Instead, they're required to provide a clear notice and an opportunity to opt-out. Prior to initiating any action against a controller or a processor, the attorney general will issue a notice of violation explaining the provisions that are violated. Danica advises clients on data privacy and security issues relevant to buying or selling a company, data usage and rights, advertising and marketing, performing gap and risk assessments, and planning cybersecurity incident response. Despite these remaining hurdles, the bill is widely expected to become the fourth comprehensive state consumer privacy law in the United States and the first such bill to become law in 2022. 14 Sensitive data is defined as personal data related to racial origin, religious belief, sexual orientation, citizenship or immigration status, mental or physical health condition, etc. Where the Semiconductor Chips Will Fall: What Manufacturers Need to Know About Are You Ready? The U.S. lacks a comprehensive federal privacy law, but Democratic-controlled state legislatures in California, Virginia and Colorado have passed broad measures in recent years. Although many of the protections are similar to the other states' laws, Utah's new bill, if enacted, will potentially have a narrower scope. The passage of the UCPA may influence more states to pass similar data privacy laws. It contains similar definitions for a "controller" and "processor" as those found in the Colorado and Virginia laws. Spencer J. Cox on March 24, 2022, Utah has become the fourth state to enact a comprehensive law addressing consumer data privacy, joining California, Colorado and Virginia. Under the Utah Consumer Privacy Act, consumers within the state are entitled to the following data protection and personal privacy rights: The right to be informed of the collection and processing of their personal data. 131 (6) (a) "Consumer" means an individual who is a resident of the state acting in an 132 individual or household context. Additionally, organizations should conduct a current state assessment against the new state obligations to identify any compliance gaps and develop a roadmap of future activities to address compliance gaps and operationalize new requirements. The law requires the controllers to follow certain requirements as outlined below: The attorney general has the exclusive authority to enforce the law. It regulates how a controller (defined by the UCPA as a person doing business in Utah who determines the purposes and means by which personal data are processed) processes personal data concerning consumers residing in Utah. 8 Consumer Privacy Act, State of Utah. Like other laws, the Utah Consumer Privacy Act allows consumers to opt-out of the use of their information for certain purposes, including targeted advertising and the sale of personal information. Passing a comprehensive state privacy law has proven to be no small task. NLRB General Counsel Abruzzo Issues Memo on Employer Surveillance in 2022 Labor and Employment Tri-State Legislative Update: CT, MA, and RI. As explained below, that distinction is more than just a difference in diction: it . March 8, 2022 The Utah Consumer Privacy Act ("UCPA" or the "Act") is on its way to the Governor's desk. The controller is the one who determines the purpose and means of processing, while the processor is the one who processes the personal data on behalf of the controller. UCPA will only apply to businesses who: (1) conduct business in Utah or provide a product or service directed at Utah residents; (2) have an annual gross revenue of over $25 million; and, UCPA separately defines "sensitive information" and provides consumers the right to opt-out of the processing of their sensitive data, which differs from the other state privacy laws that require consumers to opt-in to such processing. 1 Consumer Privacy Act, State of Utah. On March 24, Gov. The attorney general may request consultation from the Division. Unconstitutional Self-Actualizing, Perpetual Funding Mechanism May California Offshore Wind Lease Sale Announced by Bureau of Ocean Colorado AG Publishes Draft Colorado Privacy Act Rules, Significant Developments for the US Offshore Wind Energy Industry. The Act cleared the State Senate on February 25 and was unanimously approved by the House of Representatives on March 2. A piecemeal approach to data privacy based on individual regulatory requirement will only compound the difficulty. The right to rectify or erase their personal data. US Privacy Regulations and How US Financial Institutions are Operationalizing Them, Virginia Aims to Protect Consumer Data with Passage of Virginia Consumer Data Protection Act, Association for Data and Cyber Governance Article, Your Digital Future is Now: How Financial Institutions Can Reevaluate Digital Portfolios to Stay Ahead, The Shared Responsibility Approach for Risk Mitigation, Your Business is Only as Strong as its Weakest Link: Why Business Resiliency is Top of Mind for Financial Institutions, Supply Chain Illumination Strengthens Critical Platform. The right to obtain copies of any personal data they previously . And unlike the CCPA/CPRA and CPA, the UCPA does not include provisions on dark patterns.. Utah's privacy law is unique in that controllers don't need to obtain opt-in consent to collect and process sensitive data. Terminology Like the CPA and CDPA, the UCPA generally uses the GDPR's terminology of controller, processor, and personal data. Cost of Living Crisis Causes Rise in Financial Crime. Rather, the state attorney general enforces the law. Code 1798.140. After the 30-day cure period, if a controller or processor remains in breach, the Utah Attorney General could seek to recover actual damages to the consumer and up to $7,500 for each violation. 5 Consumer Privacy Act, State of Utah. These rights, however, are limited by reasonable business-use exemptions, such as detecting fraud and complying with a companys legal obligations. Specifically, the UCPA's provisions regarding "sensitive data" will not apply to information that reveals racial or ethnic origin when processed by a video communication service, which the UCPA does not define, or certain healthcare workers. Importantly, a company may not penalize a consumer for exercising a right by denying service, charging different prices, or providing a different level or quality of service. Her practice area also focuses on technology, data privacy and cybersecurity, as well as transactional and regulatory matters for clients across industries. The UCPA applies only to controllers or processors that (1) do business in the state (or target Utah residents with products or services); (2) earn at least $25 million in revenue; and (3) either: (a) control or process personal data of 100,000 or more consumers (defined as a Utah resident) in a calendar year; or (b) derive more than 50 percent . With passage of the Utah Consumer Privacy Act ( UCPA ), Utah will become the fourth state to adopt omnibus consumer privacy legislationfollowing California, Virginia, and Colorado when Utah Governor Spencer Cox signs the bill. The law does not provide for a private right of action. The Utah Consumer Privacy Act ("UCPA") provides for consumer rights and responsibilities for controllers and processors. The UCPA will take effect on December 31, 2023. CONSUMER PRIVACY RIGHTS AND SENSITIVE DATA. Jackie Klosek Utah's Senate unanimously passed the UCPA on February 25. Longtime readers will recognize the close kinship between the UCPA and Virginia's and Colorado's privacy laws. Spencer J. Cox on March 24, 2022, Utah has become the fourth state to enact a comprehensive law addressing consumer data privacy, joining California, Colorado and Virginia. If written into law, Utah will be the fourth state to pass comprehensive consumer data privacy legislation. Spencer Cox signed the Utah Consumer Privacy Act (" UCPA "). The Utah Consumer Privacy Act (UCPA) was signed into law by Governor Spencer Cox on March 24th, 2022, joining a growing list of U.S. states with comprehensive . Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials. With the recent signing of the Utah Consumer Privacy Act ( UCPA) by Gov. The Utah Consumer Privacy Act (UCPA) was signed into law on March 24, 2022 and is scheduled to take effect on December 31, 2023. The National Law Review - National Law Forum LLC 3 Grant Square #141 Hinsdale, IL 60521 Telephone (708) 357-3317 ortollfree(877)357-3317. The Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTDPA) was signed into law on May 10, 2022 and is scheduled to take effect on July 1, 2023. The Division can take administrative action against companies that have violated the law, however, the Division cannot act as your private attorney. The new law also contains specific requirements for companies that want to collect sensitive data (such as information about an individuals race or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, medical information or treatment information, genetic or biometric data, or specific geolocation data). Companies must publicly post a privacy notice that contains the following information: Additionally, if the company sells personal data or engages in targeted advertising, it must clearly inform the consumer that they have a right to opt out of either use of their information. By Kyle Fath, Kristin Bryan & Gicel Tomimbang on March 25, 2022 Posted in Compliance, Data Privacy, Utah The Utah Consumer Privacy Act ("UCPA") was signed into law by Governor Spencer J. Cox yesterday. The company may also charge a reasonable fee to process the information in certain situations, such as if it believes the request is unfounded or excessive, it is a second request made within a 12-month period, or the company believes the primary purpose is for something other than exercising their consumer right. The Utah Consumer Privacy Act ( SB 227) unanimously passed the Utah Senate on February 25. Parting Advice: Judge Drain Rules That Dividends Paid From the Proceeds of Safe- Value-Based Care Conference 2022: Hot Topics and Trends, 2022 West Coast Forum - Beverly Hills, CA, Mitigating Title IX Liability in Athletic Fundraising Policies and Procedures, Trade Secrets, Restrictive Covenants, and No-Poach Agreements in Health Care. Civ. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. Although the bill generally tracks the comprehensive privacy law passed in Virginia last year, the VCDPA, there are some notable differences. Enrolled Bill Returned to House or Senate. Regarding enforcement, the burden will fall upon Utah's AG to pursue actions referred by the Division of Consumer Protection (which is within the Utah Department of Commerce), the body tasked with investigating potential violations of the law. Utah recently passed the Utah Consumer Privacy Act, which will go into effect December 31, 2023. Boris Segalis Heightened Scrutiny of Director Positions By FERC AND DOJ, FDA Updates Manufactured Food Program Standards, Joint Advisory Outlines Attacks by Daixin Team. (t)(2)(C); 1798.145. David P. Saunders (CIPP/US, CIPM) is an experienced litigator who focuses his practice on privacy and cybersecurity matters. While Utah privacy law closely tracks that of Virginia and other state privacy laws in general, Utah takes a unique approach with respect to consumer UCPA violation claims. However, instead of following the Virginia/Colorado model and requiring opt-in consent for the collection and processing of sensitive information, the Act would require businesses to provide notice and an opportunity to opt out of the use of sensitive data. The UCPA provides certain exceptions where a controller may deny a consumer request; however, the burden of demonstrating9that the request falls under such exceptions is on the controller. Applicability of the law Utah has joined the ranks of Colorado, California and Virginia after Governor Spencer Cox signed the Utah Consumer Privacy Act ("UCPA") on March 24, 2022. Consumer Rights Under the new legal framework, Utah residents are granted the following six categories of rights: National Law Review, Volume XII, Number 63, Public Services, Infrastructure, Transportation. Sensitive data includes information about racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, health and medical treatment or conditions, biometric or genetic data used to identify individuals, and geolocation data. The UCPA is the least onerous of the four state data privacy laws passed to date. 7 Consumer Privacy Act, State of Utah. 12 Consumer Privacy Act, State of Utah. Bill Received from Senate for Enrolling. The UCPA applies to for-profit entities ("controllers" or "processors") that (1) conduct business in Utah or target products and services to consumers who are residents of the state, (2) have annual revenues of at least $25 million, and (3) meet one of two threshold requirements: The law exempts certain types of data and entities, including publicly available data, de-identified data, and data subject to the Health Insurance Portability and Accountability Act, the Driver's Privacy Protection Act, and the Family Education Rights and Privacy Act. He counsels clients on a wide range of topics, including consumer protection law, cross-border data flows, and data breach response and prevention. If a company uses a third party to help them process consumer data, it must enter into a contract with that third party. The Acts applicability would make it narrower than any currently enacted state privacy law to date. A business in compliance with California, Colorado, and Virginia's laws should have no issue meeting the UCPA's deadline of December 31, 2023. State Voting Leave Requirements: A Refresher in Preparation for the How Colleges, Universities Can Prep for U.S. Supreme Courts DHS Again Extends I-9 Compliance Flexibility, Also Proposes Framework CFTC Whistleblower Report Reveals Tremendous Success for Taxpayers. Heads Up: Defendants Deserve Fair Notice of Preliminary Injunctions, New Law Changes Non-Compete Landscape for D.C. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional. The Division of Consumer Protection (Division) within the Department of Commerce will accept complaints related to the alleged violation of the law. Client strengthens the delivery and development of critical maritime platform. EPA Provides Report to Congress on Its Capacity to Implement Certain SEC Adopts Amendments Requiring Electronic Filing of Forms 144. In The Zone? The right to delete their own personal data provided to a controller. Main Menu. The categories of third parties with whom the controller shares personal data (if any). So bereiten sich Arbeitgeber auf die elektronische New Employment Law Requirements for Companies with US-Based Employees. HAPPY OTSA DAY! Controllers determine why and how personal data is processed, while processors process personal data on behalf of a controller. And as with other state laws, the Act contains broad exceptions for certain entities and data categories, including higher education institutions, nonprofits, and information and entities regulated by both the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA). It is unclear whether another new comprehensive state privacy lawan added layer to the current patchwork of privacy laws in the U.S.will create any momentum for Congress to pass a federal privacy law, but the activity certainly remains at the state level for now. The scope of the UCPA is narrower than that of the VCDPA, California Consumer Privacy Act (and as amended, the California Privacy Rights Act) (collectively, the CCPA/CPRA), and Colorado Privacy Act (CPA). Importantly, the law defines consumers as residents of Utah acting in an individual or household context. 6 Consumer Privacy Act, State of Utah. Fall Back: Westchesters Pay Transparency Law Takes Effect on Where the Semiconductor Chips Will Fall: What Manufacturers Need to Are You Ready? Utah is the fourth U.S. state to adopt a consumer privacy law, preceded by California, Virginia and Colorado. Bankruptcy; Business Law; Cannabis; Civil Rights; Consumer Protection Applicability No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other . The UCPA is both similar to and different from the consumer privacy laws of California, Virginia and Colorado. The categories of personal data processed; The purposes for which the personal data is processed; The categories of personal data shared with third parties (if any); and. 3/8/2022. OBLIGATIONS OF CONTROLLERS AND PROCESSORS, FAMILIAR TRANSPARENCY AND SECURITY REQUIREMENTS, The UCPA requires controllers to provide consumers with a privacy policy that includes similar disclosures as required under the other state frameworks. Following the lead of California, Colorado, and Virginia, Utah is set to become the fourth state to pass a comprehensive privacy law. Failure to comply could cost businesses up to $7,500 per violation plus the actual damage to the consumer. Controllers and processors must enter into a written contract that sets out the details of processing, such as the personal data to be processed, the purpose of processing, and the parties' rights and obligations. That contract must require the third party to keep information confidential and set forth the processors obligations and responsibilities for safeguarding the information and the purpose of processing the information. Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. If the director of the Division of Consumer Protection has reasonable cause to believe that substantial evidence exists that the business is in . Controller A (EEA) Processor Z (EEA) Employee of Processor Z (Non PTO Extends Deadline for Comments on Initiatives to Ensure Patent With Election Day Around the Corner, Employers Need to Remember You Puerto Rico Publishes Model Protocol for Expanded Sexual Harassment Podcast: Post-Dobbs Navigating the Fast-Changing and Uncertain Health Care and Life Sciences Practice Group. The UCPA also does not apply to personal data of employees or business contacts, de-identified or pseudonymous data, aggregated data or publicly available information. During law school, Cathy was editor-in-chief for theAmerican Intellectual Property Law Association Quarterly Journal You are responsible for reading, understanding and agreeing to the National Law Review's (NLRs) and the National Law Forum LLC's Terms of Use and Privacy Policy before using the National Law Review website. The attorney general may not take action if the violation is cured within 30 days. On March 3, 2022, the Utah House of Representatives unanimously passed a consumer privacy bill which the Utah Senate passed earlier this year. Ninth Circuit Takes Broad View of Protected Activity under the NLRB GC To Urge Board to Regulate Electronic Worker Monitoring and Outside the Beltway of Health Care - Episode 21 [PODCAST], Key Terms and Conditions for Buyers and Sellers in the Supply Chain. Under the new law, consumers have the following rights: To exercise these rights, the consumer must submit a request to the company. Destroyed: FTC Levels Incredible $100 Mm Penalty Against Vonage for Bidens Executive Order Implementing New EU-U.S. Data Privacy Connecticut Joins the Interstate Medical Licensure Compact and the More Autonomous Big Rigs Needed on the Road: Why Start There?