Protection of Personal Information ActGeneral ProvisionsAmended by Chapter 61, 2009 General Session2009Title.This chapter is known as the "Protection of Personal Information Act."
Amended by Chapter 348, 2019 General Session2019Definitions.As used in this chapter:
"Breach of system security" means an unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information.
"Breach of system security" does not include the acquisition of personal information by an employee or agent of the person possessing unencrypted computerized data unless the personal information is used for an unlawful purpose or disclosed in an unauthorized manner.
"Consumer" means a natural person.
"Financial institution" means the same as that term is defined in 15 U.S.C. Sec. 6809.
"Personal information" means a person's first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or date element is unencrypted or not protected by another method that renders the data unreadable or unusable:
Social Security number;
financial account number, or credit or debit card number; and
any required security code, access code, or password that would permit access to the person's account; or
driver license number or state identification card number.
"Personal information" does not include information regardless of its source, contained in federal, state, or local government records or in widely distributed media that are lawfully made available to the general public.
"Record" includes materials maintained in any form, including paper and electronic.Enacted by Chapter 348, 2019 General Session2019Applicability.This chapter does not apply to a financial institution or an affiliate, as defined in 15 U.S.C. Sec. 6809, of a financial institution.Protection of Personal InformationAmended by Chapter 348, 2019 General Session2019Protection of personal information.
Any person who conducts business in the state and maintains personal information shall implement and maintain reasonable procedures to:
prevent unlawful use or disclosure of personal information collected or maintained in the regular course of business; and
destroy, or arrange for the destruction of, records containing personal information that are not to be retained by the person.
The destruction of records under Subsection (1)(b) shall be by:
shredding;
erasing; or
otherwise modifying the personal information to make the information indecipherable.Amended by Chapter 426, 2024 General Session2024Personal information -- Disclosure of system security breach.A person who owns or licenses computerized data that includes personal information concerning a Utah resident shall, when the person becomes aware of a breach of system security, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused for identity theft or fraud purposes.If an investigation under Subsection (1)(a) reveals that the misuse of personal information for identity theft or fraud purposes has occurred, or is reasonably likely to occur, the person shall provide notification to each affected Utah resident. If an investigation under Subsection (1)(a) reveals that the misuse of personal information relating to 500 or more Utah residents, for identity theft or fraud purposes, has occurred or is reasonably likely to occur, the person shall, in addition to the notification required in Subsection (1)(b), provide notification to:the Office of the Attorney General; andthe Utah Cyber Center created in Section 63A-16-1102.If an investigation under Subsection (1)(a) reveals that the misuse of personal information relating to 1,000 or more Utah residents, for identity theft or fraud purposes, has occurred or is reasonably likely to occur, the person shall, in addition to the notification required in Subsections (1)(b) and (c), provide notification to each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined in 15 U.S.C. Sec. 1681a.A person required to provide notification under Subsection (1) shall provide the notification in the most expedient time possible without unreasonable delay:considering legitimate investigative needs of law enforcement, as provided in Subsection (4)(a);after determining the scope of the breach of system security; andafter restoring the reasonable integrity of the system.A person who maintains computerized data that includes personal information that the person does not own or license shall notify and cooperate with the owner or licensee of the information of any breach of system security immediately following the person's discovery of the breach if misuse of the personal information occurs or is reasonably likely to occur.Cooperation under Subsection (3)(a) includes sharing information relevant to the breach with the owner or licensee of the information.Notwithstanding Subsection (2), a person may delay providing notification under Subsection (1)(b) at the request of a law enforcement agency that determines that notification may impede a criminal investigation.A person who delays providing notification under Subsection (4)(a) shall provide notification in good faith without unreasonable delay in the most expedient time possible after the law enforcement agency informs the person that notification will no longer impede the criminal investigation.A notification required by Subsection (1)(b) may be provided:in writing by first-class mail to the most recent address the person has for the resident;electronically, if the person's primary method of communication with the resident is by electronic means, or if provided in accordance with the consumer disclosure provisions of 15 U.S.C. Section 7001;by telephone, including through the use of automatic dialing technology not prohibited by other law; orfor residents of the state for whom notification in a manner described in Subsections (5)(a)(i) through (iii) is not feasible, by publishing notice of the breach of system security:in a newspaper of general circulation; andas required in Section 45-1-101.If a person maintains the person's own notification procedures as part of an information security policy for the treatment of personal information the person is considered to be in compliance with the notification requirement in Subsection (1)(b) if the procedures are otherwise consistent with this chapter's timing requirements and the person notifies each affected Utah resident in accordance with the person's information security policy in the event of a breach.A person who is regulated by state or federal law and maintains procedures for a breach of system security under applicable law established by the primary state or federal regulator is considered to be in compliance with this part if the person notifies each affected Utah resident in accordance with the other applicable law in the event of a breach.The following information may be deemed confidential and classified as a protected record under Subsections 63G-2-305(1) and (2) if the requirements of Subsection 63G-2-309(1)(a)(i) are met:a notification submitted under Subsection (1)(c), including supporting information provided under Subsection (6)(b); andinformation produced by the Office of the Attorney General or the Utah Cyber Center in providing coordination or assistance to the person providing notification under Subsection (1)(c).A person providing notification under Subsection (1)(c) to the Office of the Attorney General or the Utah Cyber Center of a breach of system security shall include the following information in the notification, to the extent the information is known or available at the time the person provides the notification:the date the breach of system security occurred;the date the breach of system security was discovered;the total number of people affected by the breach of system security, including the total number of Utah residents affected;the type of personal information involved in the breach of system security; anda short description of the breach of system security that occurred.A waiver of this section is contrary to public policy and is void and unenforceable.EnforcementAmended by Chapter 173, 2025 General Session2025Enforcement -- Confidentiality agreement -- Penalties.The attorney general may enforce this chapter's provisions.Nothing in this chapter creates a private right of action.Nothing in this chapter affects any private right of action existing under other law, including contract or tort.A person who violates this chapter's provisions is subject to a civil penalty of:no greater than $2,500 for a violation or series of violations concerning a specific consumer; andno greater than $100,000 in the aggregate for related violations concerning more than one consumer, unless:the violations concern:10,000 or more consumers who are residents of the state; and10,000 or more consumers who are residents of other states; orthe person agrees to settle for a greater amount.In addition to the penalties provided in Subsection (3), the attorney general may seek, in an action brought under this chapter:injunctive relief to prevent future violations of this chapter; andattorney fees and costs.Notwithstanding Title 78B, Chapter 3a, Venue for Civil Actions, if the attorney general brings an action under this chapter in the district court, the attorney general shall bring the action in:Salt Lake City; orthe county in which resides a consumer who is affected by the violation.The attorney general shall deposit any amount received under Subsection (3), (4), or (10) into the Attorney General Litigation Fund created in Section 67-5-40.In enforcing this chapter, the attorney general may:investigate the actions of any person alleged to violate Section 13-44-201 or 13-44-202;subpoena a witness;subpoena a document or other evidence;require the production of books, papers, contracts, records, or other information relevant to an investigation;conduct an adjudication in accordance with Title 63G, Chapter 4, Administrative Procedures Act, to enforce a civil provision under this chapter; andenter into a confidentiality agreement in accordance with Subsection (7).If the attorney general has reasonable cause to believe that an individual is in possession, custody, or control of information that is relevant to enforcing this chapter, the attorney general may enter into a confidentiality agreement with the individual.In a civil action brought under this chapter, a court may issue a confidentiality order that incorporates the confidentiality agreement described in Subsection (7)(a).A confidentiality agreement entered into under Subsection (7)(a) or a confidentiality order issued under Subsection (7)(b) may:address a procedure;address testimony taken, a document produced, or material produced under this section;provide whom may access testimony taken, a document produced, or material produced under this section;provide for safeguarding testimony taken, a document produced, or material produced under this section; orrequire that the attorney general:return a document or material to an individual; ornotwithstanding Section 63A-12-105 or a retention schedule created in accordance with Section 63G-2-604, destroy the document or material at a designated time.A subpoena issued under Subsection (6) may be served by certified mail.A person's failure to respond to a request or subpoena from the attorney general under Subsection (6)(b), (c), or (d) is a violation of this chapter.The attorney general may inspect and copy all records related to the business conducted by the person alleged to have violated this chapter, including records located outside the state.For records located outside of the state, the person who is found to have violated this chapter shall pay the attorney general's expenses to inspect the records, including travel costs.Upon notification from the attorney general of the attorney general's intent to inspect records located outside of the state, the person who is found to have violated this chapter shall pay the attorney general $500, or a higher amount if $500 is estimated to be insufficient, to cover the attorney general's expenses to inspect the records.To the extent an amount paid to the attorney general by a person who is found to have violated this chapter is not expended by the attorney general, the amount shall be refunded to the person who is found to have violated this chapter.The Division of Corporations and Commercial Code or any other relevant entity shall revoke any authorization to do business in this state of a person who fails to pay any amount required under this Subsection (10).Subject to Subsection (11)(c), the attorney general shall keep confidential a procedure agreed to, testimony taken, a document produced, or material produced under this section pursuant to a subpoena, confidentiality agreement, or confidentiality order, unless the individual who agreed to the procedure, provided testimony, produced the document, or produced material waives confidentiality in writing.Subject to Subsections (11)(c) and (11)(d), the attorney general may use, in an enforcement action taken under this section, testimony taken, a document produced, or material produced under this section to the extent the use is not restricted or prohibited by a confidentiality agreement or a confidentiality order.The attorney general may use, in an enforcement action taken under this section, testimony taken, a document produced, or material produced under this section that is restricted or prohibited from use by a confidentiality agreement or a confidentiality order if the individual who provided testimony or produced the document or material waives the restriction or prohibition in writing.The attorney general may disclose testimony taken, a document produced, or material produced under this section, without consent of the individual who provided the testimony or produced the document or material, or the consent of an individual being investigated, to:a grand jury; ora federal or state law enforcement officer, if the person from whom the information was obtained is notified 20 days or greater before the day on which the information is disclosed, and the federal or state law enforcement officer certifies that the federal or state law enforcement officer will:maintain the confidentiality of the testimony, document, or material; anduse the testimony, document, or material solely for an official law enforcement purpose.An administrative action filed under this chapter shall be commenced no later than 10 years after the day on which the alleged breach of system security last occurred.A civil action under this chapter shall be commenced no later than five years after the day on which the alleged breach of system security last occurred.