63A-19-402. Personal data collection -- Privacy notice.

467 words·~2 min read·/ut/title-63a/chapter-19/63a-19-402·

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Effective 3/27/2025

(1)A governmental entity shall provide a privacy notice to an individual, or the legal guardian of an individual, from whom the governmental entity requests or collects personal data.

(2)If the personal data collected by a governmental entity:

(a)would be classified as a public record under Section 63G-2-301 , the privacy notice shall be limited to a statement indicating that the individual's personal data may be available to the public as provided by Section 63G-2-201 ; and

(b)would not be classified as a public record under Section 63G-2-301 , the privacy notice shall describe:

(i)all intended purposes and uses of the personal data;

(ii)the consequences for refusing to provide the personal data;

(iii)the classes of persons and governmental entities:

(A)with whom the governmental entity shares personal data; or

(B)to whom the governmental entity sells personal data; and

(iv)the record series in which the personal data is included.

(3)The governmental entity shall provide the privacy notice by:

(a)posting the privacy notice in a prominent place where the governmental entity collects the personal data;

(b)including the privacy notice as part of any document or form used by the governmental entity to collect the personal data; or

(c)including as part of any document or form used by the governmental entity to collect personal data, a conspicuous link or QR code that links to an electronic version of the privacy notice.

(4)The privacy notice required by this section is in addition to, and does not supersede, any other notice requirement otherwise applicable to the governmental entity.

(a)Notwithstanding Subsections

(1)through (4), a governmental entity may provide the privacy notice required under this section by posting the privacy notice on the governmental entity's government website, or on the public notice website if the governmental entity does not have a government website, when the privacy notice relates to processing activities that:

(i)serve a public safety interest; and

(ii)produce a public benefit that is greater than or equal to the potential impact on an individual's privacy interest that the privacy notice protects.

(b)The processing activities related to public safety described in Subsection (5)(a) may include:

(i)the provision of emergency services;

(ii)law enforcement body or dash camera recordings;

(iii)security camera monitoring;

(iv)ambulance and emergency medical services; and

(v)911 emergency communications.

(6)The governmental entity shall, upon request, provide the privacy notice to an individual, or the legal guardian of an individual, regarding personal data previously furnished by that individual.

(7)The governmental entity may only use personal data furnished by an individual for the purposes identified in the privacy notice provided to that individual.

Amended by Chapter 475 , 2025 General Session