On March 4, 2022, the Utah legislature joined several other states in passing a consumer privacy law, the Utah Consumer Privacy Act (“Act”). Once signed by the governor, as is expected, the Act will become effective December 31, 2023. The Act creates a right for consumers to access and delete personal data maintained by certain businesses and to opt out of the collection and use of personal data for certain purposes. The Act also requires businesses that control and process consumer’s personal data to provide information regarding how a consumer’s data is used and to accept and comply with a consumer’s request to exercise rights under the Act.
The Act does not create a private right of action for consumers, only the Utah Attorney General may enforce the Act. The Act applies to controllers and processors. A controller is defined as a person doing business in Utah who determines the purposes for which and the means by which personal data is processed, regardless of whether the person makes the determination alone or with others. Processor is defined as a person who processes personal data on behalf of a controller. Read More