Law / United States / 
Utah
Utah Consumer Privacy Act, sensitive data categories and biometric data definition
Utah Code 13-61-101(6), 13-61-101(32)(a)(ii), 13-61-302(3)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- Audit expectation
- none
What it requires
- Give Utah consumers clear notice and an opportunity to opt out before processing their sensitive data, including biometric data such as a voiceprint, retina scan, iris scan, or fingerprint collected for the purpose of identifying a specific individual.
- Treat an identifier your app generates only from a photograph, or from a video or audio recording, as outside biometric data under this law; this notice-and-opt-out duty does not reach it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does section 13-61-101(6)(c)(iii), which excludes data generated from a video or audio recording, remove a voiceprint that a controller measures from a recorded voice, when subsection (6)(b) lists a voiceprint used to identify a specific individual as biometric data?
What it makes you log
Logging duty
The cited definitions fix what biometric data and sensitive data are: sensitive data includes the processing of genetic personal data or biometric data for the purpose of identifying a specific individual, and biometric data excludes photographs, recordings and health care setting captures. Section 13-61-302(3) bars processing sensitive data without first giving clear notice and an opportunity to opt out, a notice duty that states no record to be kept. The cited provisions state no record duty, no retention period, no audit and no territorial reach. The chapter's reach test in 13-61-102 and the definitions of consumer and controller are not cited by this row, so no hook is taken.
- Kind
- None
- As of
What this law does
Defines biometric data as data generated by automatic measurement of an individual's unique biological characteristics, naming fingerprint, voiceprint, retina, iris, or any other unique biological pattern used to identify a specific individual, but excludes any physical or digital photograph, video or audio recording, or data generated from one.
Sensitive data means personal data that reveals an individual's racial or ethnic origin, religious beliefs, sexual orientation, or citizenship or immigration status, or information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional; the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual; and specific geolocation data.
A controller may not process sensitive data without first giving clear notice and an opportunity to opt out, an opt-out rather than opt-in model.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .