2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill enacts the Government Data Privacy Act.
10 Highlighted Provisions:
11 This bill:
12 ▸ defines terms;
13 ▸ describes governmental entity duties related to personal data privacy, including:
14 • breach notification;
15 • limits on data collection and use; and
16 • the ability to correct and access personal data;
17 ▸ creates the state data privacy policy that outlines the broad data privacy goals for the
18 state;
19 ▸ creates the Utah Privacy Governing Board to recommend changes in the state data
20 privacy policy;
21 ▸ establishes the Office of Data Privacy to coordinate implementation of privacy
22 protections; and
23 ▸ renames the Personal Privacy Oversight Commission to the Utah Privacy
24 Commission (commission) and amends the commission's duties.
25 Money Appropriated in this Bill:
26 None
27 Other Special Clauses:
28 None
29 Utah Code Sections Affected:
30 AMENDS:
31 63A-12-115, as enacted by Laws of Utah 2023, Chapter 173
32 63C-24-101, as enacted by Laws of Utah 2021, Chapter 155
33 63C-24-102, as last amended by Laws of Utah 2023, Chapter 16
34 63C-24-201, as enacted by Laws of Utah 2021, Chapter 155
35 63C-24-202, as last amended by Laws of Utah 2023, Chapter 173
36 67-3-13, as last amended by Laws of Utah 2023, Chapters 16, 173 and 435
37 ENACTS:
38 63A-19-101, Utah Code Annotated 1953
39 63A-19-102, Utah Code Annotated 1953
40 63A-19-201, Utah Code Annotated 1953
41 63A-19-202, Utah Code Annotated 1953
42 63A-19-301, Utah Code Annotated 1953
43 63A-19-302, Utah Code Annotated 1953
44 63A-19-401, Utah Code Annotated 1953
45 63A-19-402, Utah Code Annotated 1953
46 63A-19-403, Utah Code Annotated 1953
47 63A-19-404, Utah Code Annotated 1953
48 63A-19-405, Utah Code Annotated 1953
49 63A-19-406, Utah Code Annotated 1953
50 63A-19-501, Utah Code Annotated 1953
51 63A-19-601, Utah Code Annotated 1953
52 REPEALS:
53 67-1-17, as last amended by Laws of Utah 2023, Chapter 173
54
55 Be it enacted by the Legislature of the state of Utah:
56 Section 1. Section 63A-12-115 is amended to read:
57 63A-12-115. Privacy annotation for records series -- Requirements -- Content.
58 (1) (a) Before January 1, [
59 record series that the executive branch agency collects, maintains, or uses, evaluate the record
60 series and make a privacy annotation that completely and accurately complies with Subsection
61 (2) and the rules described in Subsection 63A-12-104(2)(e).
62 (b) Beginning on January 1, [
63 maintain, or use personal identifying information unless the record series for which the
64 personal identifying information is collected, maintained, or used includes a privacy annotation
65 that completely and accurately complies with Subsection (2) and the rules described in
66 Subsection 63A-12-104(2)(e).
67 (2) A privacy annotation shall include the following:
68 (a) if the record series does not include personal identifying information, a statement
69 indicating that the record series does not include personal identifying information; or
70 (b) if the record series includes personal identifying information:
71 (i) an inventory of the personal identifying information included in the record series;
72 and
73 (ii) for the personal identifying information described in Subsection (2)(b)(i):
74 (A) the purpose for which the executive branch agency collects, keeps, or uses the
75 personal identifying information;
76 (B) a citation to the executive branch agency's legal authority for collecting, keeping, or
77 using the personal identifying information; and
78 (C) any other information required by state archives by rule under Subsection
79 63A-12-104(2)(e).
80 Section 2. Section 63A-19-101 is enacted to read:
81
82
83 63A-19-101. Definitions.
84 As used in this chapter:
85 (1) "Chief privacy officer" means the individual appointed under Section 63A-19-302.
86 (2) "Commission" means the Utah Privacy Commission established in Section
87 63C-24-102.
88 (3) "Cyber Center" means the Utah Cyber Center created in Section 63A-16-510.
89 (4) "Data breach" means the unauthorized access, acquisition, disclosure, loss of
90 access, or destruction of personal data held by a governmental entity, unless the governmental
91 entity concludes, according to standards established by the Cyber Center, that there is a low
92 probability that personal data has been compromised.
93 (5) "Designated government entity" means the same as that term is defined in Section
94 67-3-13.
95 (6) "Governing board" means the Utah Privacy Governing Board established in Section
96 63A-19-201.
97 (7) "Governmental entity" means the same as that term is defined in Section
98 63G-2-103.
99 (8) "High risk processing activities" means a governmental entity's processing of
100 personal data that may result in a significant compromise to an individual's privacy interests,
101 based on factors that include:
102 (a) the sensitivity of the personal data processed;
103 (b) the amount of personal data being processed;
104 (c) the individual's ability to consent to the processing of personal data; and
105 (d) risks of unauthorized access or use.
