Law / United States / 
Utah
Government Data Privacy Act, duties of governmental entities
Utah Code 63A-19-401 to 63A-19-401.3 and 63A-19-404
In force since .
A comprehensive regime rule binding government bodies.
- Obligation class
- Governance, Retention, Reporting
As of .
What it requires
- This part binds a governmental entity, a term Utah Code 63A-19-101 takes from section 63G-2-103, and section 63A-19-401.4 extends the same requirements to a contractor of a governmental entity.
- Obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose.
- Initiate a data privacy program, and for each processing activity in place before , identify any non-compliant activity and prepare a strategy for bringing it into compliance, as soon as reasonably practicable and by at the latest.
- Do not establish, maintain or use undisclosed or covert surveillance of individuals, sell personal data, or share personal data, unless the law permits it (or, for a sale, expressly requires it).
- If you are a state agency, from make a privacy annotation for each record series containing personal data, and do not collect, maintain or use the personal data in a record series that has none.
- Have each employee who has access to personal data, or who supervises an employee who does, complete data privacy training within 30 days after beginning employment and at least once in each calendar year.
- By December 31 each year, prepare a privacy program report, share it with the Office of Data Privacy and keep it for at least five years.
- Retain and dispose of personal data in accordance with a documented record retention schedule.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Auditor investigates alleged violations on the instruction of the Utah Privacy Governing Board and gives the entity 30 days to cure; the Attorney General may sue to enjoin or compel compliance by an entity that is not a state agency, and an uncured violation by a state agency is reported to the Legislative Management Committee.
What this law does
The Government Data Privacy Act took effect on . A governmental entity must obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose. It must initiate a data privacy program before .
For any processing activity implemented before , it must identify any non-compliant activity and prepare a strategy for bringing it into compliance, as soon as reasonably practicable and no later than . It may not establish, maintain or use undisclosed or covert surveillance of individuals unless permitted by law, may not sell personal data unless expressly required by law, and may not share personal data unless permitted by law.
Beginning , a state agency must make a complete and accurate privacy annotation for each record series containing personal data that it collects, maintains or uses, and after that date may not collect, maintain or use the personal data in a record series without one. An employee who has access to personal data, or who supervises an employee who does, must complete data privacy training within 30 days after beginning employment and at least once in each calendar year.
On or before December 31 of each year, the chief administrative officer of each governmental entity must prepare a privacy program report. The report must be shared with the Office of Data Privacy on or before December 31 each year and retained for no less than five years. A governmental entity that collects personal data must retain and dispose of it in accordance with a documented record retention schedule.
The State Auditor must give an entity a chance to cure a substantiated violation within 30 days. After a referral, the Attorney General may file an action in district court to enjoin an entity that is not a state agency from violating the chapter or to require it to comply.
When LexLint raises it
When your app profile says your app processes personal data.