Utah Passes Comprehensive Privacy Law

Why This Privacy Law is Important:

Utah has acted very quickly to enact its comprehensive state privacy law, with SB 227, the Utah Consumer Privacy Act (UCPA) passing unanimously in both legislative chambers in the state within a week. The quick passage of the law, which shares similarities with the Colorado Privacy Act (CPA) and Virginia Consumer Data Protection Act (VCDPA), demonstrates a growing consensus around the fundamentals of consumer data protection and privacy rights in the US.

Overview:

After unanimously passing in the Senate (28-0 on Feb. 25, 2022) and the House (71-0 on Mar. 2, 2022), Governor Spencer Cox signed the bill into law. Utah has joined California, Colorado, and Virginia as states that have passed comprehensive privacy laws. The law sets similar standards to the CPA and VCDPA, granting consumers (rather than employees or applicants covered under the California Privacy Rights Act, or CPRA) certain rights.
Compared to other state privacy regulations, the UCPA’s regulations are fairly straightforward and not overly stringent toward the businesses it regulates, creating what its sponsor, Sen. Kirk Cullimore, called “a workable standard for businesses and clarity for Utah consumers.”

Who it Applies to:

The criteria for businesses to be regulated by this bill include:

• Earning revenue greater than $25 million per year
• Holding personal data on more than 100,000 Utah residents
• Deriving half their revenue from selling data related to more than 25,000 Utah residents

The UCPA does not apply to government agencies, businesses already covered under HIPAA, or other federal privacy legislation. These criteria will likely be met by fewer organizations than some other recent state privacy laws.

Download the Privacy Alert to the right to get the full text and expert analysis!