63A-19-204. Commission duties.

464 words·~2 min read·/ut/title-63a/chapter-19/63a-19-204·

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Effective 5/6/2026

(1)The commission shall:

(a)annually develop, approve, and make public by May 1 of each year a data privacy agenda that identifies for the upcoming year:

(i)governmental entity privacy practices to be reviewed by the commission;

(ii)educational and training materials that the commission intends to develop;

(iii)any other items related to data privacy the commission intends to study; and

(iv)best practices and guiding principles that the commission plans to develop related to government privacy practices;

(b)develop guiding standards and best practices with respect to government privacy practices;

(c)develop educational and training materials that include information about:

(i)the privacy implications and civil liberties concerns of the privacy practices of government entities;

(ii)best practices for government collection and retention policies regarding personal data; and

(iii)best practices for government personal data security standards; and

(d)review the privacy implications and civil liberties concerns of government privacy practices.

(2)The commission may, in addition to the approved items in the data privacy agenda prepared under Subsection (1)(a) :

(a)review specific government privacy practices as referred to the commission by the chief privacy officer described in Section 63A-19-302 or the state auditor;

(b)review a privacy practice not accounted for in the data privacy agenda only upon referral by the chief privacy officer or the state auditor in accordance with this section;

(c)review and provide recommendations regarding consent mechanisms used by governmental entities to collect personal data;

(d)develop and provide recommendations to the Legislature on how to balance transparency and public access of public records against an individual's reasonable expectations of privacy and data protection;

(e)develop recommendations for legislation regarding the guiding standards and best practices the commission has developed in accordance with Subsection (1)(a) ;

(f)consult with relevant public and private entities in the performance of the commission's duties listed in Subsection

(1); and

(g)study and recommend which information contained in the privacy program report described in Section 63A-19-401.3 should be a public record.

(3)At least annually, on or before October 1, the commission shall report to the Government Operations Interim Committee:

(a)the results of any reviews the commission has conducted;

(b)the guiding standards and best practices described in Subsection (1)(b) ; and

(c)any recommendations for legislation the commission has developed in accordance with Subsection (2)(d).

(a)Upon request by the governing board, a member of the commission shall give an update on the work of the commission at any governing board meeting.

(b)The governing board may at any time instruct the commission to review and report upon any privacy developments related to governmental privacy within the scope of the commission's duties.

Amended by Chapter 202 , 2026 General Session