News and Views
Media Coverage

New Utah Privacy Law ‘Lighter’ than Predecessors

Compliance Week

Utah has become the fourth U.S. state to pass a comprehensive data privacy law, with others potentially on the way during this legislative session.

The Utah Consumer Privacy Act (S.B. 227) was signed into law March 24 by Gov. Spencer Cox (R). Utah joins California, Virginia, and Colorado as states with comprehensive laws that order companies that collect personal data to allow their customers to opt out of the collecting of certain data; to access and delete some types of data upon request; and to be transparent about why they collect data and whether it is sold to third parties.

[...]

Alex Nisenbaum, partner with law firm Blank Rome, said Utah’s law might “herald a path forward for more business-friendly comprehensive privacy laws,” noting the Utah law scales back multiple requirements that are part of other state privacy laws.

Cho said many companies likely won’t specifically seek to comply with the particulars of Utah’s law but will fulfill data privacy requests from customers anywhere in the country.

“Most of them don’t want to have an emailed back-and-forth about why they are denying a request based on jurisdiction or don’t have the resources to do so,” she said. “They’d just rather offer the rights universally, regardless of state residency.”

Nisenbaum agreed with that assessment.

“The biggest question we get from clients is what do I have to do in terms of a high-water mark so I don’t have to use five different internal mechanisms to comply with five laws,” he said. “Companies may not find it worthwhile to screen out whether a request is coming from California versus another jurisdiction with similar but slightly different rights.”

To read the full article, please click here.

"New Utah Privacy Law ‘Lighter’ than Predecessors," by Aaron Nicodemus was published in Compliance Week on March 30, 2022.