Utah Code 13-61-402. Enforcement powers of the attorney general
Current as of: 2024 | Check for updates
|
Other versions
(1) The attorney general has the exclusive authority to enforce this chapter.
Terms Used In Utah Code 13-61-402
- Account: means the Consumer Privacy Restricted Account established in Section
13-61-403 . See Utah Code 13-61-101 - Allegation: something that someone says happened.
- Consumer: means an individual who is a resident of the state acting in an individual or household context. See Utah Code 13-61-101
- Controller: means a person doing business in the state who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others. See Utah Code 13-61-101
- Damages: Money paid by defendants to successful plaintiffs in civil cases to compensate the plaintiffs for their injuries.
- Division: means the Division of Consumer Protection created in Section
13-2-1 . See Utah Code 13-61-101 - Processor: means a person who processes personal data on behalf of a controller. See Utah Code 13-61-101
(2) Upon referral from the division, the attorney general may initiate an enforcement action against a controller or processor for a violation of this chapter.
(3)
(3)(a) At least 30 days before the day on which the attorney general initiates an enforcement action against a controller or processor, the attorney general shall provide the controller or processor:
(3)(a)(i) written notice identifying each provision of this chapter the attorney general alleges the controller or processor has violated or is violating; and
(3)(a)(ii) an explanation of the basis for each allegation.
(3)(b) The attorney general may not initiate an action if the controller or processor:
(3)(b)(i) cures the noticed violation within 30 days after the day on which the controller or processor receives the written notice described in Subsection (3)(a); and
(3)(b)(ii) provides the attorney general an express written statement that:
(3)(b)(ii)(A) the violation has been cured; and
(3)(b)(ii)(B) no further violation of the cured violation will occur.
(3)(c) The attorney general may initiate an action against a controller or processor who:
(3)(c)(i) fails to cure a violation after receiving the notice described in Subsection (3)(a); or
(3)(c)(ii) after curing a noticed violation and providing a written statement in accordance with Subsection (3)(b), continues to violate this chapter.
(3)(d) In an action described in Subsection (3)(c), the attorney general may recover:
(3)(d)(i) actual damages to the consumer; and
(3)(d)(ii) for each violation described in Subsection (3)(c), an amount not to exceed $7,500.
(4) All money received from an action under this chapter shall be deposited into the Consumer Privacy Account established in Section 13-61-403.
(5) If more than one controller or processor are involved in the same processing in violation of this chapter, the liability for the violation shall be allocated among the controllers or processors according to the principles of comparative fault.