Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

core/heading

Consumer Data Privacy and Online Monitoring

core/paragraph

Available at: <a href="https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf">https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf</a>

Data Breach Requirements: Utah Code § 13-44-102 et seq.

The numbering and internal citations herein are derived from the applicable state statute.

The term “personal information” means a person’s first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or date element is unencrypted or not protected by another method that renders the data unreadable or unusable: (i) Social Security number; (ii)(A) financial account number, or credit or debit card number, and (B) any required security code, access code, or password that would permit access to the person’s account; or (iii) Driver’s license number or state identification card number.

core/separator

The term “breach of system security” means an unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information.

A “breach of system security” does not include the acquisition of personal information by an employee or agent of the person possessing unencrypted computerized data unless the personal information is used for an unlawful purpose or disclosed in an unauthorized manner.

A person who owns or licenses computerized data that includes personal information concerning a Utah resident shall, when the person becomes aware of a breach of system security, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused for identity theft or fraud purposes. If such an investigation reveals that the misuse of personal information for identity theft or fraud purposes has occurred, or is reasonably likely to occur, the person shall provide notification to each affected Utah resident.

The breach notification shall be provided in the most expedient time possible without unreasonable delay: considering legitimate investigative needs of law enforcement, after determining the scope of the breach of system security, and after restoring the reasonable integrity of the system.

A person may delay providing the breach notification at the request of a law enforcement agency that determines that notification may impede a criminal investigation. A person who delays providing notification under subsection (4)(a) shall provide notification in good faith without unreasonable delay in the most expedient time possible after the law enforcement agency informs the person that notification will no longer impede the criminal investigation.

5(a) A breach notice may be provided by one of the following methods: (i) in writing by first-class mail to the most recent address the person has for the resident; (ii) electronically, if the person’s primary method of communication with the resident is by electronic means, or if provided in accordance with the consumer disclosure provisions of 15 U.S.C. § 7001 (The Electronic Signatures in Global and National Commerce Act); (iii) by telephone, including through the use of automatic dialing technology not prohibited by other law; or (iv) for residents of the state for whom notification in a manner described in subsections (5)(a)(i) through (iii) is not feasible, by publishing notice of the breach of system security: (A) in a newspaper of general circulation; and (B) as required in Section 45-1-101 (See Other Information).

The data breach notification law does not apply to a financial institution or an affiliate, as defined in 15 U.S.C. Sec. 6809, of a financial institution.

A person who is regulated by state or federal law and maintains procedures for a breach of system security under applicable law established by the primary state or federal regulator is considered to be in compliance with this part if the person notifies each affected Utah resident in accordance with the other applicable law in the event of a breach.

A person who maintains computerized data that includes personal information that the person does not own or license shall notify and cooperate with the owner or licensee of the information of any breach of system security immediately following the person’s discovery of the breach if misuse of the personal information occurs or is reasonably likely to occur. Cooperation includes sharing information relevant to the breach with the owner or licensee of the information.

