12/31/2023Enacted by Chapter 462, 2022 General Session2022Controller's response to requests. Subject to the other provisions of this chapter, a controller shall comply with a consumer's request under Section 13-61-202 to exercise a right. Within 45 days after the day on which a controller receives a request to exercise a right, the controller shall: take action on the consumer's request; and inform the consumer of any action taken on the consumer's request. The controller may extend once the initial 45-day period by an additional 45 days if reasonably necessary due to the complexity of the request or the volume of the requests received by the controller. If a controller extends the initial 45-day period, before the initial 45-day period expires, the controller shall: inform the consumer of the extension, including the length of the extension; and provide the reasons the extension is reasonably necessary as described in Subsection (2)(b). The 45-day period does not apply if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires. If, in accordance with this section, a controller chooses not to take action on a consumer's request, the controller shall within 45 days after the day on which the controller receives the request, inform the consumer of the reasons for not taking action. A controller may not charge a fee for information in response to a request, unless the request is the consumer's second or subsequent request during the same 12-month period. Notwithstanding Subsection (4)(a), a controller may charge a reasonable fee to cover the administrative costs of complying with a request or refuse to act on a request, if: the request is excessive, repetitive, technically infeasible, or manifestly unfounded; the controller reasonably believes the primary purpose in submitting the request was something other than exercising a right; or the request, individually or as part of an organized effort, harasses, disrupts, or imposes undue burden on the resources of the controller's business. A controller that charges a fee or refuses to act in accordance with this Subsection (4)(b) bears the burden of demonstrating the request satisfied one or more of the criteria described in Subsection (4)(b)(i). If a controller is unable to authenticate a consumer request to exercise a right described in Section 13-61-201 using commercially reasonable efforts, the controller: is not required to comply with the request; and may request that the consumer provide additional information reasonably necessary to authenticate the request.