Utah Businesses Should Beehive Or Get Stung

Utah, the forty-fifth US state is famed for its University and the basketball team the Utah Jazz. However, there are many unusual legal requirements in the State including:

• the ban on fishing whilst riding a horse
• hunting whales
• playing trombones in the street to attract the attention of potential auction customers
• The capital city of the State of Utah is Salt Lake City which hosted the Winter Olympics in 2002. However, Salt Lake City also has some ‘curious’ legal requirements. For example, Utah citizens cannot possess a bag constructed from paper with a violin inside it…No…me neither?... Answers on a postcard folks…

However, this is not the only law Utah has enacted. In late March 2022, the State announced that it had enacted new data protection legislation, the Utah Consumer Privacy Act.

What Effect Do The New Rules Have?

The newly enacted legal rules are a country-wide set of rules which intend to provide meaning to the respective words ‘Processors of Personal Data’ and ‘Controllers of Personal Data’ in the State of Utah. In more granular detail if businesses wish :

• gather
• process and
• collate

the sensitive and private information which on an independent judgment is capable of identifying a constituent registered and living in the State, the new law imposes legal duties upon such affected businesses to do all they can to meet the exacting standards of the new rules.

The new rules will apply to sensitive information which can be connected to an identifiable person. They also require by law affected parties to enter into written agreements as to what data is processed which are loosely based upon Article 28 of the General Data Protection Regulation.

What Is The Direction Of Travel? It Isn’t Part Of a Trend Is It?

In the Beehive State, the new legal requirements appear to shift the sands in this area of law in favour of the Data Subject. Constituents in the State of Utah will now be given their voice and in this regard have a greater say over how their data is collected up, processed, and assorted by affected companies. Whilst this new legislation exclusively applies to the State of Utah, it appears to be part of a much wider trend and in line with the data protection legislation which has been introduced in eastern US states of Colorado, California, and Virginia. Colorado will bring into force the Colorado Privacy Act on 1st July 2023, Virginia will introduce it imminently on 1st January 2023 in the form of the Virginia Consumer Data Protection Act and, California enacted the widely known California Consumer Privacy Act 2020.

In stark contrast to the legislation in the three aforementioned states, the Utah legislation includes a mechanism that comes into play if the following three conditions are met:

• if an affected party carries on commercial activity such as making products or providing service to constituents of Utah; and
• controls or processes sensitive information belonging to a large proportion of its customers and
• over £20,250 yearly revenue.

What Do Lawyers Need To Be Advising Clients?

If parties are located in Utah lawyers need to be advising clients to:

• check the legal position related to controllers and processors of personal data and if the mechanism is triggered
• make parties aware that such legislation will be brought into force in 2023 and
• ensure affected parties are in the best state of preparedness to avoid getting stung in the Beehive State.

ASSESSING FIRMS

#bakermckenzie #dlapiper #hoganlovells #huntonandrewskurthllp #morrison&foerster #orrickherringtonsutcliffe #venable #bakerhostetler #cooley #covingtonanburling #debevoise&plimpton #dechert #kelleydrye&warren #latham&Watkins #mayerbrown #reedsmith #steptoe&johnson #wilmerhale

THE ARTICLE WAS WRITTEN USING THE FOLLOWING SOURCES

[1] Lehnardt, Karin – 55 Interesting Utah Facts – Fact Retriever - 20 August 2016 - 55 Utah Facts that Will Surprise You | Fact Retriever

[2] Faragasso, Melissa – Businesses Buzzing With Utah News of Utah’s New Comprehensive Privacy Law – Cleary Gottlieb - 25 March 2022 - Businesses Buzzing With News of Utah's New Comprehensive Privacy Law | Cleary Cybersecurity and Privacy Watch (clearycyberwatch.com)

[3] Colorado Privacy Act

[4] Virginia Consumer Data Protection Act

[5] General Data Protection Regulation

[6] California Privacy Rights Act 2020

[7] Article 28 General Data Protection Regulation

[8] Omnibus Privacy Law definition – Law Insider - Omnibus Privacy Law Definition | Law Insider