Data Privacy Amendments

Added a new data privacy complaint process requiring individuals to submit complaints to the agency first before requesting mediation.

Added a new section requiring contractors to comply with privacy laws to the same extent as governmental entities.

Added a new section requiring state agencies to create privacy annotations for record series containing personal data by July 1, 2027.

Modified the Utah Privacy Commission composition to include a new member representing the public as a private citizen.

Modified surveillance reporting requirements to include 'all intended purposes and uses of personal data' rather than just a general description.

Modified surveillance review frequency from annual to biannual for entities implementing the technology.

Modified the Office of Data Privacy's ability to issue extensions, limiting them to one-time extensions of no longer than 12 months.

Modified the Chief Privacy Officer's reporting deadline from October 1 to June 30.

Modified the Chief Privacy Officer's reporting committee from the Judiciary Interim Committee to the Government Operations Interim Committee.

Added a new definition for 'Data privacy complaint' to formally recognize the new complaint process.

Modified surveillance authorization deadlines, shifting the initial reporting date from November 30, 2026, to November 30, 2027.

Modified the deadline for existing surveillance technologies to obtain continued authorization from May 6, 2027, to May 6, 2028.

Removed the 'State Privacy Auditor' as a distinct role, transferring its duties to the State Auditor's office.

Updated definitions of 'personal data' and related privacy terms to align with the final legislative intent.

Modified the Utah Privacy Commission's composition to include members appointed by the State Board of Education, city/county representatives, and others, replacing the previous structure.

Amended conflict of interest disclosure requirements for state officials to include specific details about household members and employment history.

Adjusted the deadline for registering local government entities with the Lieutenant Governor and modified the State Auditor's authority to withhold funds from non-compliant entities.

Corrected section numbers throughout the bill (e.g., changing references from 63G-2-303 to 63A-19-408) and fixed formatting errors in the 'Utah Code Sections Affected' list.

Replaced the 'State Privacy Auditor' role with a new 'Utah Office of Data Privacy' and restructured the 'Utah Privacy Commission' to include representatives from cities, counties, and public education.

Repealed the standalone 'State Privacy Auditor' position, transferring its responsibilities to the State Auditor's office and the new Office of Data Privacy.

Mandated annual data privacy training for all government employees who access personal data, with completion required within 30 days of hiring.

Required state agencies to create 'privacy annotations' for record series containing personal data, detailing what data is collected and why.

Required government entities to report specific details about data breaches to the Cyber Center and Attorney General, including the number of affected individuals and types of data compromised.

Established a formal data privacy complaint process involving a new ombudsperson and mediation options for disputes between individuals and government entities.

Added new definitions for 'high-risk processing activities' (including facial recognition and profiling) and expanded 'personal data' to include passive data collection.

Expanded conflict of interest disclosure requirements for state officials to include spouses and household members, with redaction options for at-risk government employees.

Transfers support and oversight of the Utah Privacy Commission from the State Auditor's office to the new Utah Office of Data Privacy.

Repeals the 'state privacy auditor' position and removes related provisions from the State Auditor's duties.

Creates a new data privacy ombudsman role and establishes a formal complaint process for individuals to resolve privacy disputes with government entities.

Mandates annual data privacy training for all government employees who access personal data, with specific completion deadlines.

Requires government entities to create privacy annotations for record series containing personal data to clarify what data is collected and why.

Requires government entities to report non-compliant processing activities and strategies for bringing them into compliance.

Expands definitions of 'personal data' to include synthetic data, website tracking technology, and passive data collection activities.

Updates deadlines for privacy program initiation and breach reporting, including new requirements for notifying the Cyber Center of security incidents.

Replaced the State Privacy Auditor with a new Utah Office of Data Privacy and restructured the Utah Privacy Commission to include members from state agencies, cities, counties, and public education.

Established a mandatory data privacy complaint process where individuals must first file complaints with the government entity before seeking mediation.

Required all government employees with access to personal data to complete annual privacy training within 30 days of employment.

Mandated that state agencies create 'privacy annotations' for record series containing personal data by July 2027 to document data types and legal authority.

Expanded data breach notification requirements to include incidents affecting fewer than 500 individuals, requiring internal reporting and annual logging.

Extended the deadline for government entities to initiate data privacy programs from 2025 to 2027.

Created a new Data Privacy Ombudsperson role within the Office of Data Privacy to mediate disputes and educate the public.

Added new definitions for terms such as 'profiling,' 'synthetic data,' and 'high-risk processing activities' to modernize the legal framework.

Mandates public authorization and annual reporting for high-risk surveillance technologies like facial recognition, license plate readers, and persistent aerial surveillance.

Establishes a formal data privacy complaint process involving a new Data Privacy Ombudsman and requires a specific complaint resolution workflow.

Requires state agencies to create 'privacy annotations' for record series containing personal data by July 2027 to improve transparency.

Expands conflict of interest disclosure requirements for state officials to include detailed information about household members and specific employment details.

Requires contractors processing personal data for state entities to comply with the same data privacy training and compliance standards as the government entities themselves.

Introduces new definitions for 'synthetic data,' 'profiling,' 'automated decision making,' and 'high-risk processing activities' to modernize privacy standards.

Transfers support for the Utah Privacy Commission from the State Auditor's office to a newly created Office of Data Privacy and repeals the State Privacy Auditor position.

Repeals the State Privacy Auditor position (Section 67-3-13) and removes the requirement for the State Auditor to provide staff and support to the Privacy Commission.

Updates the definition of 'private records' to explicitly include new categories such as electronic toll collection data, military overseas ballots, and specific voter registration details.

Sets a deadline of July 1, 2027, for state agencies to initiate privacy programs and begin creating privacy annotations for their records.