Utah is on the brink of joining California, Colorado, and Virginia to become the fourth state in the US to enact a major comprehensive privacy law. On February 25, the Utah Senate passed the Utah Consumer Privacy Act (“UCPA”), and on March 2, it was passed by the Utah House. The bill officially went to Governor Spencer Cox’s desk on March 15 and he has 20 days to sign or veto, or the UCPA automatically becomes law. If the governor vetoes the bill (which is unlikely), the Utah legislature has sufficient votes to override, because it was passed unanimously.
Who does the UCPA apply to?
The UCPA applies to any “controller” or “processor” who: (a) conducts business in Utah or produces a product or service that is targeted to Utah residents; (b) has annual revenue of $25M or more; and (c) satisfies at least one of the following: (i) during a calendar year, controls or processes personal data of 100,000 or more consumers; or (ii) derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.
A "consumer" under the UCPA means an individual who is a resident of Utah acting in an individual or household context. "Consumer" does not include an individual acting in an employment or commercial context. A "controller" under the UCPA means a person doing business in Utah who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the...
Read Full Story:
https://www.natlawreview.com/article/utah-consumer-privacy-act-mintz-s-hot-take