Law / United States / 
Utah
Utah Consumer Privacy Act, publicly-available-information exemption and biometric data
Utah Code Ann. § 13-61-101(6), (29), (32)
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not treat personal data obtained from a data broker or aggregator as publicly available under the Utah Consumer Privacy Act unless it meets one of the definition's three prongs: it came from a governmental record, you reasonably believe the consumer or widely distributed media lawfully made it available to the general public, or the consumer disclosed it, without restricting the audience, to the person you obtained it from.
- Do not treat a scraped photograph, video or audio recording, or data generated from one, as biometric data under the Utah Consumer Privacy Act; the definition excludes all three and has no exception for use in identification.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- What gives a person grounds to reasonably believe that "a consumer or widely distributed media has lawfully made available to the general public" information under Utah Code section 13-61-101(29)(b), when the person collects it from a website without knowing how it got there?
- How does a person show that "the consumer has not restricted the information to a specific audience" under Utah Code section 13-61-101(29)(c) when the source is a site that limits viewing to logged-in members?
What it makes you log
Logging duty
The cited paragraphs are definitions. They take publicly available information out of personal data and define biometric data, and they state no record duty. The Act's other sections are not cited by this row and are not coded on it. The definitions have no territorial clause.
- Kind
- None
- As of
What this law does
Section 13-61-101(29) defines publicly available information as information that a person lawfully obtains from a record of a governmental entity, reasonably believes a consumer or widely distributed media has lawfully made available to the general public, or, if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.
Biometric data under Section 13-61-101(6) means data generated by automatic measurements of an individual's unique biological characteristics. It does not include a physical or digital photograph, a video or audio recording, or data generated from either. Processing genetic or biometric data for the purpose of identifying a specific individual is sensitive data under Section 13-61-101(32)(a)(ii).
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .