USA – UTAH Trends and Developments Contributed by: Clifford Blair, Kirton McConkie
Act requires organisations to implement reasonable administrative, technical and physical security safe - guards. Strong security controls also support incident response readiness. Breach response planning should include defined roles, communication protocols and documentation procedures. Enforcement Structure and Cure Provisions Utah employs a hybrid enforcement model. The Utah Division of Consumer Protection investigates com - plaints and refers matters to the Attorney General. The Attorney General has exclusive authority to bring enforcement actions. If a violation is identified, the Attorney General must provide written notice and a 30-day opportunity to cure. Civil penalties may reach USD7,500 per violation for uncured violations. Unlike California (but similar to Colorado and Virginia), Utah provides no private right of action under the Utah Consumer Privacy Act. Utah also has no standalone dedicated enforcement agency for privacy, as does California. Notably, neither the Division of Consumer Protection nor the Attorney General is empowered to promulgate privacy regulations. This absence pro - vides predictability for organisations subject to the statute. Cybersecurity and Breach Co-Ordination: Senate Bill 127 Following the adoption of the Utah Consumer Priva - cy Act, in 2023 the Utah Legislature passed Senate Bill 127, which strengthens breach notification and cybersecurity governance in Utah. Entities owning or licensing computerised personal data must investi - gate suspected breaches and provide timely notice where misuse for identity theft or fraud is confirmed. Breaches of relevant data affecting 500 or more resi - dents must be reported to the Attorney General and the Utah Cyber Center. Data covered by the breach notification requirement is similar to other US jurisdic - tions and is limited to Social Security number, driver licence or State Identification number, and financial account information that would permit access to the account. Governmental entities must report breaches to the Utah Cyber Center. The Utah Cyber Center co-ordinates statewide cyber - security planning, incident response, and threat infor -
mation sharing. From 1 January 2025, governmen - tal entities must generally use authorised top-level domains such as.gov,.edu or.mil for official commu - nications, subject to limited exceptions. These meas - ures illustrate Utah’s investment in structured cyber - security infrastructure. Electronic Information and Law Enforcement: Senate Bill 226 In the year after the adoption of the Utah Consumer Privacy Act, the legislature strengthened privacy pro - tections in the context of law enforcement by adopt - ing Senate Bill 226, which limits access to electronic data. Law enforcement agencies must obtain a search warrant based on probable cause before accessing location information, stored data or transmitted data from electronic devices, except in defined emergency or consent-based circumstances. Data not covered by a warrant must be destroyed in an unrecovera - ble manner. Agencies may not use, copy or disclose information outside the scope of the warrant, subject to narrow exceptions. The statute protects providers acting in good faith reliance on a warrant from liabil - ity. The statute reinforces judicial oversight and aligns Utah more closely with global expectations regarding digital privacy safeguards. Social Media Regulation and Youth Protection Utah has been at the forefront among US states in regulating social media platforms, particularly with respect to minors; however, Utah’s efforts have been marked by sustained legislative action and ongoing constitutional litigation. In March 2023, the Utah Leg - islature enacted the Utah Social Media Regulation Act through SB 152 and HB 311, imposing age veri - fication, parental consent requirements, advertising restrictions, and limits on certain platform features. Those provisions were challenged on constitutional grounds and ultimately repealed and replaced in 2024 with a revised framework, including the Minor Protec - tion in Social Media Act (SB 194/HB 464), which was designed to refine age-assurance systems, strengthen default privacy protections, restrict features such as autoplay, and provide supervisory tools for parents. The revised law was scheduled to take effect on 1 October 2024, but on 10 September 2024 a federal district court granted a preliminary injunction block -
623 CHAMBERS.COM
Powered by FlippingBook