Duty LXD-1134
Processes de-identified data, in Utah
Genetic Information Privacy Act, deidentified datasince 3 lines
Utah Code 13-60-102(3) and 13-60-102(7)(c) · Read the law's page
- To treat data as deidentified under the Genetic Information Privacy Act, take administrative and technical measures to ensure the data cannot be associated with a particular consumer (Utah Code 13-60-102(3)(b)(i)).
- Publicly commit to maintain and use the data in deidentified form and not attempt to reidentify it (Utah Code 13-60-102(3)(b)(ii)).
- Enter into a legally enforceable contract that prohibits any recipient of the data from attempting to reidentify it (Utah Code 13-60-102(3)(b)(iii)).
Utah Consumer Privacy Act, definition of deidentified datasince 3 lines
Utah Code 13-61-101(14) and 13-61-101(24)(b) · Read the law's page
- To treat data as deidentified under the Utah Consumer Privacy Act, take reasonable measures to ensure that a person cannot associate the data with an individual (Utah Code 13-61-101(14)(a)(ii)(A)).
- Publicly commit to maintain and use the data only in deidentified form and not to attempt to reidentify it (Utah Code 13-61-101(14)(a)(ii)(B)).
- Contractually obligate any recipient of the data to comply with those two requirements (Utah Code 13-61-101(14)(a)(ii)(C)).
Utah Consumer Privacy Act, processing deidentified or pseudonymous datasince 1 line
Utah Code 13-61-303 · Read the law's page
- When you use pseudonymous data or deidentified data, take reasonable steps to comply with any contractual obligations the data are subject to, and promptly address any breach of such an obligation (Utah Code 13-61-303(3)).
Utah Health Data Authority, identifiable health data and re-identificationsince 4 lines
Utah Health Data Authority, Utah Code 26B-8-507 to 26B-8-509 · Read the law's page
- Do not attempt to identify or re-identify an individual using data obtained under the Utah Health Data Authority part, including through data linking or correlation, except as sections 26B-8-506 and 26B-8-508 allow (Utah Code 26B-8-507(1)(c)).
- If you are the department, use, release or publish information received under the Utah Health Data Authority part only in a way that identifies no person, except as sections 26B-8-506 and 26B-8-508 provide (Utah Code 26B-8-507(1)(b)).
- To obtain identifiable health data from the department, make the request for a specified period or solely for bona fide research or statistical purposes, demonstrate that the data is required for those purposes, and enter into a written agreement satisfactory to the department to protect the data (Utah Code 26B-8-508(4)).
- Once you hold identifiable health data under section 26B-8-508, do not disclose it further without the department's prior approval, and then only by control number, and delete it at the earlier of the end of the specified period or the day your need for it ceases (Utah Code 26B-8-508(5)).