Law note · Utah
Utah Consumer Privacy Act, sensitive and biometric data provisions
Defines biometric data as data generated by automatic measurement of an individual's unique biological characteristics, naming fingerprint, voiceprint, retina, iris, or any other unique biological pattern used to identify a specific individual, but excludes any physical or digital photograph, video or audio recording, or data generated from one.
Biometric and genetic data become sensitive data, alongside racial or ethnic origin, religious belief, sexual orientation, citizenship or immigration status, certain medical information, and specific geolocation, only when processed for the purpose of identifying a specific individual. A controller may not process sensitive data without first giving clear notice and an opportunity to opt out, an opt-out rather than opt-in model.
What it asks of an app
- Give Utah consumers clear notice and an opportunity to opt out before processing their sensitive data, including biometric data such as a voiceprint, retina scan, iris scan, or fingerprint collected for the purpose of identifying a specific individual.
- Treat an identifier your app generates only from a photograph, or from a video or audio recording, as outside biometric data under this law; this notice-and-opt-out duty does not reach it.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, trains_models, deploys_chatbot
Primary source: official Utah Code text, Utah State Legislature