§ 45-1-101. Legal notice publication requirements: (1) As used in this section: (a) “Average advertisement rate” means: (i) in determining a rate for publication on the public legal notice website or in a newspaper that primarily distributes publications in a county of the third, fourth, fifth, or sixth class, a newspaper’s gross advertising revenue for the preceding calendar quarter divided by the gross column-inch space used in the newspaper for advertising for the previous calendar quarter; or (ii) in determining a rate for publication in a newspaper that primarily distributes publications in a county of the first or second class, a newspaper’s average rate for all qualifying advertising segments for the preceding calendar quarter for an advertisement: (A) published in the same section of the newspaper as the legal notice; and (B) of the same column-inch space as the legal notice. (b) “Column-inch space” means a unit of space that is one standard column wide by one inch high. (c) “Gross advertising revenue” means the total revenue obtained by a newspaper from all of its qualifying advertising segments. (d)(i) “Legal notice” means: (A) a communication required to be made public by a state statute or state agency rule; or (B) a notice required for judicial proceedings or by judicial decision. (ii) “Legal notice” does not include: (A) a public notice published by a public body in accordance with the provisions of Sections 52-4-202 and 63A-16-601; or (B) a notice of delinquency in the payment of property taxes described in Section 59-2-1332.5. (e) “Local district” is as defined in Section 17B-1-102. (f) “Public legal notice website” means the website described in Subsection (2)(b) for the purpose of publishing a legal notice online. (g)(i) “Qualifying advertising segment” means, except as provided in Subsection (1)(g)(ii), a category of print advertising sold by a newspaper, including classified advertising, line advertising, and display advertising. (ii) “Qualifying advertising segment” does not include legal notice advertising. (h) “Special service district” is as defined in Section 17D-1-102. (2) Except as provided in Subsections (8) and (9), notwithstanding any other legal notice provision established by law, a person required by law to publish legal notice shall publish the notice: (a)(i) as required by the statute establishing the legal notice requirement; or (ii) by serving legal notice, by certified mail or in person, directly on all parties for whom the statute establishing the legal notice requirement requires legal notice, if: (A) the direct service of legal notice does not replace publication in a newspaper that primarily distributes publications in a county of the third, fourth, fifth, or sixth class; (B) the statute clearly identifies the parties; (C) the person can prove that the person has identified all parties for whom notice is required; and (D) the person keeps a record of the service for at least two years; and (b) on a public legal notice website established by the combined efforts of Utah’s newspapers that collectively distribute newspapers to the majority of newspaper subscribers in the state. (3) The public legal notice website shall: (a) be available for viewing and searching by the general public, free of charge; and (b) accept legal notice posting from any newspaper in the state. (4) A person that publishes legal notice as required under Subsection (2) is not relieved from complying with an otherwise applicable requirement under Title 52, Chapter 4, Open and Public Meetings Act. (5) If legal notice is required by law and one option for complying with the requirement is publication in a newspaper, or if a local district or a special service district publishes legal notice in a newspaper, the newspaper: (a) may not charge more for publication than the newspaper’s average advertisement rate; and (b) shall publish the legal notice on the public legal notice website at no additional cost. (6) If legal notice is not required by law, or if legal notice is required by law and the person providing legal notice, in accordance with the requirements of law, chooses not to publish the legal notice in a newspaper, or if a local district or a special service district with an annual operating budget of less than $250,000 chooses to publish a legal notice on the public notice website without publishing the complete notice in the newspaper, a newspaper: (a) may not charge more than an amount equal to 15% of the newspaper’s average advertisement rate for publishing five column lines in the newspaper to publish legal notice on the public legal notice website; (b) may not require that the legal notice be published in the newspaper; and (c) at the request of the person publishing on the legal notice website, shall publish in the newspaper up to five column lines, at no additional charge, that briefly describe the legal notice and provide the web address where the full public legal notice can be found. (7) If a newspaper offers to publish the type of legal notice described in Subsection (5), it may not refuse to publish the type of legal notice described in Subsection (6). (8) Notwithstanding the requirements of a statute that requires the publication of legal notice, if legal notice is required by law to be published by a local district or a special service district with an annual operating budget of $250,000 or more, the local district or special service district shall satisfy its legal notice publishing requirements by: (a) mailing a written notice, postage prepaid: (i) to each voter in the local district or special service district; and (ii) that contains the information required by the statute that requires the publication of legal notice; or (b) publishing the legal notice in a newspaper and on the legal public notice website as described in Subsection (5). (9) Notwithstanding the requirements of a statute that requires the publication of legal notice, if legal notice is required by law to be published by a local district or a special service district with an annual operating budget of less than $250,000, the local district or special service district shall satisfy its legal notice publishing requirements by: (a) mailing a written notice, postage prepaid: (i) to each voter in the local district or special service district; and (ii) that contains the information required by the statute that requires the publication of legal notice; or (b) publishing the legal notice in a newspaper and on the public legal notice website as described in Subsection (5); or (c) publishing the legal notice on the public legal notice website as described in Subsection (6).

Data Disposal and Security: Utah Code § 13-44-201.

The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.

The term “personal information” means a person’s first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or date element is unencrypted or not protected by another method that renders the data unreadable or unusable: (i) Social Security number; (ii)(A) Financial account, credit, or debit card number; and (B) Any required security code, access code, or password that would permit access to the person’s account; or (iii) Driver’s license number or state identification card number.

Any person who conducts business in the state and maintains personal information shall implement and maintain reasonable procedures to prevent unlawful use or disclosure of personal information collected or maintained in the regular course of business.

Any person who conducts business in the state and maintains personal information shall implement and maintain reasonable procedures to destroy, or arrange for the destruction of, records containing personal information that are not to be retained by the person. The destruction of records shall be by: (a) Shredding; (b) Erasing; or (c) Otherwise modifying the personal information to make the information indecipherable.