Utah Code 13-61-304. Limitations
Current as of: 2024 | Check for updates
|
Other versions
(1) The requirements described in this chapter do not restrict a controller‘s or processor‘s ability to:
Terms Used In Utah Code 13-61-304
- Child: means an individual younger than 13 years old. See Utah Code 13-61-101
- Consumer: means an individual who is a resident of the state acting in an individual or household context. See Utah Code 13-61-101
- Contract: A legal written agreement that becomes binding when signed.
- Controller: means a person doing business in the state who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others. See Utah Code 13-61-101
- Fraud: Intentional deception resulting in injury to another.
- Governmental entity: means the same as that term is defined in Section
63G-2-103 . See Utah Code 13-61-101 - Guardian: A person legally empowered and charged with the duty of taking care of and managing the property of another person who because of age, intellect, or health, is incapable of managing his (her) own affairs.
- Guardian: includes a person who:(14)(a) qualifies as a guardian of a minor or incapacitated person pursuant to testamentary or court appointment; or(14)(b) is appointed by a court to manage the estate of a minor or incapacitated person. See Utah Code 68-3-12.5
- Obligation: An order placed, contract awarded, service received, or similar transaction during a given period that will require payments during the same or a future period.
- Person: means :
(24)(a) an individual;(24)(b) an association;(24)(c) an institution;(24)(d) a corporation;(24)(e) a company;(24)(f) a trust;(24)(g) a limited liability company;(24)(h) a partnership;(24)(i) a political subdivision;(24)(j) a government office, department, division, bureau, or other body of government; and(24)(k) any other organization or entity. See Utah Code 68-3-12.5- Personal data: means information that is linked or reasonably linkable to an identified individual or an identifiable individual. See Utah Code 13-61-101
- Process: means an operation or set of operations performed on personal data, including collection, use, storage, disclosure, analysis, deletion, or modification of personal data. See Utah Code 13-61-101
- Processor: means a person who processes personal data on behalf of a controller. See Utah Code 13-61-101
- Prosecute: To charge someone with a crime. A prosecutor tries a criminal case on behalf of the government.
- Right: means a consumer right described in Section
13-61-201 . See Utah Code 13-61-101- State: when applied to the different parts of the United States, includes a state, district, or territory of the United States. See Utah Code 68-3-12.5
- Subpoena: A command to a witness to appear and give testimony.
- Summons: Another word for subpoena used by the criminal justice system.
- Third party: means a person other than:
(36)(a) the consumer, controller, or processor; or(36)(b) an affiliate or contractor of the controller or the processor. See Utah Code 13-61-101- Trade secret: means information, including a formula, pattern, compilation, program, device, method, technique, or process, that:
(37)(a) derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the information's disclosure or use; and(37)(b) is the subject of efforts that are reasonable under the circumstances to maintain the information's secrecy. See Utah Code 13-61-101(1)(a) comply with a federal, state, or local law, rule, or regulation;(1)(b) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, local, or other governmental entity;(1)(c) cooperate with a law enforcement agency concerning activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;(1)(d) investigate, establish, exercise, prepare for, or defend a legal claim;(1)(e) provide a product or service requested by a consumer or a parent or legal guardian of a child;(1)(f) perform a contract to which the consumer or the parent or legal guardian of a child is a party, including fulfilling the terms of a written warranty or taking steps at the request of the consumer or parent or legal guardian before entering into the contract with the consumer;(1)(g) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or of another individual;(1)(h)(1)(h)(i) detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any illegal activity; or(1)(h)(ii) investigate, report, or prosecute a person responsible for an action described in Subsection (1)(h)(i);(1)(i)(1)(i)(i) preserve the integrity or security of systems; or(1)(i)(ii) investigate, report, or prosecute a person responsible for harming or threatening the integrity or security of systems, as applicable;(1)(j) if the controller discloses the processing in a notice described in Section 13-61-302, engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws;(1)(k) assist another person with an obligation described in this subsection;(1)(l) process personal data to:(1)(l)(i) conduct internal analytics or other research to develop, improve, or repair a controller’s or processor’s product, service, or technology;(1)(l)(ii) identify and repair technical errors that impair existing or intended functionality; or(1)(l)(iii) effectuate a product recall;(1)(m) process personal data to perform an internal operation that is:(1)(m)(i) reasonably aligned with the consumer’s expectations based on the consumer’s existing relationship with the controller; or(1)(m)(ii) otherwise compatible with processing to aid the controller or processor in providing a product or service specifically requested by a consumer or a parent or legal guardian of a child or the performance of a contract to which the consumer or a parent or legal guardian of a child is a party; or(1)(n) retain a consumer’s email address to comply with the consumer’s request to exercise a right.(2) This chapter does not apply if a controller’s or processor’s compliance with this chapter:(2)(a) violates an evidentiary privilege under Utah law;(2)(b) as part of a privileged communication, prevents a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Utah law; or(2)(c) adversely affects the privacy or other rights of any person.(3) A controller or processor is not in violation of this chapter if:(3)(a) the controller or processor discloses personal data to a third party controller or processor in compliance with this chapter;(3)(b) the third party processes the personal data in violation of this chapter; and(3)(c) the disclosing controller or processor did not have actual knowledge of the third party’s intent to commit a violation of this chapter.(4) If a controller processes personal data under an exemption described in Subsection (1), the controller bears the burden of demonstrating that the processing qualifies for the exemption.(5) Nothing in this chapter requires a controller, processor, third party, or consumer to disclose a trade secret.