This week, the Utah legislature passed the Utah Consumer Privacy Act (SB 227). If enacted by Governor Spencer Cox, Utah will follow California, Virginia, and Colorado as the fourth U.S. state to establish a baseline regime for the protection of personal data. The law would come into effect in December 2023.
“While the Utah Consumer Privacy Act would create some new rights for Utah residents, it contains significantly fewer privacy protections than leading state frameworks. A national comprehensive law that sets strong baseline standards will be the only way to ensure that geography doesn’t determine individuals’ basic privacy rights.”
Statement by Keir Lamont, Senior Counsel, Future of Privacy Forum
The Utah Consumer Privacy Act shares a similar structural framework for protecting personal information as legislation enacted in Virginia and Colorado. As such, it would be unlikely to introduce significant new compliance challenges for businesses that are already preparing for those laws, which come into effect in 2023.
However, Utah’s law would set significantly narrower individual rights and business obligations than privacy regimes enacted in other states.
Individual Rights: The Act would create new rights for Utah consumers to access their information and delete personal data previously provided to a business. It would also provide individuals with the ability to opt-out of the processing of personal data for targeted advertising and sales. Diverging from existing state privacy laws, the Act lacks a right to correct inaccurate personal data or to opt-out of significant profiling decisions. Finally, unlike Virginia and Colorado, the