HB 444: Data Privacy Amendments - Utah

Substitute #4 → Enrolled · 2 edits · Mar 27, 2025

MINOR

The bill was finalized with minor formatting corrections to the list of affected code sections and a change in the effective date from February 28, 2025, to March 11, 2025. The substantive policy content regarding data privacy definitions, auditor duties, and website posting requirements remains unchanged from the previous version.

Scope change

No change in the scope or applicability of the bill; the changes are limited to technical formatting and the effective date.

TIMELINE

The bill's effective date was moved from February 28, 2025, to March 11, 2025, likely to allow time for final review or administrative preparation.

TECHNICAL

The list of Utah Code sections affected was reformatted to include the newly enacted sections (ending in .1, .2, etc.) and to correct the ordering of repealed sections, ensuring the final text accurately reflects all legislative actions.

Introduced → Substitute #1 · 8 edits

MODERATE

This bill amends Utah's data privacy laws to create a more robust framework for protecting personal data held by government entities. Key changes include renaming the State Privacy Auditor to State Privacy Auditor (with new duties), establishing a new Utah Privacy Commission, creating a Data Privacy Ombudsperson, and updating definitions to align with modern data practices like high-risk processing and synthetic data. The bill also introduces new requirements for privacy notices on websites, mandates annual reporting on data sharing/sales, and sets specific deadlines for implementing privacy programs and training.

Scope change

The bill expands the scope of data privacy requirements to include specific new categories of data (e.g., synthetic data, geolocation data) and clarifies the obligations of contractors and designated governmental entities. It also adds a new mechanism for resolving disputes via an Ombudsperson.

REQUIREMENT

Created a new Utah Privacy Commission with 12 members to develop data privacy standards and review government privacy practices.

Established a new Data Privacy Ombudsperson to mediate disputes and raise issues regarding serious privacy violations.

Renamed the State Privacy Auditor role and expanded its duties to include auditing privacy practices of designated governmental entities.

Added new requirements for website privacy notices, including disclosure of website tracking technology and user data collection.

Mandated annual reporting by designated governmental entities regarding the types of personal data they share or sell.

DEFINITION

Updated definitions to include 'high-risk processing activities' (e.g., facial recognition, automated decision making) and 'synthetic data'.

TIMELINE

Adjusted effective dates and deadlines for privacy program implementation, with some provisions effective May 1, 2024, and others May 7, 2025.

ENFORCEMENT

Clarified enforcement mechanisms, including the state auditor's role in investigating violations and the attorney general's authority to file court actions.

Substitute #3 → Substitute #4 · 8 edits

MODERATE

This bill updates Utah's data privacy laws by renaming the state privacy auditor to the state privacy auditor, clarifying definitions of personal data and privacy practices, and establishing new requirements for privacy annotations, training, and breach notifications. The changes aim to strengthen privacy protections for individuals while modernizing oversight mechanisms.

Scope change

The bill expands privacy requirements to include new categories of data processing activities and extends contractor obligations to match governmental entity requirements.

DEFINITION

Updated definitions to include modern terms like 'automated decision making,' 'profiling,' 'biometric data,' and 'synthetic data' to reflect current technology risks.

Renamed 'state privacy officer' to 'state privacy auditor' and clarified the role's responsibilities for auditing designated governmental entities.

REQUIREMENT

Requires governmental entities to create privacy annotations for record series containing personal data by July 1, 2027, with specific inventory and purpose documentation.

Requires data privacy training for all employees with access to personal data within 30 days of employment and annually thereafter.

Mandates website privacy notices for government websites, including disclosure of tracking technology and user data collection practices.

TIMELINE

Adjusted implementation deadlines for privacy programs, training requirements, and breach reporting to provide clearer compliance timelines.

ENFORCEMENT

Establishes a Utah Privacy Commission with 12 members to oversee privacy practices and develop best practices for government data handling.

Enhanced data breach notification requirements with specific timelines and information disclosure obligations to the Cyber Center and Attorney General.

Substitute #2 → Substitute #3 · 6 edits

MODERATE

This bill amends Utah's data privacy laws by renaming the state privacy auditor to state privacy officer, updating definitions to use 'personal data' instead of 'personal identifying information', and modifying requirements for privacy annotations and government website notices. The changes clarify terminology and adjust oversight responsibilities while maintaining the core privacy protection framework.

Scope change

The bill maintains the same scope of applicability to governmental entities but updates terminology and oversight roles to better align with modern data privacy concepts.

DEFINITION

Renamed 'state privacy auditor' to 'state privacy officer' and updated related terminology throughout the code.

Changed 'personal identifying information' to 'personal data' in multiple sections to align with modern privacy terminology.

REQUIREMENT

Updated privacy annotation requirements to focus on personal data rather than personal identifying information.

Modified government website privacy notice requirements to include user data collection disclosures.

ENFORCEMENT

Adjusted the state auditor's privacy oversight duties and reporting requirements.

TECHNICAL

Made technical and conforming changes to align terminology and cross-references throughout the code.

Substitute #1 → Substitute #2 · 8 edits

MODERATE

This bill updates Utah's data privacy laws by renaming the 'state privacy auditor' to 'state privacy auditor' (clarifying the role), creating a new Utah Privacy Commission with 12 members, and establishing a Utah Office of Data Privacy. It adds requirements for privacy annotations on government records, expands data breach notification rules, and clarifies definitions for personal data and privacy practices. The changes aim to modernize privacy oversight and improve transparency in how government entities handle personal information.

Scope change

The bill expands the scope of privacy oversight by creating new entities (Utah Privacy Commission and Utah Office of Data Privacy) and extends requirements to include privacy annotations for government record series, website privacy notices, and contractor compliance.

REQUIREMENT

New requirement for state agencies to create privacy annotations for record series containing personal data by July 1, 2027, which must include an inventory of personal data types, purposes for collection, and legal authority.

Added requirement for government websites to include privacy notices about tracking technology, user data collection, and how to access or correct personal data.

Added training requirements for all employees with access to personal data, requiring completion within 30 days of employment and annually thereafter.

Added requirements for contractors to complete data privacy training and comply with privacy chapter requirements when processing personal data for government entities.

DEFINITION

Added new definitions including 'high-risk processing activities' (facial recognition, automated decision making, profiling), 'user data' (automatically collected website information), and 'synthetic data' (artificial data generated from personal data).

Renamed 'state privacy officer' to 'state privacy auditor' and redefined the role to focus on auditing designated governmental entities' privacy practices.

ENFORCEMENT

Modified data breach notification requirements to notify the Cyber Center and Attorney General within five days for breaches affecting 500+ individuals, with additional requirements for breaches compromising computer system security.

TIMELINE

Modified effective dates for various provisions, with most changes taking effect upon governor's approval and some provisions phased in by May 7, 2025, or July 1, 2025.

Data Privacy Amendments

What changed between versions

How they voted

Actions timeline

Sponsors