What does Utah's data breach law ask a business to do?

Who does this law apply to?

The law says a person or business that owns or licenses computerized personal information about a Utah resident must investigate promptly and in good faith once it learns of a breach.

Notice to each affected Utah resident is owed when that investigation shows misuse for identity theft or fraud has occurred or is reasonably likely.

A person who owns or licenses computerized data that includes personal information concerning a Utah resident shall, when the person becomes aware of a breach of system security, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused for identity theft or fraud purposes.

If an investigation under Subsection (1)(a) reveals that the misuse of personal information for identity theft or fraud purposes has occurred, or is reasonably likely to occur, the person shall provide notification to each affected Utah resident.

What counts as personal information?

Personal information is a person's name together with a social security number, a financial account or card number with the code that opens the account, or a driver licence or state identification number, where the name or the data element is unencrypted or not otherwise made unreadable.

"Personal information" means a person's first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or date element is unencrypted or not protected by another method that renders the data unreadable or unusable:

How fast must people be told?

The text sets no fixed number of days. It says notice goes out in the most expedient time possible without unreasonable delay, allowing for law enforcement, finding the scope of the breach and restoring the system.

A person required to provide notification under Subsection (1) shall provide the notification in the most expedient time possible without unreasonable delay:

Who else must be told?

When misuse affects 500 or more Utah residents, the Office of the Attorney General and the Utah Cyber Center must also be told. At 1,000 or more residents, the nationwide consumer reporting agencies must be told as well.

If an investigation under Subsection (1)(a) reveals that the misuse of personal information relating to 500 or more Utah residents, for identity theft or fraud purposes, has occurred or is reasonably likely to occur, the person shall, in addition to the notification required in Subsection (1)(b), provide notification to: (i) the Office of the Attorney General; and (ii) the Utah Cyber Center created in Section 63A-16-1102.

What if a vendor holds the data?

A business that holds personal information it does not own must tell and cooperate with the owner immediately after it discovers a breach, where misuse occurs or is reasonably likely.

A person who maintains computerized data that includes personal information that the person does not own or license shall notify and cooperate with the owner or licensee of the information of any breach of system security immediately following the person's discovery of the breach if misuse of the personal information occurs or is reasonably likely to occur.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.