What Utah’s new consumer privacy protection law means for you
Jan 18, 2024, 10:28 PM | Updated: Jan 22, 2024, 7:41 am
SALT LAKE CITY — You cancel a service, and within days, your inbox is nothing but emails from the company begging you to come back.
It has happened to everybody, including Katie Hart, head of the Utah Division of Consumer Protection.
“I keep getting all these reminders of ‘Hey, you can sign back up!’” Hart said. “’We’ve got this new deal for you! Come back! We miss you!’”
Hart said just because a company stops charging you for a canceled service doesn’t mean they’re obligated to delete your information.
That was the case until Dec. 31, 2023, when the Utah Consumer Privacy Act gave consumers a say in how a business handles their personal data.
“The law is designed to help consumers to have some rights when it comes to the way their data is being collected, stored, used, and ultimately deleted,” Hart explained.
The law can do a lot more than cut down on annoying follow-up solicitations, Hart said. It can also purge your information on the chance that the company is a victim of a cyber-attack.
“If you as a consumer want a company to get rid of all records of you, you have that right,” she said.
Under the law, Utah’s Consumer Protection Division and the Utah Attorney General’s Office can prosecute companies that fail to comply with such requests. If they prosecute your case, it could possibly mean money for you. The law reads prosecutors can go after “actual damages to the consumer,” and the company can also be fined up to $7,500 for each violation.
One thing to note: Companies have 45 days to comply with your request. So, if you are getting emails selling you something the day after you made your request, it’s too early to file a complaint with regulators.
“So, give it a couple of months for them to get rid of your information,” said Hart.
The law only applies to big companies that have annual revenue of at least $25 million and either handle the data of at least 100,000 people or have half their revenue coming from the sales of data belonging to at least 25,000 people.
In addition to having their data purged, the law also gives consumers the right to find out if a business is processing their personal data, access their personal data, obtain a copy of their personal data, and opt out of having their personal data sold or used for advertising.
Correction: An earlier version incorrectly reported the year the law changed as 2003 instead of 2023.
