Summary

Governmental entities must provide a privacy notice to individuals or their legal guardians about when collecting personal data. The specific requirements for this notice depend on the governing law:

• GDPA: Entities subject to the GDPA must provide a privacy notice when requesting or collecting personal data from an individual.
• GRAMA Part 6: Entities subject to GRAMA’s notice requirements must provide a notice to any person asked to furnish personal data that could be classified as a private or controlled record.
• Other law: Entities may be subject to notice requirements in other superseding V2.0 21 or preempting laws and regulations.

Due to the legal complexity, legal counsel should be consulted to determine which law applies to a particular entity and to ensure compliance.

In general, a privacy notice is a written statement that informs a person about how an entity will collect, use, and share their personal data. An entity should not collect personal data without complying with either Subsection 63G-2-601(2) or Section 63A19-402, as appropriate.

Under Subsection 63G-2-601(2), the notice must include:

• The record series that will contain the information.
• The reasons for collecting the information.
• The intended uses of the information.
• The consequences for refusing to provide the information.
• The classes of persons and the governmental entities that share information with or receive information from the entity on a regular or contractual basis.

Additionally, the notice must be posted in a prominent place where the information is collected or included directly in the documents or forms used to collect the information.

Under Utah Code § 63A-19-402, a governmental entity must provide a privacy notice when collecting personal data. The content of the notice depends on whether the data is a public record.

• If the personal data is a public record: The entity needs to provide a privacy notice with a statement indicating that the individual's personal data may be available to the public as provided by Section 63G-2-201.

If the personal data is not a public record: The privacy notice must be more detailed, describing the following:

• The intended purposes and uses of the personal data.
• The consequences for refusing to provide the personal data.
• The record series in which the personal data is included.
• The classes of persons and governmental entities with whom the personal data is shared or to whom it is sold.

A governmental entity must provide this privacy notice by one of the following V2.0 22 methods:

• Posting it in a prominent place where the personal data is collected.
• Including it as part of any document or form used to collect the personal data.
• Including a conspicuous link or QR code to an electronic version of the notice as part of any document or form used to collect the personal data.

An important element of the GDPA not addressed in GRAMA is the provision for processing activities that serve a public safety interest or produce a public benefit greater than or equal to the potential impact on an individual's privacy. Examples include:

• The provision of emergency services.
• Law enforcement body or dash camera recordings.
• Security camera monitoring. • Ambulance and emergency medical services.
• 911 emergency communications.

In such cases, the governmental entity may provide the privacy notice by posting it on the entity's website, or on the public notice website if the entity does not have a website.

The notice required under Section 63A-19-402 is in addition to, and does not supersede, any other applicable notice. A governmental entity is prohibited from using personal data for any purposes not identified in the privacy notice. Additionally, upon request, an entity must provide the privacy notice to an individual, or their legal guardian, regarding personal data previously furnished by that individual. Privacy notice templates are available at privacy.utah.gov or by contacting the Office.

Some of the notice requirements of GRAMA are redundant with provisions of the GDPA. The Office is working with the Legislature to consolidate them appropriately within the GDPA.