Utah is likely the next in line to pass a comprehensive consumer privacy law, joining the ranks of California, Colorado, and Virginia. Senate Bill 227, the Utah Consumer Privacy Act (UCPA), was passed by the Utah legislature and sent to Governor Spencer Cox’s desk on March 3. Governor Cox has 20 days in which to either sign the bill into law or veto it, and if no action is taken the bill will become law. If enacted in its current form, the UCPA would take effect December 31, 2023.

UCPA Requirements

The bill shares similarities with the Virginia Consumer Data Privacy Act (VCDPA) and the Colorado Privacy Act (Colorado CPA) but is expected to be more business-friendly. The key features of the bill are:

• Applicability. Subject to certain exceptions, the UCPA directly applies to both organizations that determine the means and purposes of processing personal data (controllers) as well as other organizations that process personal data on their behalf (processors), and which either do business in Utah or produce a product or service that is targeted to consumers who are Utah residents, have annual revenue of $25M or more, and either (i) control or process personal data of 100,000 or more Utah consumers during a calendar year, or (ii) derive over 50% of the entity's gross revenue from the sale of personal data and control or process the personal data of 25,000 or more Utah consumers. Unlike the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the...

Read Full Story: https://www.foley.com/en/insights/publications/2022/03/utah-fourth-state-pass...