Law note · Utah
Utah Consumer Privacy Act, publicly-available-information exemption and biometric data
What it asks of an app
- Do not treat personal data scraped from a data broker, aggregator, or re-hosted directory as publicly available under the Utah Consumer Privacy Act; the exemption requires a government record or the consumer's own lawful disclosure.
- Do not treat a bare scraped photograph, video, or audio recording as biometric data on its own; it becomes biometric, and then sensitive, data once you process it to identify a specific individual.
- There is no private right of action under this Act; only the Utah Attorney General enforces it, with a 30-day cure period.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Section 13-61-101(29) defines publicly available information with three prongs: information a person lawfully obtains from a governmental record, information a consumer or widely distributed media has lawfully made available to the general public, or information obtained from a person the consumer disclosed it to without restricting the audience, a near match to California's CCPA test and broader than Colorado's two-prong version.
Personal data scraped from a source that is neither a government record nor something the consumer themselves put out, such as a data broker or re-hosted directory, is not publicly available under this Act.
Biometric data under Section 13-61-101(6) means data from automatic measurement of an individual's unique biological characteristics used to identify a specific individual, and expressly excludes a physical or digital photograph, a video or audio recording, and data generated from either, the same structural exclusion Colorado uses.
Processing genetic or biometric data for the purpose of identifying a specific individual is sensitive data under Section 13-61-101(32)(a)(ii), triggering opt-in consent. Enforcement is Attorney-General-exclusive with a 30-day cure period and no private right of action; the Act took effect December 31, 2023.