106 (9) "Legal guardian" means:
107 (a) the parent of a minor; or
108 (b) an individual appointed by a court to be the guardian of a minor or incapacitated
109 person and given legal authority to make decisions regarding the person or property of the
110 minor or incapacitated person.
111 (10) "Office" means the Office of Data Privacy created in Section 63A-19-301.
112 (11) "Ombudsman" means the data privacy ombudsman appointed under Section
113 63A-19-501.
114 (12) "Personal data" means information that is linked or can be reasonably linked to an
115 identified individual or an identifiable individual.
116 (13) "Process" means any operation or set of operations performed on personal data,
117 including collection, recording, organization, structuring, storage, adaptation, alteration, access,
118 retrieval, consultation, use, disclosure by transmission, transfer, dissemination, alignment,
119 combination, restriction, erasure, or destruction.
120 (14) "Record" means the same as that term is defined in Section 63G-2-103.
121 (15) "Record series" means the same as that term is defined in Section 63G-2-103.
122 (16) "Retention schedule" means a governmental entity's schedule for the retention or
123 disposal of records that has been approved by the Records Management Committee pursuant to
124 Section 63A-12-113.
125 (17) (a) "Sell" means an exchange of personal data for monetary consideration by a
126 governmental entity to a third party.
127 (b) "Sell" does not include a fee charged by a governmental entity for access to a record
128 as defined in Section 63G-2-203.
129 (18) (a) "State agency" means the following entities that are under the direct
130 supervision and control of the governor or the lieutenant governor:
131 (i) a department;
132 (ii) a commission;
133 (iii) a board;
134 (iv) a council;
135 (v) an institution;
136 (vi) an officer;
137 (vii) a corporation;
138 (viii) a fund;
139 (ix) a division;
140 (x) an office;
141 (xi) a committee;
142 (xii) an authority;
143 (xiii) a laboratory;
144 (xiv) a library;
145 (xv) a bureau;
146 (xvi) a panel;
147 (xvii) another administrative unit of the state; or
148 (xviii) an agent of an entity described in Subsections (18)(a)(i) through (xvii).
149 (b) "State agency" does not include:
150 (i) the legislative branch;
151 (ii) the judicial branch;
152 (iii) an executive branch agency within the Office of the Attorney General, the state
153 auditor, the state treasurer, or the State Board of Education; or
154 (iv) an independent entity.
155 (c) "State privacy officer" means the individual described in Section 67-3-13.
156 Section 3. Section 63A-19-102 is enacted to read:
157 63A-19-102. State data privacy policy.
158 It is the policy of Utah that:
159 (1) an individual has a fundamental interest in and inherent expectation of privacy
160 regarding the personal data that the individual provides to a governmental entity;
161 (2) a governmental entity shall act in a manner respecting personal data provided to the
162 governmental entity that is consistent with the interests and expectations described in
163 Subsection (1);
164 (3) the state shall encourage innovation to enhance the ability of a governmental entity
165 to:
166 (a) protect the privacy of an individual's personal data;
167 (b) provide clear notice to an individual regarding the processing of the individual's
168 personal data;
169 (c) process personal data only for specified, lawful purposes and only process the
170 minimum amount of an individual's personal data necessary to achieve those purposes;
171 (d) implement appropriate consent mechanisms regarding the uses of an individual's
172 personal data;
173 (e) provide an individual with the ability to access, control, and request corrections to
174 the individual's personal data held by a governmental entity;
175 (f) maintain appropriate safeguards to protect the confidentiality, integrity, and
176 availability of personal data;
177 (g) account for compliance with privacy related laws, rules, and regulations that are
178 specific to a particular governmental entity, program, or personal data; and
179 (h) meet a governmental entity's and an individual's business and service needs;
180 (4) the state shall promote training and education programs for employees of
181 governmental entities focused on:
182 (a) data privacy best practices, obligations, and responsibilities; and
183 (b) the overlapping relationship with privacy, records management, and security; and
184 (5) the state shall promote consistent terminology in data privacy requirements across
185 governmental entities.
186 Section 4. Section 63A-19-201 is enacted to read:
187
188 63A-19-201. Utah Privacy Governing Board.
189 (1) There is created the Utah Privacy Governing Board.
190 (2) The governing board shall be composed of five members as follows:
191 (a) the governor, or the governor's designee;
192 (b) the president of the Senate, or the president's designee;
193 (c) the speaker of the House of Representatives, or the speaker's designee;
194 (d) the attorney general, or the attorney general's designee; and
195 (e) the state auditor, or the state auditor's designee.
196 (3) (a) A majority of the members of the governing board is a quorum.
197 (b) The action of a majority of a quorum constitutes an action of the governing board.
198 (4) The governor, or the governor's designee is chair of the governing board.
199 (5) The governing board shall meet at least two times a year.
200 (6) The governing board may recommend specific matters to the state auditor under
201 Section 63A-19-601.
202 (7) The office shall provide staff and support to the governing board.
