Law / United States / 
Utah
Genetic Information Privacy Act, deidentified data
Utah Code 13-60-102(3) and 13-60-102(7)(c)
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat data as deidentified under the Genetic Information Privacy Act, take administrative and technical measures to ensure the data cannot be associated with a particular consumer (Utah Code 13-60-102(3)(b)(i)).
- Publicly commit to maintain and use the data in deidentified form and not attempt to reidentify it (Utah Code 13-60-102(3)(b)(ii)).
- Enter into a legally enforceable contract that prohibits any recipient of the data from attempting to reidentify it (Utah Code 13-60-102(3)(b)(iii)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 13-60-102(3) states the conditions for treating data as deidentified and section 13-60-102(7)(c) takes deidentified data out of genetic data. Neither states a log or record duty.
- Kind
- None
- As of
What this law does
Section 13-60-102(3) defines deidentified data as data that cannot reasonably be linked to an identifiable individual and that is possessed by a company that takes administrative and technical measures to ensure the data cannot be associated with a particular consumer, makes a public commitment to maintain and use data in deidentified form and not attempt to reidentify data, and enters into a legally enforceable contractual obligation that prohibits a recipient of the data from attempting to reidentify it. Section 13-60-102(7)(c) provides that genetic data does not include deidentified data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .