Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party marketing automation tools that collect personal information in Utah? What are the requirements?

Use of Third-Party Marketing Automation Tools in Utah

Based on the provided documents, the use of third-party marketing automation tools that collect personal information in Utah is subject to certain requirements.

Personally Identifiable Information

According to UTAC R895-8-6[2.1], any personally identifiable information provided to a State website shall be used solely by the State, its entities, and third-party agents with whom it has contracted to perform a state function on its behalf. However, this rule may be superseded by a federal statute, federal regulation, or State statute, in which case the personally identifiable information shall be used by other parties only to the extent required by the superseding federal statute, federal regulation, or State Statute.

Limits on Sharing Account Number Information for Marketing Purposes

UTAC R590-206-14[3.3] prohibits a licensee from disclosing, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer. However, there are exceptions to this rule, such as disclosing the information to the licensee’s service provider solely to perform marketing for the licensee’s own products or services, or to a participant in an affinity or similar program where the participants in the program are identified to the customer when the customer enters into the program.

Exception to Opt Out Requirements for Disclosure of Nonpublic Personal Financial Information for Service Providers and Joint Marketing

UTAC R590-206-15[3.2] provides an exception to opt-out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing. A licensee may provide nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, if the licensee provides the initial notice in accordance with Section 5 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in Sections 16 and 17 in the ordinary course of business to carry out those purposes.

General Requirements for License Issuance

To act as a third-party administrator in Utah, a person must satisfy the character requirements under Section 31A-25-204, satisfy the financial responsibility requirement under Section 31A-25-205, and has not committed an act that is a ground for denial, suspension, or revocation provided in Section 31A-25-208. Additionally, the department may require a person applying for a license or for consent to engage in the business of insurance to submit to a criminal background check as a condition of receiving a license or consent.

Information to be Included in Privacy Notices

UTAC R590-206-7[3.3] requires that initial, annual, and revised privacy notices provided by a licensee include information such as the categories of nonpublic personal financial information that the licensee collects and discloses, the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal financial information, and the licensee’s policies and practices with respect to protecting the confidentiality and security of nonpublic personal information.

Conclusion

Based on the provided documents, the use of third-party marketing automation tools that collect personal information in Utah is subject to certain requirements. Licensees must comply with the limits on sharing account number information for marketing purposes and include certain information in their privacy notices. Additionally, persons applying for a license or for consent to engage in the business of insurance may be required to submit to a criminal background check.

Source(s):
Jurisdiction

Utah