203 Section 5. Section 63A-19-202 is enacted to read:
204 63A-19-202. Governing board duties.
205 (1) The governing board shall:
206 (a) recommend changes to the state data privacy policy;
207 (b) by July 1 of each year, approve the data privacy agenda items for the commission
208 and make recommendations for additional items for the data privacy agenda;
209 (c) hear issues raised by the ombudsman regarding existing governmental entity
210 privacy practices;
211 (d) evaluate and recommend the appropriate:
212 (i) structure and placement for the office within state government; and
213 (ii) authority to be granted to the office, including any authority to make rules; and
214 (e) recommend funding mechanisms and strategies for governmental entities to enable
215 compliance with data privacy responsibilities, including:
216 (i) appropriations;
217 (ii) rates;
218 (iii) grants; and
219 (iv) internal service funds.
220 (2) In fulfilling the duties under this part, the commission may receive and request
221 input from:
222 (a) governmental entities;
223 (b) elected officials;
224 (c) subject matter experts; and
225 (d) other stakeholders.
226 Section 6. Section 63A-19-301 is enacted to read:
227
228 63A-19-301. Office of Data Privacy.
229 (1) There is created within the department the Office of Data Privacy.
230 (2) The office shall coordinate with the governing board and the commission to
231 perform the duties in this section.
232 (3) The office shall:
233 (a) create and maintain a strategic data privacy plan to:
234 (i) assist state agencies to implement effective and efficient privacy practices, tools,
235 and systems that:
236 (A) protect the privacy of personal data;
237 (B) comply with laws and regulations specific to the entity, program, or data;
238 (C) empower individuals to protect and control their personal data; and
239 (D) enable information sharing among entities, as allowed by law; and
240 (ii) account for differences in state agency resources, capabilities, populations served,
241 data types, and maturity levels regarding privacy practices;
242 (b) review statutory provisions related to governmental data privacy and records
243 management to:
244 (i) identify conflicts and gaps in data privacy law;
245 (ii) standardize language used for similar privacy processes; and
246 (iii) consult impacted agencies and the attorney general regarding findings and
247 proposed amendments;
248 (c) work with state agencies to study, research, and identify:
249 (i) additional privacy requirements that are feasible for state agencies;
250 (ii) potential remedies and accountability mechanisms for non-compliance of a state
251 agency;
252 (iii) ways to expand individual control and rights with respect to personal data held by
253 state agencies; and
254 (iv) resources needed to develop, implement, and improve privacy programs;
255 (d) monitor high-risk data processing activities within state agencies;
256 (e) receive information from state agencies regarding the sale, sharing, and processing
257 of personal data;
258 (f) coordinate with the Cyber Center to develop an incident response plan for data
259 breaches affecting governmental entities;
260 (g) coordinate with the state archivist to incorporate data privacy practices into records
261 management;
262 (h) coordinate with the state archivist to incorporate data privacy training into the
263 trainings described in Section 63A-12-110; and
264 (i) create a data privacy training program for employees of governmental entities.
265 (4) The data privacy training program described in Subsection (3)(i) shall be made
266 available to all governmental entities, and shall be designed to provide instruction regarding:
267 (a) data privacy best practices, obligations, and responsibilities; and
268 (b) the relationship between privacy, records management, and security.
269 (5) (a) Except as provided in Subsection (5)(b), all employees of state agencies shall be
270 required to complete the data privacy training program described in Subsection (3)(i):
271 (i) within 30 days of beginning employment; and
272 (ii) at least once in each calendar year.
273 (b) An employee of a state agency that does not have access to personal data as part of
274 the employee's work duties is not required to participate in the data privacy training program
275 described in Subsection (3)(i).
276 (c) Each state agency shall be responsible for monitoring completion of data privacy
277 training by the state agency's employees.
278 (6) To the extent that resources permit, the office may provide expertise and assistance
279 to governmental entities for high risk data processing activities.
280 Section 7. Section 63A-19-302 is enacted to read:
281 63A-19-302. Chief privacy officer -- Appointment -- Powers -- Reporting.
282 (1) The governor shall, with the advice and consent of the Senate, appoint a chief
283 privacy officer.
284 (2) The chief privacy officer is the director of the office.
285 (3) The chief privacy officer:
286 (a) shall exercise all powers given to and perform all duties imposed on the office;
287 (b) has administrative authority over the office;
288 (c) may make changes in office personnel and service functions under the chief privacy
289 officer's administrative authority;
290 (d) may authorize a designee to assist with the chief privacy officer's responsibilities;
291 and
292 (e) shall report annually, on or before October 1, to the Judiciary Interim Committee
293 regarding:
294 (i) recommendations for legislation to address data privacy concerns; and
295 (ii) reports received from state agencies regarding the sale or sharing of personal data
296 provided under Subsection 63A-19-401(2)(f)(ii).
297 Section 8. Section 63A-19-401 is enacted to read:
298
299 63A-19-401. Duties of governmental entities.
300 (1) (a) Except as provided in Subsections (1)(b) and (c), a governmental entity shall
301 comply with the requirements of this part.
302 (b) (i) If a governmental entity is subject to a more restrictive or specific provision of
303 law than found in this part, the governmental entity shall comply with the more restrictive or
304 specific provision of law.
305 (ii) For purposes of Subsection (1)(b)(i), Title 63G, Chapter 2, Government Records
306 Access and Management Act, is a more restrictive and specific provision of law.
307 (c) A governmental entity that is exempt under Section 63G-2-702, 63G-2-703, or
308 63G-2-704 from complying with the requirements in Title 63G, Chapter 2, Part 6, Collection of
309 Information and Accuracy of Records, is exempt from complying with the requirements in
310 Sections 63A-10-402, 63A-10-403, and 63A-10-404.
311 (2) A governmental entity:
312 (a) shall implement and maintain a privacy program that includes the governmental
313 entity's policies, practices, and procedures for processing personal data;
314 (b) shall provide notice to an individual or the legal guardian of an individual, if the
315 individual's personal data is affected by a data breach, in accordance with Section 63A-19-405;
316 (c) shall obtain and process only the minimum amount of personal data reasonably
317 necessary to efficiently achieve a specified purpose;
318 (d) shall meet the requirements of this part for all processing activities implemented by
319 a governmental entity after May 1, 2024;
320 (e) shall, for any processing activity implemented before May 1, 2024, that the
321 governmental entity identifies as non-compliant with the requirements of this part:
322 (i) document the non-compliant processing activity; and
323 (ii) prepare a strategy for bringing the processing activity into compliance with this
324 part;
325 (f) may not establish, maintain, or use undisclosed or covert surveillance of individuals
326 unless permitted by law;
327 (g) may not sell personal data unless expressly required by law;
328 (h) may not share personal data unless permitted by law;
329 (i) (i) that is a designated government entity, shall annually report to the state privacy
330 officer:
331 (A) the types of personal data the designated government entity currently shares or
332 sells;
333 (B) the basis for sharing or selling the personal data; and
334 (C) the classes of persons and the governmental entities that receive the personal data
335 from the designated government entity; and
336 (ii) that is a state agency, shall annually report to the chief privacy officer:
337 (A) the types of personal data the state agency currently shares or sells;
338 (B) the basis for sharing or selling the personal data; and
339 (C) the classes of persons and the governmental entities that receive the personal data
340 from the state agency; and
341 (j) (i) except as provided in Subsection (3), require all employees of governmental
342 entities to complete a data privacy training program:
343 (A) within 30 days after beginning employment; and
344 (B) at least once in each calendar year; and
345 (k) is responsible for monitoring and verifying completion of data privacy training by
346 their employees.
347 (3) An employee of a governmental entity that does not have access to personal data of
348 individuals as part of their work duties is not required to participate in a data privacy training
349 program described in Subsection (2)(j)(i).
350 (4) (a) A person that enters into an agreement with a governmental entity and processes
351 or has access to personal data as a part of the person's contractual duties or through the use of a
352 governmental entity's systems, is subject to the requirements of this chapter to the same extent
353 as required of the governmental entity.
354 (b) The requirements under Subsection (4)(a) are in addition to and do not replace any
355 other requirements or liability that may be imposed for the person's violation of other laws
356 protecting privacy rights or government records.
357 Section 9. Section 63A-19-402 is enacted to read:
358 63A-19-402. General governmental privacy requirements -- Personal data request
359 notice.
360 (1) A governmental entity shall provide a personal data request notice to an individual,
361 or the legal guardian of an individual, from whom the governmental entity requests or collects
362 personal data.
363 (2) The personal data request notice described in Subsection (1) shall include:
364 (a) the reasons the individual is asked to provide the personal data;
365 (b) the intended purposes and uses of the personal data;
366 (c) the consequences for refusing to provide the personal data;
367 (d) the classes of persons and entities that:
368 (i) share the personal data with the governmental entity; or
369 (ii) receive the personal data from the governmental entity on a regular or contractual
370 basis; and
371 (e) the record series in which the personal data is or will be included, if applicable.
372 (3) The governmental entity shall provide the personal data request notice by:
373 (a) posting the personal data request notice in a prominent place where the
374 governmental entity collects the personal data;
375 (b) including the personal data request notice as part of any document or form used by
376 the governmental entity to collect the personal data; or
377 (c) conspicuously linking to or displaying a QR code linked to an electronic version of
378 the personal data request notice as part of any document or form used by the governmental
379 entity to collect the personal data.
380 (4) The personal data request notice required by this section is in addition to, and does
381 not supersede, any other notice requirement otherwise applicable to the governmental entity.
382 (5) The governmental entity shall, upon request, provide the personal data request
383 notice to an individual, or the legal guardian of an individual, regarding personal data
384 previously furnished by that individual.
385 (6) The governmental entity may only use personal data furnished by an individual for
386 the purposes identified in the personal data request notice provided to that individual.
387 Section 10. Section 63A-19-403 is enacted to read:
388 63A-19-403. Process to request amendment or correction of personal data.
389 (1) A governmental entity that collects personal data shall provide a process by which
390 an individual or legal guardian of an individual may request an amendment or correction of
391 personal data that has been furnished to the governmental entity.
392 (2) The process by which an individual or legal guardian of an individual may request
393 an amendment or correction shall comply with all applicable laws and regulations to which the
394 personal data at issue and to which the governmental entity is subject.
395 (3) The process to request an amendment or correction described in this section does
396 not obligate the governmental entity to make the requested amendment or correction.
397 Section 11. Section 63A-19-404 is enacted to read:
398 63A-19-404. Retention and disposition of personal data.
399 (1) A governmental entity that collects personal data shall retain and dispose of the
400 personal data in accordance with a documented record retention schedule.
401 (2) Compliance with Subsection (1) does not exempt a governmental entity from
402 complying with other applicable laws or regulations related to retention or disposition of
403 specific personal data held by that governmental entity.
404 Section 12. Section 63A-19-405 is enacted to read:
405 63A-19-405. Data breach notification to the Cyber Center and the Office of the
406 Attorney General.
407 (1) (a) A governmental entity that identifies a data breach affecting 500 or more
408 individuals shall notify the Cyber Center and the attorney general of the data breach.
409 (b) In addition to the notification required by Subsection (1)(a), a governmental entity
410 that identifies the unauthorized access, acquisition, disclosure, loss of access, or destruction of
411 data that compromises the security, confidentiality, availability, or integrity of the computer
412 systems used or information maintained by the governmental entity shall notify the Cyber
413 Center.
414 (2) The notification under Subsection (1)(a) shall:
415 (a) be made without unreasonable delay, but no later than five days from the discovery
416 of the data breach; and
417 (b) include the following information:
418 (i) the date and time the data breach occurred;
419 (ii) the date the data breach was discovered;
420 (iii) the total number of people affected by the data breach, including the total number
421 of Utah residents affected;
422 (iv) the type of personal data involved in the data breach;
423 (v) a short description of the data breach that occurred;
424 (vi) the means by which access was gained to the system, computer, or network, if
425 known;
426 (vii) the individual or entity who perpetrated the data breach, if known;
427 (viii) steps the governmental entity is or has taken to mitigate the impact of the data
428 breach; and
429 (ix) any other details requested by the Cyber Center.
430 (3) If the information required by Subsection (2)(b) is not available within five days of
431 discovering the breach, the governmental entity shall provide as much of the information
432 required under Subsection (2)(b) as is available and supplement the notification with additional
433 information as soon as the information becomes available.
434 (4) (a) A governmental entity that experiences a data breach affecting fewer than 500
435 individuals shall create an internal incident report containing the information in Subsection
436 (2)(b) as soon as practicable and shall provide additional information as the information
437 becomes available.
438 (b) A governmental entity shall provide to the Cyber Center:
439 (i) an internal incident report described in Subsection (4)(a) upon request of the Cyber
440 Center; and
441 (ii) an annual report logging all of the governmental entity's data breach incidents
442 affecting fewer than 500 individuals.
443 Section 13. Section 63A-19-406 is enacted to read:
444 63A-19-406. Data breach notice to individuals affected by data breach.
445 (1) A governmental entity shall provide a data breach notice to an individual or legal
446 guardian of an individual affected by the data breach:
447 (a) after determining the scope of the data breach;
448 (b) after restoring the reasonable integrity of the affected system, if necessary; and
449 (c) except as provided in Subsection (1)(b), without unreasonable delay.
450 (2) A governmental entity shall delay providing notification under Subsection (1) at the
451 request of a law enforcement agency that determines that notification may impede a criminal
452 investigation, until such time as the law enforcement agency informs the governmental entity
453 that notification will no longer impede the criminal investigation.
454 (3) The data breach notice to an affected individual shall include:
455 (a) a description of the data breach;
456 (b) the individual's personal data that was accessed or may have been accessed;
457 (c) steps the governmental entity is taking or has taken to mitigate the impact of the
458 data breach;
459 (d) recommendations to the individual on how to protect themselves from identity theft
460 and other financial losses; and
461 (e) any other language required by the Cyber Center.
462 (4) Unless the governmental entity reasonably believes that providing notification
463 would pose a threat to the safety of an individual, or unless an individual has designated to the
464 governmental entity a preferred method of communication, a governmental entity shall provide
465 notice by:
466 (a) email; and
467 (b) one of the following methods, listed in order of preference:
468 (i) text message with a summary of the data breach notice and instructions for
469 accessing the full notice;
470 (ii) telephone message with a summary of the data breach notice and instructions for
471 accessing the full data breach notice; or
472 (iii) mail.
473 (5) A governmental entity shall also provide a data breach notice in a manner that is
474 reasonably calculated to have the best chance of being received by the affected individual or
475 the legal guardian of an individual, such as through a press release, posting on appropriate
476 social media accounts, or publishing notice in a newspaper of general circulation when:
477 (a) a data breach affects more than 500 individuals; and
478 (b) a governmental entity is unable to obtain an individual's contact information to
479 provide notice for any method listed in Subsection (4)(b).
480 Section 14. Section 63A-19-501 is enacted to read:
481
482 63A-19-501. Data privacy ombudsman.
483 (1) The governor shall appoint a data privacy ombudsman with the advice of the
484 governing board.
485 (2) The ombudsman shall:
486 (a) be familiar with the provisions of:
487 (i) this chapter;
488 (ii) Chapter 12, Division of Archives and Records Service and Management of
489 Government Records; and
490 (iii) Title 63G, Chapter 2, Government Records Access and Management Act; and
491 (b) serve as a resource for an individual who is making or responding to a complaint
492 about a governmental entity's data privacy practice.
493 (3) The ombudsman may, upon request by a governmental entity or individual, mediate
494 data privacy disputes between individuals and governmental entities.
495 (4) After consultation with the chief privacy officer or the state privacy officer, the
496 ombudsman may raise issues and questions before the governing board regarding serious and
497 repeated violations of data privacy from:
498 (a) a specific governmental entity; or
499 (b) widespread governmental entity data privacy practices.
500 Section 15. Section 63A-19-601 is enacted to read:
501
502 63A-19-601. Enforcement.
503 (1) Upon instruction by the board, the state auditor shall:
504 (a) investigate alleged violations of this chapter by a governmental entity;
505 (b) provide notice to the relevant governmental entity of an alleged violation of this
506 chapter; and
507 (c) for a violation that the state auditor substantiates, provide an opportunity for the
508 governmental entity to cure the violation within 30 days.
509 (2) If a governmental entity fails to cure a violation as provided in Subsection (1)(c),
510 the state auditor shall report the governmental entity's failure:
511 (a) for a designated government entity, to the attorney general for enforcement under
512 Subsection (3); and
513 (b) for a state agency, to the Legislative Management Committee.
514 (3) After referral by the state auditor under Subsection (2)(a), the attorney general may
515 file an action in district court to enjoin a violation of or require a governmental entity to
516 comply with this chapter.
517 Section 16. Section 63C-24-101 is amended to read:
518
519
520 63C-24-101. Title.
521 This chapter is known as the [
522 Commission."
523 Section 17. Section 63C-24-102 is amended to read:
524 63C-24-102. Definitions.
525 As used in this chapter:
526 (1) "Commission" means the [
527 created in Section 63C-24-201.
528 (2) "Governing board" means the Utah Privacy Governing Board created in Section
529 63A-9-201.
530 (3) "Governmental entity" means the same as that term is defined in Section
531 63G-2-103.
532 [
533
534
535
536 [
537 [
538 63E-1-102.
539 (5) "Office" means the Office of Data Privacy created in Section 63A-19-301.
540 [
541
542 [
543 [
544 personal data.
545 (b) "Privacy practice" includes:
546 (i) a technology use related to personal data; and
547 (ii) policies related to the protection, storage, sharing, and retention of personal data.
548 Section 18. Section 63C-24-201 is amended to read:
549
550 63C-24-201. Utah Privacy Commission created.
551 (1) There is created the [
552 (2) (a) The commission shall be composed of 12 members.
553 (b) The governor shall appoint:
554 (i) one member who, at the time of appointment provides internet technology services
555 for a county or a municipality;
556 (ii) one member with experience in cybersecurity;
557 (iii) one member representing private industry in technology;
558 (iv) one member representing law enforcement; and
559 (v) one member with experience in data privacy law.
560 (c) The state auditor shall appoint:
561 (i) one member with experience in internet technology services;
562 (ii) one member with experience in cybersecurity;
563 (iii) one member representing private industry in technology;
564 (iv) one member with experience in data privacy law; and
565 (v) one member with experience in civil liberties law or policy and with specific
566 experience in identifying the disparate impacts of the use of a technology or a policy on
567 different populations.
568 (d) The attorney general shall appoint:
569 (i) one member with experience as a prosecutor or appellate attorney and with
570 experience in civil liberties law; and
571 (ii) one member representing law enforcement.
572 (3) (a) Except as provided in Subsection (3)(b), a member is appointed for a term of
573 four years.
574 (b) The initial appointments of members described in Subsections (2)(b)(i) through
575 (b)(iii), (2)(c)(iv) through (c)(v), and (2)(d)(ii) shall be for two-year terms.
576 (c) When the term of a current member expires, a member shall be reappointed or a
577 new member shall be appointed in accordance with Subsection (2).
578 (4) (a) When a vacancy occurs in the membership for any reason, a replacement shall
579 be appointed in accordance with Subsection (2) for the unexpired term.
580 (b) A member whose term has expired may continue to serve until a replacement is
581 appointed.
582 (5) The commission shall select officers from the commission's members as the
583 commission finds necessary.
584 (6) (a) A majority of the members of the commission is a quorum.
585 (b) The action of a majority of a quorum constitutes an action of the commission.
586 (7) A member may not receive compensation or benefits for the member's service but
587 may receive per diem and travel expenses incurred as a member of the commission at the rates
588 established by the Division of Finance under:
589 (a) Sections 63A-3-106 and 63A-3-107; and
590 (b) rules made by the Division of Finance in accordance with Sections 63A-3-106 and
591 63A-3-107.
592 (8) A member shall refrain from participating in a review of:
593 (a) an entity of which the member is an employee; or
594 (b) a technology in which the member has a financial interest.
595 (9) The state auditor shall provide staff and support to the commission.
596 (10) The commission shall meet up to [
597 described in Section 63C-24-202.
598 Section 19. Section 63C-24-202 is amended to read:
599 63C-24-202. Commission duties.
600 (1) The commission shall:
601 (a) annually develop a data privacy agenda that identifies for the upcoming year:
602 (i) governmental entity privacy practices to be reviewed by the commission;
603 (ii) educational and training materials that the commission intends to develop;
604 (iii) any other items related to data privacy the commission intends to study; and
605 (iv) best practices and guiding principles that the commission plans to develop related
606 to government privacy practices;
607 (b) develop guiding standards and best practices with respect to government privacy
608 practices;
609 [
610 (i) the privacy implications and civil liberties concerns of the privacy practices of
611 government entities;
612 (ii) best practices for government collection and retention policies regarding personal
613 data; and
614 (iii) best practices for government personal data security standards; [
615 [
616 privacy practices[
617 (e) provide the data privacy agenda to the governing board by May 1 of each year.
618 (2) The commission may, in addition to the approved items in the data privacy agenda
619 prepared under Subsection (1)(a):
620 (a) review specific government privacy practices as referred to the commission by the
621 chief privacy officer described in Section [
622 described in Section 67-3-13; [
623 (b) review a privacy practice not accounted for in the data privacy agenda only upon
624 referral by the chief privacy officer or the state privacy officer in accordance with Subsection
625 63C-24-202(2)(a);
626 (c) review and provide recommendations regarding consent mechanisms used by
627 governmental entities to collect personal information;
628 (d) develop and provide recommendations to the Legislature on how to balance
629 transparency and public access of public records against an individual's reasonable expectations
630 of privacy and data protection; and
631 [
632 best practices the commission has developed in accordance with Subsection (1)(a).
633 (3) [
634 the Judiciary Interim Committee:
635 (a) the results of any reviews the commission has conducted;
636 (b) the guiding standards and best practices described in Subsection [
637 (c) any recommendations for legislation the commission has developed in accordance
638 with Subsection [
639 (4) At least annually, on or before June 1, the commission shall report to the governing
640 board regarding:
641 (a) governmental entity privacy practices the commission plans to review in the next
642 year;
643 (b) any educational and training programs the commission intends to develop in
644 relation to government data privacy best practices;
645 (c) results of the commission's data privacy practice reviews from the previous year;
646 and
647 (d) recommendations from the commission related to data privacy legislation,
648 standards, or best practices.
649 (5) The data privacy agenda detailed in Subsection (1)(a) does not add to or expand the
650 authority of the commission.
651 Section 20. Section 67-3-13 is amended to read:
652 67-3-13. State privacy officer.
653 (1) As used in this section:
654 (a) "Designated government entity" means a government entity that is not a state
655 agency.
656 (b) "Independent entity" means the same as that term is defined in Section 63E-1-102.
657 (c) (i) "Government entity" means the state, a county, a municipality, a higher
658 education institution, a special district, a special service district, a school district, an
659 independent entity, or any other political subdivision of the state or an administrative subunit of
660 any political subdivision, including a law enforcement entity.
661 (ii) "Government entity" includes an agent of an entity described in Subsection
662 (1)(c)(i).
663 (d) [
664
665 [
666 (e) (i) "Privacy practice" means the acquisition, use, storage, or disposal of personal
667 data.
668 (ii) "Privacy practice" includes:
669 (A) a technology use related to personal data; and
670 (B) policies related to the protection, storage, sharing, and retention of personal data.
671 (f) (i) "State agency" means the following entities that are under the direct supervision
672 and control of the governor or the lieutenant governor:
673 (A) a department;
674 (B) a commission;
675 (C) a board;
676 (D) a council;
677 (E) an institution;
678 (F) an officer;
679 (G) a corporation;
680 (H) a fund;
681 (I) a division;
682 (J) an office;
683 (K) a committee;
684 (L) an authority;
685 (M) a laboratory;
686 (N) a library;
687 (O) a bureau;
688 (P) a panel;
689 (Q) another administrative unit of the state; or
690 (R) an agent of an entity described in Subsections (A) through (Q).
691 (ii) "State agency" does not include:
692 (A) the legislative branch;
693 (B) the judicial branch;
694 (C) an executive branch agency within the Office of the Attorney General, the state
695 auditor, the state treasurer, or the State Board of Education; or
696 (D) an independent entity.
697 (2) The state privacy officer shall:
698 (a) when completing the duties of this Subsection (2), focus on the privacy practices of
699 designated government entities;
700 (b) compile information about government privacy practices of designated government
701 entities;
702 (c) make public and maintain information about government privacy practices on the
703 state auditor's website;
704 (d) provide designated government entities with educational and training materials
705 developed by the [
706 Section 63C-24-201 that include the information described in Subsection 63C-24-202(1)(b);
707 (e) implement a process to analyze and respond to requests from individuals for the
708 state privacy officer to review a designated government entity's privacy practice;
709 (f) identify annually which designated government entities' privacy practices pose the
710 greatest risk to individual privacy and prioritize those privacy practices for review;
711 (g) review each year, in as timely a manner as possible, the privacy practices that the
712 privacy officer identifies under Subsection (2)(e) or (2)(f) as posing the greatest risk to
713 individuals' privacy;
714 (h) when reviewing a designated government entity's privacy practice under Subsection
715 (2)(g), analyze:
716 (i) details about the technology or the policy and the technology's or the policy's
717 application;
718 (ii) information about the type of data being used;
719 (iii) information about how the data is obtained, stored, shared, secured, and disposed;
720 (iv) information about with which persons the designated government entity shares the
721 information;
722 (v) information about whether an individual can or should be able to opt out of the
723 retention and sharing of the individual's data;
724 (vi) information about how the designated government entity de-identifies or
725 anonymizes data;
726 (vii) a determination about the existence of alternative technology or improved
727 practices to protect privacy; and
728 (viii) a finding of whether the designated government entity's current privacy practice
729 adequately protects individual privacy; and
730 (i) after completing a review described in Subsections (2)(g) and (h), determine:
731 (i) each designated government entity's use of personal data, including the designated
732 government entity's practices regarding data:
733 (A) acquisition;
734 (B) storage;
735 (C) disposal;
736 (D) protection; and
737 (E) sharing;
738 (ii) the adequacy of the designated government entity's practices in each of the areas
739 described in Subsection (2)(i)(i); and
740 (iii) for each of the areas described in Subsection (2)(i)(i) that the state privacy officer
741 determines to require reform, provide recommendations for reform to the designated
742 government entity and the legislative body charged with regulating the designated government
743 entity.
744 (3) (a) The legislative body charged with regulating a designated government entity
745 that receives a recommendation described in Subsection (2)(i)(iii) shall hold a public hearing
746 on the proposed reforms:
747 (i) with a quorum of the legislative body present; and
748 (ii) within 90 days after the day on which the legislative body receives the
749 recommendation.
750 (b) (i) The legislative body shall provide notice of the hearing described in Subsection
751 (3)(a).
752 (ii) Notice of the public hearing and the recommendations to be discussed shall be
753 posted for the jurisdiction of the designated government entity, as a class A notice under
754 Section 63G-30-102, for at least 30 days before the day on which the legislative body will hold
755 the public hearing.
756 (iii) Each notice required under Subsection (3)(b)(i) shall:
757 (A) identify the recommendations to be discussed; and
758 (B) state the date, time, and location of the public hearing.
759 (c) During the hearing described in Subsection (3)(a), the legislative body shall:
760 (i) provide the public the opportunity to ask questions and obtain further information
761 about the recommendations; and
762 (ii) provide any interested person an opportunity to address the legislative body with
763 concerns about the recommendations.
764 (d) At the conclusion of the hearing, the legislative body shall determine whether the
765 legislative body shall adopt reforms to address the recommendations and any concerns raised
766 during the public hearing.
767 (4) (a) Except as provided in Subsection (4)(b), if the chief privacy officer described in
768 Section [
769 agencies, the state privacy officer may review the privacy practices of a state agency in
770 accordance with the processes described in this section.
771 (b) Subsection (3) does not apply to a state agency.
772 (5) The state privacy officer shall:
773 (a) quarterly report, to the [
774 Commission:
775 (i) recommendations for privacy practices for the commission to review; and
776 (ii) the information provided in Subsection (2)(i); and
777 (b) annually, on or before October 1, report to the Judiciary Interim Committee:
778 (i) the results of any reviews described in Subsection (2)(g), if any reviews have been
779 completed;
780 (ii) reforms, to the extent that the state privacy officer is aware of any reforms, that the
781 designated government entity made in response to any reviews described in Subsection (2)(g);
782 (iii) the information described in Subsection (2)(i);
783 (iv) reports received from designated government entities regarding the sale or sharing
784 of personal data provided under Subsection 63A-19-401(2)(f)(i); and
785 [
786 Subsection (2)(g).
787 Section 21. Repealer.
788 This bill repeals:
789 Section 67-1-17, Chief privacy officer.
790 Section 22. Effective date.
791 This bill takes effect on May 1, 2024.