Law / United States / 
Utah
Government Data Privacy Act, correction requests and data privacy complaints
Utah Code 63A-19-403 and 63A-19-502
In force since .
A data subject rights rule binding government bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- This part binds a governmental entity, a term Utah Code 63A-19-101 takes from section 63G-2-103, and section 63A-19-401.4 extends the same requirements to a contractor of a governmental entity.
- Provide a procedure by which an individual or legal guardian can request an amendment or correction of personal data furnished to you and of information about an identifiable individual in a record you maintain; you are not obliged to make the change requested.
- When an individual submits a data privacy complaint, have your chief administrative officer attempt to resolve it before either party requests mediation with the data privacy ombudsperson.
- An employee of a governmental entity may submit a confidential and anonymous data privacy complaint directly to the attorney general and has the protections of the Utah Protection of Public Employees Act.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Auditor investigates alleged violations on the instruction of the Utah Privacy Governing Board and gives the entity 30 days to cure; the Attorney General may sue to enjoin or compel compliance by an entity that is not a state agency, and an uncured violation by a state agency is reported to the Legislative Management Committee.
What this law does
Section 403 first took effect on . A governmental entity that collects personal data must provide a procedure by which an individual or legal guardian may request an amendment or correction of personal data furnished to the entity and of information concerning an identifiable individual in a record it maintains, as allowed by law. The procedure does not obligate the governmental entity to make the requested amendment or correction.
Section 502, which took effect on , requires an individual who makes a data privacy complaint to submit it first to the chief administrative officer of the governmental entity, who must attempt to resolve it. If the chief administrative officer cannot resolve the complaint, the individual or the governmental entity may request mediation with the data privacy ombudsperson.
An employee of a governmental entity may submit a confidential and anonymous data privacy complaint directly to the attorney general and is entitled to the protections of the Utah Protection of Public Employees Act.
When LexLint raises it
When your app profile says your app processes personal data.