Title 63A, Title 63A: Utah Government Operations Code

63A-19-403. Procedure to request amendment or correction of personal data. (1) A governmental entity that collects personal data shall provide a procedure by which an individual or legal guardian of an individual may request an amendment or correction of: personal data that has b…

63A-19-404. Retention and disposition of personal data. (1) A governmental entity that collects personal data shall retain and dispose of the personal data in accordance with a documented record retention schedule. (2) Compliance with Subsection (1) does not exempt a governmental…

63A-19-405. Data breach notification to the Cyber Center and the Office of the Attorney General. (1) A governmental entity that identifies a data breach affecting 500 or more individuals shall notify the Cyber Center and the attorney general of the data breach. In addition to the…

63A-19-406. Data breach notice to individuals affected by data breach. (1) Except as provided in Subsectiona governmental entity shall provide cause a data breach notice to be sent to an individual or legal guardian of an individual affected by the data breach: (1)(b), after dete…

63A-19-407. Technology transparency study -- Report to Legislature. (1) The office and the commission shall jointly study the implementation of processing activities for which an individual's personal data may be collected without the ability to provide direct notice: the public …

63A-19-408. Private information concerning certain government employees. (1) As used in this section: "At-risk government employee" means a current or former: peace officer as specified in Section; 53-13-102 state or federal judge of an appellate, district, justice, or juvenile c…

63A-19-501. Data privacy ombudsperson. (1) There is created within the office the position of data privacy ombudsperson. (2) The governor shall appoint the ombudsperson with the advice of the governing board. (3) The ombudsperson shall: be an attorney in good standing and authori…

63A-19-502. Data privacy complaint process. (1) An individual who makes a data privacy complaint shall first submit the complaint to the chief administrative officer of the governmental entity that is the subject of the complaint. (2) Upon receipt of a data privacy complaint unde…

63A-19-601. Enforcement. (1) Upon instruction by the board, the state auditor shall: investigate alleged violations of this chapter by a governmental entity; provide notice to the relevant governmental entity of an alleged violation of this chapter; and for a violation that the s…

63A-19-602. Disciplinary action. A governmental entity may take disciplinary action, which may include suspension or discharge, against any employee of the governmental entity who intentionally violates any provision of this chapter.

63A-20-101. Digital identity bill of rights. The following rights constitute the digital identity bill of rights in this state: (1) An individual possesses an individual identity innate to the individual's existence and independent of the state, which identity is fundamental and …

63A-20-201. Definitions. As used in this chapter: (1) "Cross-context correlation" means the ability of a person to link, associate, or infer that the presentation of a state-endorsed digital identity originating with the same or another person relates to the same individual. (2) …

63A-20-202. Digital identity program -- Creation -- Duties. (1) There is created within the department the State-Endorsed Digital Identity Program. (2) The department shall design, implement, administer, and issue a state-endorsed digital identity in compliance with the requireme…

63A-20-203. Program manager -- Appointment -- Duties. (1) The executive director, with the approval of the governor, shall appoint an individual to manage the program. (2) The program manager shall be experienced in: government administration; data privacy; cybersecurity; and inf…

63A-20-204. Coordination on use cases -- Report. (1) The department shall coordinate with the following agencies to evaluate mechanisms by which a state-endorsed digital identity may be accepted and verified in the performance of their statutory duties or authorized functions: th…

63A-20-301. State-endorsed digital identity requirements. (1) A state-endorsed digital identity shall: incorporate state-of-the-art safeguards for protecting an individual's identity, including compromise detection, recovery mechanisms, and cross-context correlation protections; …

63A-20-302. Application and eligibility for state-endorsed digital identity. (1) An individual who is at least 18 years old, or is an emancipated minor, may apply to the department for a state-endorsed digital identity. (2) An individual who is under 18 years old, and is not an e…

63A-20-303. Identity proofing. (1) The department shall establish and maintain identity proofing requirements for the issuance of a state-endorsed digital identity that: follow a generally accepted identity proofing standard; are commensurate with the risks of impersonation, frau…

63A-20-304. Requirements for governmental entities. (1) A governmental entity may not: convey a material benefit upon an individual for using a state digital identity instead of a physical identity; withhold services or benefits from an individual if the individual uses a physica…

63A-20-305. Requirements for health care providers. (1) Within two years from the date the first state-endorsed digital identity is issued, a health care provider that receives at least $10,000,000 a year in public funding shall accept a state-endorsed digital identity if the hea…

63A-20-401. Requirements for digital wallet providers. (1) A digital wallet produced by a digital wallet provider shall: incorporate state-of-the-art safeguards for protecting an individual's identity; process an individual's identity attributes in a secure manner; comply with th…

63A-20-501. Requirements for verifiers. (1) A verifier shall: incorporate state-of-the-art safeguards for protecting an individual's identity in the verification process; comply with the requirements of this part through technological means where possible; process an individual's…

63A-20-601. Requirements for relying parties. (1) A relying party shall: incorporate state-of-the-art safeguards for protecting an individual's identity in the verification process; comply with the requirements of this part through technological means where possible; process an i…

63A-20-701. Duty of loyalty. The department, a digital wallet provider, a verifier, a relying party, and a digital guardian shall refrain from practices or activities related to the processing of an individual's identity attributes from a digital identity that: (1) conflict with …

63A-20-702. Processing restrictions. (1) Any record of a presentation of a state digital identity may only be processed by a digital wallet provider, a verifier, or a relying party: for the primary purpose for which the presentation was performed; or if required by law. (2) Infor…

63A-20-801. Complaints and enforcement. (1) An individual may submit a complaint to the data privacy ombudsperson alleging a violation of this chapter by: the department; a digital wallet provider; a verifier; or a relying party. (2) The data privacy ombudsperson may receive and …

63A-20-802. Auditing. (1) Subject to prioritization of the Legislative Audit Subcommittee created in Section, the Office of the Legislative Auditor General shall conduct an audit of the program beginning on January 1, 2028. 36-12-8 (2) The audit shall evaluate: the department's c…

63A-20-901. Severability. (1) If any provision of this chapter or the application of any provision to any person or circumstance is held invalid by a final decision of a court of competent jurisdiction, the remainder of this chapter shall be given effect without the invalid provi…