Most businesses understand how GDPR and CCPA reshaped policies and processes around customer data, but state privacy compliance continues to expand.
The Utah Consumer Privacy Act, which took effect on March 24, 2022, adds another layer to evolving state privacy compliance obligations.
While UCPA shares similarities with laws in states like California, it introduces distinct considerations for businesses that collect or share Utah residents’ personal information.
Navigating these requirements can be complex, especially as state privacy compliance standards continue to develop.
If your business collects customer data from Utah residents, understanding UCPA requirements is essential to maintaining state privacy compliance.
This blog post breaks down UCPA into clear, practical terms so you know exactly what your business must do to stay compliant.
Overview of the Utah Consumer Privacy Act
The Utah Consumer Privacy Act (UCPA) was passed on March 24, 2022, and it will take effect on December 31, 2023. UCPA is a comprehensive privacy law that regulates the collection, use, disclosure and sale of information about Utah residents. It requires companies to provide notice to customers about their data use practices and provide them with access to their own information. The act also provides consumers with a right to opt-out of certain types of data use and gives them the right to seek damages from companies that have violated their privacy rights.
Who Needs to Comply With the UCPA?
Businesses that are defined as controllers or processors under the UCPA have to comply with the regulations. and,
- You do business in Utah or sell your goods or services to Utah residents.
- You have a minimum annual revenue of $25 million.
- You process or control personal data for at least 100,000 customers or 25,000 customers if the company earns more than half of its revenue from selling personal data.
Key Requirements of the Utah Consumer Privacy Act
- Companies must provide a clear notice to consumers about their data use practices. This includes information regarding the types of personal data being collected, how it is used, with whom it is shared, whether or not it is sold, and whether or not the company provides access to the data.
- Companies must provide consumers with a way to easily exercise their opt-out rights.
- Companies must give consumers the right to access, delete and correct any personal data collected about them.
- Companies must securely store customer information and protect it from unauthorized use or disclosure.
- Companies must provide customers with a way to submit complaints regarding the misuse of their personal data.
- Companies must implement reasonable security measures to protect customer data, including encryption and other safeguards.
- Companies must comply with all regulatory requirements regarding the collection, use, disclosure and sale of information about Utah residents.
- Companies must provide appropriate training to its employees on their responsibilities under UCPA.
What are the exemptions under UCPA?
UCPA provides some exemptions for companies under certain circumstances. These include:
- Non-profit organizations
- financial institutions supervised by the GLBA
- institutions of higher education
- Entities and business covered by the Health Insurance Portability and Accountability Act
- Indigenous tribes
- air carriers
Data-level exemptions:The UCPA does not apply to information covered by HIPAA, GLBA, the Fair Credit Reporting Act, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act, or the Farm Credit Act. Data processed or retained in the course of employment, including job candidate data, is also exempt.
Consumer rights under the Utah Consumer Privacy Act
- The Right to Know: Consumers have the right to know what personal data a business is collecting, why and how it is being used, if it is sold or shared with third parties, and whether any automated decisions are being made about them.
- The Right to Access: Consumers have the right to access their own personal data and understand how it is being used.
- The Right to Opt-Out: Consumers have the right to opt-out of certain types of data use such as the sale of their personal information.
- The Right to Delete: Consumers have the right to request that businesses delete any personal data collected from them..
- The Right to Rectification and Correction: Consumers have the right to rectify any inaccurate personal data.
- The Right to Avoid Discrimination: Companies are prohibited from discriminating against consumers that exercise their privacy rights.
Examples of sensitive data as defined by the UCPA
- citizenship or immigration status
- medical history
- racial or ethnic origin
- sexual orientation
- religious beliefs
- biometric or genetic data
Privacy Notification and Privacy Policy Requirements
The controller is required by the UCPA to provide consumers with a properly accessible, noticeable, and clear privacy notice. The following information must be included in privacy notices:
- The types of personal data processed by the controller
- The goal of data processing
- How consumers can exercise their opt-out rights if their personal data is transferred to a third party or used for targeted advertising of personal data shared with third parties
- third parties which the controller may share personal information
How to Prepare Your Business for Compliance with Utah Consumer Privacy Act
1. Review Your Data Collection and Processing Practices
Take an inventory of the types of personal data you collect, how it is used, who has access to it, and whether or not it is disclosed or sold.
2. Update Your Privacy Notices and Policies
Make sure your privacy notices and policies are up-to-date with the required information about data collection and use.
3. Train Your Employees
Ensure your employees are aware of their responsibilities under UCPA and that they understand how to handle consumer requests for access, deletion and opt-out rights.
4. Create an Opt-Out Mechanism
Create a system where consumers can easily exercise their opt-out rights.
5. Implement Security Measures
Put in place appropriate safeguards to protect customer data, such as encryption and other security measures.
6. Update Your Contractual Relationships
Ensure that any third parties you work with (e.g., vendors, service providers) also comply with UCPA when they are accessing or processing your customers’ personal data.
7. Review Your Exemptions
Confirm that any information you collect and process is exempt from UCPA, such as employment-related data or information subject to HIPAA, GLBA, FCRA, DPPA or FERPA.
8. Monitor Regulatory Updates
Stay up-to-date with the latest developments and changes to the UCPA, as well as other applicable privacy laws.
9. Review Your Data Retention Policies
Evaluate how long you are retaining personal data and ensure that it is being securely deleted when no longer required.
10. Get Professional Advice as Needed
Seek professional advice if you have any questions or need additional guidance on how to best comply with UCPA.
Penalties and Fines Under the UCPA
The attorney general of Utah has complete enforcement responsibility over UCPA compliance and fines. The Division of Consumer Protection, on the other hand, is responsible with the management of consumer complaints and has investigative powers examining the merits of claimed violations under the Act.
This includes Actual losses suffered by the consumer as a result of the business’s violation of the law and also a maximum fine of $7,500 per violation.
Ultimately, UCPA compliance is crucial to ensure that businesses are not subjected to any of these penalties. Businesses should take all necessary steps to ensure they are compliant with the UCPA. Failure to do so could result in costly fines and potential legal action by the Attorney General or consumers. Therefore, businesses should take proactive steps to review their practices related to data collection, and ensure that they comply fully with all relevant privacy laws, including the Utah Consumer Privacy Act.Â
