Processes biometric data, in Utah

Utah Code 13-44-201 · Read the law's page

• This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
• Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.
• There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.

Utah Code 78B-4-701 to 78B-4-704 · Read the law's page

• This is a defense available to any person sued in Utah on a claim arising from a breach of system security; it creates no independent duty to adopt a cybersecurity program, and under section 78B-4-704 may not be construed to create a private cause of action, including a class action, for failing to comply with it.
• To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.
• Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.
• Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.
• The defense is unavailable if you had actual notice of a threat or hazard to the information's security and did not act in a reasonable amount of time to take known remedial efforts before it resulted in the breach; a risk assessment to improve security is not itself actual notice.

Utah Code 13-61-101(6), 13-61-101(32)(a)(ii), 13-61-302(3) · Read the law's page

• Give Utah consumers clear notice and an opportunity to opt out before processing their sensitive data, including biometric data such as a voiceprint, retina scan, iris scan, or fingerprint collected for the purpose of identifying a specific individual.
• Treat an identifier your app generates only from a photograph, or from a video or audio recording, as outside biometric data under this law; this notice-and-opt-out duty does not reach it.

Utah Code Ann. § 13-61-101(6), (29), (32) · Read the law's page

• Do not treat personal data obtained from a data broker or aggregator as publicly available under the Utah Consumer Privacy Act unless it meets one of the definition's three prongs: it came from a governmental record, you reasonably believe the consumer or widely distributed media lawfully made it available to the general public, or the consumer disclosed it, without restricting the audience, to the person you obtained it from.
• Do not treat a scraped photograph, video or audio recording, or data generated from one, as biometric data under the Utah Consumer Privacy Act; the definition excludes all three and has no exception for use in identification.

Utah Code 45-2-3.5, 45-2-14, 45-3-2 to 45-3-7, as amended · Read the law's page

• Do not treat the use of generative AI, computer animation, or digital manipulation as a defense to a libel or slander claim
• Give a person written notice before filing a defamation action over digitally created content; if you are the publisher and remove the content within 10 days of that notice, the plaintiff's recovery is limited to actual damages
• Get an individual's consent before distributing an AI-generated, computer-animated, or digitally manipulated replica of that individual's likeness or voice
• Do not traffic in identity-replication tools without the depicted individual's consent