In 2022, Utah enacted a consumer personal data statute called the Utah Consumer Privacy Act (“UCPA”). Utah Code § 13-61-101, et seq. The UCPA took effect at the end of 2023 and now, covered businesses must be in full compliance.

The UCPA is enforced through Utah’s Attorneys’ General’s Office, and consumers are not allowed to file personal lawsuits for alleged violations of the Act by businesses. Complaints by consumers can be filed with the Utah Division of Consumer Protection, which conducts investigations. From there, the Attorney General may take enforcement actions. The UCPA requires that businesses be given a 30-day “cure” opportunity before any penalty can be imposed. Civil fines can be imposed of up to $7,500 per violation.

The UCPA is similar to other consumer privacy statutes in the U.S. That is, consumers are given certain rights vis-a-vis the businesses that collect and process their personal data. For example, consumers have a right to be given notice of certain information prior to having their data collected. This information includes the right to know:

• The categories of personal data collected and processed
• The business purposes for which the data is collected and processed
• Methods that consumers can use to exercise their rights under the UCPA
• What categories of personal data the controller shares with third parties
• What types — categories — of third parties does the business share/sell personal data to?

Further, the UCPA gives consumers the right to demand certain actions be taken by the businesses collecting their personal data. These include the rights:

• To access their personal data — that is, the right to know if data is being collected/processed and what the data is
• To request that a business delete their personal data — but this only applies to data specifically provided by the consumer to the business (not personal data obtained through other means)
• To obtain a copy of their personal data in a portable format
• To opt out of having their sensitive data sold or used for targeted advertising without prior consent
• To have inaccurate data corrected

Businesses must provide a method or process for consumers to exercise these rights. That is, consumers must be able to contact businesses and make allowable requests. The UCPA gives businesses up to 45 days to respond to any request (though more time can be taken if the business explains why more time is needed). Businesses cannot charge for responding to these requests and cannot discriminate or retaliate against a consumer for exercising rights under the UCPA. Unlike other statutes, there are no mandated appeal procedures if the business fails or refuses to respond to a request. In those cases, the consumer must file a complaint with the Utah Division of Consumer Protection.

Contact the Consumer Data Privacy and Compliance Attorneys at Revision Legal

For more information, contact the experienced Consumer Data Privacy and Compliance Lawyers at Revision Legal. You can contact us through the form on this page or call (855) 473-8474.