Crawls the web, in Utah

Utah Code 13-44-201 · Read the law's page

• This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
• Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.
• There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.

Utah Code 78B-4-701 to 78B-4-704 · Read the law's page

• This is a defense available to any person sued in Utah on a claim arising from a breach of system security; it creates no independent duty to adopt a cybersecurity program, and under section 78B-4-704 may not be construed to create a private cause of action, including a class action, for failing to comply with it.
• To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.
• Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.
• Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.
• The defense is unavailable if you had actual notice of a threat or hazard to the information's security and did not act in a reasonable amount of time to take known remedial efforts before it resulted in the breach; a risk assessment to improve security is not itself actual notice.

Utah Code Ann. § 76-6-703.7 · Read the law's page

• Do not intentionally or knowingly gain or attempt to gain access to a computer, computer network, computer property, or computer system without the owner's express or implied consent or permission.
• Keep any access within the manner and scope of the consent or permission the owner has given.

Utah Code Ann. §§ 76-6-702, 76-6-703 · Read the law's page

• Do not access a computer, computer system, or network without the owner's express or implied consent or permission.
• Keep any access within the manner and scope of the consent or permission the owner has given.

Utah Code Ann. § 13-61-101(6), (29), (32) · Read the law's page

• Do not treat personal data obtained from a data broker or aggregator as publicly available under the Utah Consumer Privacy Act unless it meets one of the definition's three prongs: it came from a governmental record, you reasonably believe the consumer or widely distributed media lawfully made it available to the general public, or the consumer disclosed it, without restricting the audience, to the person you obtained it from.
• Do not treat a scraped photograph, video or audio recording, or data generated from one, as biometric data under the Utah Consumer Privacy Act; the definition excludes all three and has no exception for use in identification.

Utah Code Ann. § 13-11-4 · Read the law's page

• The statute applies only to a supplier's deceptive act or practice in connection with a consumer transaction.