Law / United States / 
Utah
Government Data Privacy Act, privacy notices and website privacy notices
Utah Code 63A-19-402 and 63A-19-402.5
In force since .
A privacy notice rule binding government bodies.
- Obligation class
- Disclosure
As of .
What it requires
- This part binds a governmental entity, a term Utah Code 63A-19-101 takes from section 63G-2-103, and section 63A-19-401.4 extends the same requirements to a contractor of a governmental entity.
- Give each individual, or legal guardian, from whom you request or collect personal data a privacy notice, posted prominently where you collect it, included in each document or form you use to collect it, or reached by a conspicuous link or QR code in that document or form.
- Where the personal data would be a public record, limit the notice to a statement that the individual's personal data may be available to the public; otherwise describe all intended purposes and uses, the consequences of refusing to provide the data, the classes of persons and governmental entities with whom you share it or to whom you sell it, and the record series that include it.
- Use personal data an individual furnishes only for the purposes identified in the privacy notice you gave that individual.
- On each government website, post on the homepage a notice, or a link to a page holding it, of who is responsible for the site, how to contact them, and how a user may seek access to, request correction of, or file a complaint about the user's personal data or user data.
- If a government website collects user data, also state in that notice the website tracking technology used, the user data collected, the intended purposes and uses, the classes of persons and governmental entities with whom the user data is shared or to whom it is sold, and the record series that include it.
- Do not collect user data on a government website until you have posted that notice.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Auditor investigates alleged violations on the instruction of the Utah Privacy Governing Board and gives the entity 30 days to cure; the Attorney General may sue to enjoin or compel compliance by an entity that is not a state agency, and an uncured violation by a state agency is reported to the Legislative Management Committee.
What this law does
Section 402 first took effect on , as a duty to provide a personal data request notice. A governmental entity must provide a privacy notice to an individual, or the legal guardian of an individual, from whom it requests or collects personal data. If the personal data would be classified as a public record, the notice is limited to a statement that the individual's personal data may be available to the public.
Otherwise the notice must describe all intended purposes and uses of the personal data, the consequences for refusing to provide it, the classes of persons and governmental entities with whom it is shared or to whom it is sold, and the record series in which it is included.
The entity must post the notice in a prominent place where it collects the data, include it in any document or form used to collect the data, or include in that document or form a conspicuous link or QR code to an electronic version. It may only use personal data furnished by an individual for the purposes identified in the privacy notice provided to that individual.
Section 402.5, which took effect on , requires a government website to include notice to a user of the identity of the responsible governmental entity, how to contact it, and how a user may seek access to, request correction of, and file a complaint about the user's personal data or user data.
A government website that collects user data must also state in the notice the website tracking technology used, the user data collected, the intended purposes and uses, the classes of persons and governmental entities with whom the user data is shared or to whom it is sold, and the record series that include it. The notice must be posted prominently on the homepage of the government website, or the homepage must carry a link to a separate webpage containing it. A governmental entity may not collect user data on a government website unless it has complied with these requirements.
When LexLint raises it
When your app profile says your app processes personal data.