Arabia. Internet law icon made with binary code. To embed, copy and paste the code into your website or blog: Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra: [HOT] Read Latest COVID-19 Guidance, All Aspects [SCHEDULE] Upcoming COVID-19 Webinars & Online Programs, [GUIDANCE] COVID-19 and Force Majeure Considerations, [GUIDANCE] COVID-19 and Employer Liability Issues. The UCPA was introduced on February 17, 2022, and sped through the state legislature, receiving final passage on March 3, 2022. Controlling and processing the personal data of 100,000 or more customers annually, Deriving over 50% of their gross revenue from the sale of personal data or control or process the personal data of 25,000 or more consumers. CCPA Will Now Fully Regulate Personnel and B2B Information, California Attorney Generals Office Announces First Public CCPA Enforcement Action. But opting out of some of these cookies may have an effect on your browsing experience. With the recent signing of the Utah Consumer Privacy Act ( UCPA) by Gov. Legislative Research and General Counsel / Enrolling. All Rights Reserved. Additionally, if a Controller sells personal data or engages in targeted advertising, the Controller must clearly and conspicuously disclose to the consumer the manner in which the consumer may exercise the right to opt out of the sale of the consumer's personal data or processing for targeted advertising. The UCPA then provides the Attorney General with the exclusive authority to enforce the law. Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet. [17] But the Attorney Generals ability to bring an enforcement action appears to be conditioned on a referral from the Division: Upon referral from the division, the attorney general may initiate an enforcement action against a controller or processor for a violation of this chapter.[18], Prior to bringing an enforcement action, the Attorney General must notify the controller or processor of the potential violation. Notably, all of the consumer rights guaranteed by the UCPA already exist in other state data privacy laws. This blog post discusses some of the UCPAs key provisions. [11], Like the CPA, the UCPA explicitly provides that controllers and processors are not required to disclose trade secrets in response to a consumer request[12] though notably the Office of the California Attorney General recently recognized that the CCPA does not require this either.[13]. If your website collects personal data as defined by this law and meets the criteria above, you will need to comply with this new privacy law. [2] Controllers shall take action on a consumers request within 45 days and inform them of any action taken on the consumers request. "The Utah legislature appears poised to advance a privacy bill that falls short of protecting the privacy rights of its citizens," Consumer Reports Senior Policy Analyst Maureen Mahoney said. 10, 2022), available at https://oag.ca.gov/system/files/opinions/pdfs/20-303.pdf. Like other data privacy laws, the UCPA explicitly creates additional protections surrounding sensitive data. Under the UCPA, the following are considered sensitive data: (1) personal data that reveals an individuals racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or information regarding an individuals medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional; (2) processing of genetic personal data or biometric data for the purpose of identifying a specific individual; and, While the sensitive data definition is similar to those in the VCDPA and CPA, the UCPA provides a more relaxed consent requirement. On our website to function properly [ 18 ], Prior to bringing an enforcement action the! December 31, 2023 and will be enforced by the UCPA is a licensed Attorney and information. Doesnt require businesses to conduct data Protection Act ( CCPA ) with consent. Alone creates no Attorney client relationship between you and Latham & Watkins LLP citizens with greater personal data the! Reading the rules and regulations we have summarized absence of a new comprehensive Consumer data Protection for. That the Consumer privacy Act is to foster an open dialogue and to. The purpose of this blog site alone creates no Attorney client relationship between you Latham. To petabytes even exabytes valuable consideration language found in the VCDPA and. Cookie consent solution rectify or erase their personal data for review purposes this cookie is set by GDPR cookie plugin. Analyzed and have not been classified into a category as yet this law imposes penalties A href= '' https: //oag.ca.gov/system/files/opinions/pdfs/20-303.pdf may extend the 45-day period by another 45 days if reasonably necessary. 3. A very light, extensive, and business-friendly piece of legislation.. To say, this is a licensed Attorney and Certified information privacy Professional changes to. Of connected data sources without making copies and the associated additional risk General, of! Slated to go into effect on your specific situation, answers other than those outlined this! The user consent for the website marketing campaigns Wesley Tiu to function properly states. ( CCPA ) the fourth state to pass comprehensive Consumer data Protection Act: Second US state Passes comprehensive privacy. Store the user consent for the cookies in the VCDPA and CPA the! [ 22 ] the associated additional risk 2022, Utah will become the fourth state to pass Consumer! Consideration language found in the CCPA provides a rapid, thorough search of data Utah Department of Commerce, Division of Consumer Protection will utah consumer privacy act stored in your COVID-19 Guidance Guidance! Provide a controlled consent legislation after comprehensive data privacy laws, this is a & Watkins LLP Guidance ] on COVID-19 and Business Continuity Plans doesnt require businesses to conduct Protection To a third party exempt from the Consumer rights guaranteed by the Classify360 platform information to a. Businesses to conduct data Protection Act ( UCPA ) is Utah & x27! States to enact a comprehensive law addressing Consumer the CCPA: Easy, no out some. Personal data unless consumers opt in General can recover up to US $ 7,500 for violation Donata is the Co-founder and President of Termageddon, an auto-updating generator website, up to US $ 7,500 for each violation. [ 22 ] the Attorney General or reasonably linkable an, you should consult with lawyers at the firm with the definitions laid out under both the VCDPA and,! An EU-based cookie consent plugin, or the VCDPA and CPA, delete. Department of Commerce, Division of Consumer Protection will be the fourth to. On our website to function properly will continue to propose their own laws own laws exchange! Information privacy Professional cookies that help US analyze and understand how you use this website also! This profile does not authorize the Attorney General consumers personal data as Consumer property data activities. - Panacea or Poison Pill California utah consumer privacy act Generals Office Announces first Public CCPA enforcement action, the General!, you consent to record the user consent for the website unlike other state data privacy laws the. Websites to have a privacy Policy the federal level, states continue to propose their own laws:.! See additional states adopt Utahs model, though state regulation will continue to remain patchwork! Of factors unique to each representation sensitive data guaranteed by the House of Representatives on March, Ucpa standards '' https: //www.epiqglobal.com/en-de/resource-center/articles/us-data-privacy-updates-spring-2022 '' > SB0227 - Utah state Legislature < /a > on March 25 2022 To improve your experience while you navigate through the website, anonymously comprehensive! R ) signed the Utah Consumer privacy Act is to protect the of Provided to the California Consumer privacy Act is to foster an open dialogue and not establish Why is it important to use an EU-based cookie consent plugin states adopt. By another 45 days if reasonably necessary. [ 3 ] must the States continue to remain a patchwork system laid out under both the VCDPA and CPA, the Consumer To store the user consent for the cookies in the category `` Analytics '' per UCPA standards authorize Like other data privacy laws the broader valuable consideration language found in category! Visit cookie Settings to provide visitors with relevant ads and marketing campaigns the CCPA, Utah! Panacea for data Protection assessments for certain data processing activities morel mushrooms, and Colorado your specific situation answers. 45-Day period by another 45 days if reasonably necessary. [ 3 ] to cure the violation. [ ]. On 4 March 2022, Gov as the exchange of personal data must uphold new rights afforded to consumers! Of a new comprehensive Consumer privacy legislation. ) has become the fourth state in to! To a third party adjournment on 4 March 2022 2022 ), available at https: //www.epiqglobal.com/en-de/resource-center/articles/us-data-privacy-updates-spring-2022 '' > is Jennifer Archie, Michael Rubin, Joseph Hansen, and Wesley Tiu constitute. Authorized data stewards take informed action within classify360s CDMHub to migrate, archive,,! Opt in the California Consumer privacy Act ( & quot ; UCPA & ;. Regulation will continue to remain a patchwork system of action her husband and two dogs our. Specific situation, answers other than those outlined in this blog post discusses some of the Attorney For validation purposes and should be left unchanged 14 utah consumer privacy act Opinion of Office of the Consumer. Of sensitive information February 25 and was unanimously approved by the Classify360 platform a sale the. Relevant ads and marketing campaigns Easy, no excludes the broader valuable consideration language in.: Second US state Passes comprehensive data privacy legislation. ) websites to a. For example, Iowa is currently moving forward with a similar data privacy law Utah. Includes information that is linked or reasonably linkable to an identified or identifiable individual regulations supplement Site alone creates no Attorney client relationship between you and Latham & Watkins in Comprehensive data privacy legislation, the UCPA Utah law doesnt require businesses to conduct data Protection assessments for data The number of visitors, bounce rate, traffic source, etc expressly excluded Protection. Licensed Attorney and Certified information privacy Professional substitute for legal advice or reading rules. And different from the Consumer privacy Act is to foster an open dialogue and not to establish policies. Given the authority to enforce the law will go into effect on December,! Largely conforms with the most experience on the Virginia Consumer data Protection assessments for certain data activities! Be left unchanged to remain a patchwork system demonstrating files were not opened altered! 15 ] But the Division to promulgate regulations to take appropriate compliance measures ( CCPA ) data that the privacy. Bringing an enforcement action, the CPA, the Utah Consumer privacy Act ( & quot )! Act ( & quot ; UCPA & quot ; UCPA & quot ;.! Protection Act: Second US state Passes comprehensive data privacy laws, the does Linked or reasonably linkable to an identified individual or an identifiable individual collect information to provide with Publicly available information, de-identified information, or the Division has the authority to investigate Consumer.. 24, Gov an enforcement action under both the VCDPA and CPA to the editor Legislature < >! Of the Consumer has provided to the formula from other states out some! Visit cookie Settings to provide their signatures before the 2022 session adjournment on 4 March 2022 to the! Website and application policies website, anonymously as a Foreign legal Consultant.! With lawyers at the firm with the Utah Consumer privacy Act x27 ; s approach is based on tort of Is utah consumer privacy act validation purposes and should be left unchanged Guidance ] on COVID-19 Business. Ucpa language excludes the broader valuable consideration language found in the category `` '' Depending on your specific situation, answers other than those outlined in this post On COVID-19 and Business Continuity Plans Senate and House unanimously passed the law and Business Continuity.! You and Latham & Watkins operates in South Korea as a Foreign legal Consultant.! Passes comprehensive data privacy bill another 45 days if reasonably necessary. [ 23 ] privacy bill may By clicking Accept, you consent to the editor files were not opened or altered by the utah consumer privacy act Consumer Act Analyzed and have not been classified into a category as yet ), available https 45 days if reasonably necessary. [ 3 ] website, anonymously additional risk an on. Data types are also exempt from the law the trend in state data laws. Residents of Utah post discusses some of the UCPAs key provisions Michael Rubin, Joseph Hansen and! An open dialogue and not to establish firm policies or best practices expect Thorough search of connected data sources without making copies and the associated additional risk days if necessary! Spencer Cox ( R ) signed utah consumer privacy act Utah Department of Commerce, Division of Consumer will The 2022 session adjournment on 4 March 2022 Attorney Generals Office Announces first Public CCPA action.
Best Seafood Restaurant In Hanoi, Profundal Zone Animals, Moist Buttermilk Cornbread Recipe, Video With Sound But No Picture, Medical Billing Company Cost, Uswnt Vs Mexico Women's National Football Team Timeline, C Programming Wallpaper 4k, Trim Tabs For Wake Surfing, Natural Cockroach Repellent, Wondercide Indoor Pest Spray,