Summary

To promote transparency and public trust, governmental entities must comply with specific requirements for website privacy notices on government websites. These notices ensure users can make informed decisions about their personal data.

As outlined in Utah Code § 63A-19-402.5, governmental entities must include a privacy notice on any website that collects user data. State agencies must also adhere to Utah Admin. Code R895-8, which details requirements related to the Privacy Policy Statement For State of Utah Websites and its relationship with a state agency privacy policy, where applicable.

A governmental entity may not collect user data on its websites unless it has a website privacy notice that includes:

• The identity of the governmental entity responsible for the website and how to contact them.
• A method for a user to:
  • Seek access to their personal data or user data.
  • Request to correct or amend their personal data or user data.
  • File a complaint with the data privacy ombudsperson.
• Instructions for at-risk employees to request that their personal information be classified as a private record under Section 63G-2-302.

If the website collects user data, the privacy notice must also provide details on:

• Any website tracking technology used.
• What user data is collected.
• The intended purposes and uses of the user data.
• The record series in which the user data is included.
• The classes of persons and governmental entities with whom the user data is shared or sold.

A website privacy notice must be prominently posted on the homepage of the government website or accessible via a link on the homepage. User data may not be collected unless the website privacy notice requirements are met. Website privacy notice templates are available at privacy.utah.gov or by contacting the Office.

The requirements for the Privacy Policy Statement For State of Utah Websites are redundant with provisions of the GDPA. The Office is working with appropriate governmental entities to consolidate them appropriately within the GDPA.