63A-19-502. Data privacy complaint process.
(1) An individual who makes a data privacy complaint shall first submit the complaint to the chief administrative officer of the governmental entity that is the subject of the complaint.
(2) Upon receipt of a data privacy complaint under Subsection, the chief administrative officer shall attempt to resolve the complaint with the individual. (1)
(3) If the chief administrative officer is unable to resolve a data privacy complaint with the individual under Subsection, the individual or the governmental entity may request mediation with the ombudsperson in accordance with Section. (2) 63A-19-501
(4) If an individual submits a data privacy complaint directly to the ombudsperson, the ombudsperson shall: notify the individual and the governmental entity that the complaint will be referred to the chief administrative officer of the governmental entity; and refer the complaint to the chief administrative officer.
(5) This section does not apply to a complaint about data privacy that is within the authority of: the Government Records Office created in Section; or 63A-12-202 the government records ombudsman established in Section. 63A-12-204
(6) An employee of a governmental entity may submit a confidential and anonymous data privacy complaint directly to the attorney general.
(7) An employee of a governmental entity who submits a complaint under Subsectionis entitled to the protections described in Title 67, Chapter 21, Utah Protection of Public Employees Act. (6)