Utah Amends Data Breach Notification Law

Utah Gov. Spencer Cox on March 23 signed into law Senate Bill 127, which amends the state’s data breach notification statutes.  The amendments go into effect May 2, 2023.

The amendments include:

- Creation of the Utah Cyber Center, which will partner with various other state agencies and will, in part:

[article_ad]

• develop a statewide strategic cybersecurity plan for executive branch agencies and other governmental entities;
• identify, analyze, and mitigate cyber threats and vulnerabilities;
• coordinate cybersecurity resilience planning;
• provide cybersecurity incident response capabilities;
• recommend to the division standards to increase the cyber resilience of executive branch agencies;
• promote cybersecurity best practices;
• share cyber threat intelligence with governmental entities.

- A requirement that if any person who owns or licenses computerized data that includes personal information concerning a Utah resident becomes aware of a breach of system security and the investigation reveals that the misuse of personal information relating to 500 or more Utah residents has occurred or is reasonably likely to occur, the breach notification must be provided to the Attorney General and the Utah Cyber Center, in addition to the residents affected.

- A requirement that if the breach relates to 1,000 or more Utah residents, the notification must additionally be provided to each consumer reporting agency.

- A provision that information submitted to the Attorney General and the Utah Cyber Center related to a breach is presumed to be confidential and protected and can only be disclosed if necessary to prevent imminent and substantial harm, or the information is anonymized or aggregated in such a way that prevents disclosure of a trade secret.