Utah And Connecticut Enact Comprehensive Data Privacy Laws

Connecticut and Utah both enacted comprehensive privacy laws this spring. On March 24, 2022, Utah became the fourth state to enact a comprehensive data privacy law when Governor Spencer Cox signed Senate Bill 227, known as the Utah Consumer Privacy Act (“UCPA”). Connecticut Governor Ned Lamont signed Pubic Act No. 22-15, “An Act Concerning Personal Data Privacy and Online Privacy” on May 10.

Utah

Many of the rights created for Utah consumers by the UCPA are similar to rights seen in other states' data privacy laws. The definitions included with the law are similar to ones seen in previous state privacy laws in Colorado and Virginia. The law applies to businesses that are either a “processor” or a “controller” of personal data—borrowing terminology from the European Union's General Data Protection Regulation (“GDPR”) much as laws in Virginia and Colorado have done. Unlike either the GDPR or the Colorado and Virginia laws, however, fewer businesses are covered by