Can I collect personal information from participants in Utah? What are the requirements?

Collecting Personal Information in Utah

If you plan to collect personal information from participants in Utah, you must comply with the state’s laws and regulations regarding the protection of personal information.

Protection of Personal Information

Utah Code UTCO 13-44-201 requires any person who conducts business in the state and maintains personal information to implement and maintain reasonable procedures to prevent unlawful use or disclosure of personal information collected or maintained in the regular course of business. Additionally, records containing personal information that are not to be retained by the person must be destroyed by shredding, erasing, or otherwise modifying the personal information to make the information indecipherable.

Disclosure of System Security Breach

Utah Code UTCO 13-44-202 requires a person who owns or licenses computerized data that includes personal information concerning a Utah resident to conduct a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused for identity theft or fraud purposes when the person becomes aware of a breach of system security. If an investigation reveals that the misuse of personal information for identity theft or fraud purposes has occurred or is reasonably likely to occur, the person shall provide notification to each affected Utah resident.

Procedures for Verification of Information

Utah Administrative Code UTAC R708-43-5 outlines the procedures for verification of information through the ValIDate system. When submitting a query in ValIDate, the requestor shall enter the subject’s name as it appears on the Utah Driver License or Identification card, the subject’s Utah Driver License or Identification card number, and the subject’s date of birth. Upon submittal of an electronic request for verification, ValIDate will search the Utah Driver License Division Database and furnish a “YES” or “NO” response. A “YES” response verifies the name, Utah Driver License or Identification card number, and date of birth, matches the information in the Utah Driver License Division Database.

Use of Personally Identifiable Information

Utah Administrative Code UTAC R895-8-6 states that any personally identifiable information an individual provides to a State website shall be used solely by the State, its entities, and third party agents with whom it has contracted to perform a state function on its behalf, unless superseded by a federal statute, federal regulation, or State statute, or the information is designated as public record by an individual State agency as authorized under Title 63G, Chapter 2 of the Utah Code, Government Records Access and Management Act.

Conclusion

To collect personal information from participants in Utah, you must comply with the state’s laws and regulations regarding the protection of personal information, disclosure of system security breach, procedures for verification of information, and use of personally identifiable information.

Jurisdiction

Utah

• Privacy