Law / United States / 
Utah
Utah Consumer Privacy Act, definition of deidentified data
Utah Code 13-61-101(14) and 13-61-101(24)(b)
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat data as deidentified under the Utah Consumer Privacy Act, take reasonable measures to ensure that a person cannot associate the data with an individual (Utah Code 13-61-101(14)(a)(ii)(A)).
- Publicly commit to maintain and use the data only in deidentified form and not to attempt to reidentify it (Utah Code 13-61-101(14)(a)(ii)(B)).
- Contractually obligate any recipient of the data to comply with those two requirements (Utah Code 13-61-101(14)(a)(ii)(C)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 13-61-101(14) states the conditions for treating data as deidentified and section 13-61-101(24)(b) takes deidentified data out of personal data. Neither states a log or record duty.
- Kind
- None
- As of
What this law does
Section 13-61-101(14)(a) defines deidentified data as data that cannot reasonably be linked to an identified or identifiable individual and that is possessed by a controller who takes reasonable measures to ensure a person cannot associate the data with an individual, publicly commits to maintain and use the data only in deidentified form and not attempt to reidentify it, and contractually obligates any recipients to comply with those two requirements.
Section 13-61-101(14)(b) provides that deidentified data includes synthetic data. Section 13-61-101(24)(b) provides that personal data does not include deidentified data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .