5/1/20241/1/2027Amended by Chapter 381, 2024 General Session2024Applicability.This chapter applies to any controller or processor who:conducts business in the state; orproduces a product or service that is targeted to consumers who are residents of the state;has annual revenue of $25,000,000 or more; andsatisfies one or more of the following thresholds:during a calendar year, controls or processes personal data of 100,000 or more consumers; orderives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.This chapter does not apply to:a governmental entity or a third party under contract with a governmental entity when the third party is acting on behalf of the governmental entity;a tribe;an institution of higher education;a nonprofit corporation;a covered entity;a business associate;information that meets the definition of:protected health information for purposes of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., and related regulations;patient identifying information for purposes of 42 C.F.R. Part 2;identifiable private information for purposes of the Federal Policy for the Protection of Human Subjects, 45 C.F.R. Part 46;identifiable private information or personal data collected as part of human subjects research pursuant to or under the same standards as:the good clinical practice guidelines issued by the International Council for Harmonisation; orthe Protection of Human Subjects under 21 C.F.R. Part 50 and Institutional Review Boards under 21 C.F.R. Part 56;personal data used or shared in research conducted in accordance with one or more of the requirements described in Subsection (2)(g)(iv);information and documents created specifically for, and collected and maintained by, a committee but not a board or council listed in Section 26B-1-204;information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986, 42 U.S.C. Sec. 11101 et seq., and related regulations;patient safety work product for purposes of 42 C.F.R. Part 3; orinformation that is:deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. Part 164; andderived from any of the health care-related information listed in this Subsection (2)(g);information originating from, and intermingled to be indistinguishable with, information under Subsection (2)(g) that is maintained by:a health care facility or health care provider; ora program or a qualified service organization as defined in 42 C.F.R. Sec. 2.11;information used only for public health activities and purposes as described in 45 C.F.R. Sec. 164.512;an activity by:a consumer reporting agency, as defined in 15 U.S.C. Sec. 1681a;a furnisher of information, as set forth in 15 U.S.C. Sec. 1681s-2, who provides information for use in a consumer report, as defined in 15 U.S.C. Sec. 1681a; ora user of a consumer report, as set forth in 15 U.S.C. Sec. 1681b;subject to regulation under the federal Fair Credit Reporting Act, 15 U.S.C. Sec. 1681 et seq.; andinvolving the collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer's:credit worthiness;credit standing;credit capacity;character;general reputation;personal characteristics; ormode of living;a financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. Sec. 6801 et seq., and related regulations;personal data collected, processed, sold, or disclosed in accordance with the federal Driver's Privacy Protection Act of 1994, 18 U.S.C. Sec. 2721 et seq.;personal data regulated by the federal Family Education Rights and Privacy Act, 20 U.S.C. Sec. 1232g, and related regulations;personal data collected, processed, sold, or disclosed in accordance with the federal Farm Credit Act of 1971, 12 U.S.C. Sec. 2001 et seq.;data that are processed or maintained:in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent the collection and use of the data are related to the individual's role;as the emergency contact information of an individual described in Subsection (2)(o)(i) and used for emergency contact purposes; orto administer benefits for another individual relating to an individual described in Subsection (2)(o)(i) and used for the purpose of administering the benefits;an individual's processing of personal data for purely personal or household purposes; oran air carrier.A controller is in compliance with any obligation to obtain parental consent under this chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C. Sec. 6501 et seq., and the act's implementing regulations and exemptions.This chapter does not require a person to take any action in conflict with the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. Sec. 1320d et seq., or related regulations.