Privacy-proof consumer data and stay ahead of UCPA compliance

Personal data under the UCPA is defined as "information that is linked or reasonably linkable to an identified or identifiable individual". This includes data that can be used to directly or indirectly identify a person, such as their name, address, email address and phone number.

The UCPA excludes de-identified data, aggregated data, or publicly available information as personal data. Data regulated by the Health Insurance Portability and Accountability Act (HIPAA), the Driver's Privacy Protection Act, and the Family Education Rights and Privacy Act (FERPA) are also exempted from its scope.

The UCPA defines a sale as, "the exchange of personal data for monetary consideration by a controller to a third party." UCPA does not include CCPA/CPRA's definition of sale which involves personal data exchanged for "other valuable consideration" on top of monetary consideration.

The UCPA also excludes certain types of disclosures to third parties from the definition of sale, including disclosures for the purpose of providing products or services and for the purpose consistent with a consumer's reasonable expectations.

In addition, a sale does not occur under UCPA if the disclosure is made to processors and affiliates of the data controller.

Utah Attorney General (AG) has exclusive authority to enforce the UCPA. However, under the Act, the enforcement actions by the Attorney General may be initiated after a referral from the Utah Division of Consumer Protection. The Division receives consumer complaints, conducts an investigation, and then refers the matter to the AG if there's substantial evidence to support a violation identified in the consumer complaint. The AG can then issue a formal notice of violation and grant the business 30 days to cure before taking enforcement action.

Here are some links you can refer to for additional reading:

• A Quick Guide to Utah UCPA
• Official Text: Utah Consumer Privacy Act