Title 13, Commerce and Trade

13-61-103. Preemption -- Reference to other laws. (1) This chapter supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a local political subdivision regarding the processing of personal data by a controller or processor. (2) Any reference to fe…

13-61-201. Consumer rights -- Access -- Deletion -- Portability -- Opt out of certain processing. (1) A consumer has the right to: (a) confirm whether a controller is processing the consumer's personal data; and (b) access the consumer's personal data. (2) A consumer has the righ…

13-61-202. Exercising consumer rights. (1) A consumer may exercise a right by submitting a request to a controller, by means prescribed by the controller, specifying the right the consumer intends to exercise. (2) In the case of processing personal data concerning a known child, …

13-61-203. Controller's response to requests. (1) Subject to the other provisions of this chapter, a controller shall comply with a consumer's request under Section 13-61-202 to exercise a right. (2)(a) Within 45 days after the day on which a controller receives a request to exer…

13-61-301. Responsibility according to role. (1) A processor shall: (a) adhere to the controller's instructions; and (b) taking into account the nature of the processing and information available to the processor, by appropriate technical and organizational measures, insofar as r…

13-61-302. Responsibilities of controllers -- Transparency -- Purpose specification and data minimization -- Consent for secondary use -- Security -- Nondiscrimination -- Nonretaliation -- Nonwaiver of consumer rights. (1)(a) A controller shall provide consumers with a reasonably…

13-61-303. Processing deidentified data or pseudonymous data. (1) The provisions of this chapter do not require a controller or processor to: (a) reidentify deidentified data or pseudonymous data; (b) maintain data in identifiable form or obtain, retain, or access any data or tec…

13-61-304. Limitations. (1) The requirements described in this chapter do not restrict a controller's or processor's ability to: (a) comply with a federal, state, or local law, rule, or regulation; (b) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena,…

13-61-305. No private cause of action. A violation of this chapter does not provide a basis for, nor is a violation of this chapter subject to, a private right of action under this chapter or any other law.

13-61-401. Investigative powers of division. (1) The division shall establish and administer a system to receive consumer complaints regarding a controller's or processor's alleged violation of this chapter. (2)(a) The division may investigate a consumer complaint to determine wh…

13-61-402. Enforcement powers of the attorney general. (1) The attorney general has the exclusive authority to enforce this chapter. (2) Upon referral from the division, the attorney general may initiate an enforcement action against a controller or processor for a violation of t…

13-61-403. Consumer Privacy Restricted Account. (1) There is created a restricted account known as the "Consumer Privacy Account." (2) The account shall be funded by money received through civil enforcement actions under this chapter. (3) Upon appropriation, the division or the a…

13-61-404. Attorney general report. (1) The attorney general and the division shall compile a report: (a) evaluating the liability and enforcement provisions of this chapter, including the effectiveness of the attorney general's and the division's efforts to enforce this chapter;…

13-61-501. Definitions. As used in this part: (1) "Connected device" means a consumer's mobile phone, tablet, or similar personal electronic device that connects to a motor vehicle through the in-vehicle interface for purposes of accessing the device's applications, contacts, or …

13-61-502. Motor vehicle manufacturer requirements. (1) Except as provided in Subsection (2), a motor vehicle manufacturer shall, for a motor vehicle with a model year 2030 or later, provide in-vehicle privacy controls that allow a consumer to: (a) view the categories of personal…

13-61-503. Exemptions for motor vehicle manufacturers. (1) A motor vehicle manufacturer may collect personal data for the purpose of improving the motor vehicle manufacturer's product if the motor vehicle manufacturer: (a) collects only the minimum personal data necessary to acco…

13-61-504. Motor Vehicle Division notification requirements. The Motor Vehicle Division, created in Section 41-1a-106, shall provide information on the division's website regarding the data privacy rights of motor vehicle owners under this part.