Utah § 67-3-13 - State auditor data privacy responsibilities.
Full text of Utah Utah Code § 67-3-13 — State auditor data privacy responsibilities., with citation guidance and answers to common questions.
§ 67-3-13. State auditor data privacy responsibilities.
Effective 5/6/2026 67-3-13.
State auditor data privacy responsibilities.
(1)
As used in this section:
(a)
"Governmental entity" means the same as that term is defined in Section 63G-2-103.
(b)
"Personal data" means the same as that term is defined in Section 63A-19-101.
(c)
"Privacy practice" means the same as that term is defined in Section 63A-19-101.
(d)
"State agency" means the same as that term is defined in Section 63A-19-101.
(2)
The state auditor shall:
(a)
compile information about the privacy practices of governmental entities;
(b)
make public and maintain information about the privacy practices of governmental entities on the state auditor's website;
(c)
provide governmental entities with guidance and training regarding the data privacy auditing standards developed by the state auditor;
(d)
implement a process to analyze and respond to requests from individuals for the state auditor to audit a governmental entity's privacy practice;
(e)
identify annually which governmental entities' privacy practices pose the greatest risk to individual privacy and prioritize those privacy practices to be audited;
(f)
audit each year, in as timely a manner as possible, the privacy practices that the state auditor identifies under Subsection (2)(d) or (2)(e) as posing the greatest risk to individuals' privacy;
(g)
when auditing a governmental entity's privacy practice under Subsection (2)(f), analyze:
(i)
details about the technology or the policy and the technology's or the policy's application;
(ii)
information about the type of personal data being used;
(iii)
information about how the personal data is obtained, stored, shared, secured, and disposed;
(iv)
information about the governmental entity's sharing or selling of personal data;
(v)
information about whether an individual can or should be able to opt out of the retention, selling, and sharing of the individual's personal data;
(vi)
information about how the governmental entity de-identifies or anonymizes personal data;
(vii)
a determination about the existence of alternative technology or improved practices to protect privacy; and
(viii)
a finding of whether the governmental entity's current privacy practices adequately protect individual privacy; and
(h)
after completing an audit described in Subsections (2)(f) and (g), determine:
(i)
each governmental entity's use of personal data, including the governmental entity's privacy practices regarding personal data:
(A)
acquisition;
(B)
storage;
(C)
disposal;
(D)
protection; and
(E)
sharing;
(ii)
the adequacy of the governmental entity's practices in each of the areas described in Subsection (2)(h)(i); and
(iii)
for each of the areas described in Subsection (2)(h)(i) that the state auditor determines to require reform, provide recommendations for reform to the governmental entity and the legislative body charged with regulating the governmental entity.
(3)
(a)
The legislative body charged with regulating a governmental entity that receives a recommendation described in Subsection (2)(h)(iii) shall hold a public hearing on the proposed reforms:
(i)
with a quorum of the legislative body present; and
(ii)
within 90 days after the day on which the legislative body receives the recommendation.
(b)
(i)
The legislative body shall provide notice of the hearing described in Subsection (3)(a).
(ii)
Notice of the public hearing and the recommendations to be discussed shall be posted for the jurisdiction of the governmental entity, as a class A notice under Section 63G-30-102, for at least 30 days before the day on which the legislative body will hold the public hearing.
(iii)
Each notice required under Subsection (3)(b)(i) shall:
(A)
identify the recommendations to be discussed; and
(B)
state the date, time, and location of the public hearing.
(c)
During the hearing described in Subsection (3)(a), the legislative body shall:
(i)
provide the public the opportunity to ask questions and obtain further information about the recommendations; and
(ii)
provide any interested person an opportunity to address the legislative body with concerns about the recommendations.
(d)
At the conclusion of the hearing, the legislative body shall determine whether the legislative body shall adopt reforms to address the recommendations and any concerns raised during the public hearing.
an executive branch agency within the Office of the Attorney General, the state auditor, the state treasurer, or the State Board of Education; or
(e)
an independent entity.
(5)
The state auditor shall:
(a)
quarterly report, to the Utah Privacy Commission:
(i)
recommendations for privacy practices for the commission to review; and
(ii)
the information provided in Subsection (2)(h); and
(b)
annually, on or before October 1, report to the Judiciary Interim Committee:
(i)
the results of any audits described in Subsection (2)(f), if any audits have been completed;
(ii)
reforms, to the extent that the state auditor is aware of any reforms, that the governmental entity made in response to any audits described in Subsection (2)(f);
(iii)
the information described in Subsection (2)(h); and
(iv)
recommendations for legislation based on any results of an audit described in Subsection (2)(f).
Section 67-3-13 ("State auditor data privacy responsibilities.") is part of the Utah Code, the codified statutory law of Utah. It sets out the legal rule or procedure described in the text above. Statutes are amended regularly, so always verify against the official source.
How do I cite Utah § 67-3-13?
A common citation format is "Utah Code § 67-3-13" (Utah). Legal writing may require the code abbreviation, section number, and year or edition. Match the style required by your court, professor, or publisher.
Is this the official text of Utah law?
No. This page is for research and education and may not include the most recent amendments. For official current law, check the Utah official source linked on this page or consult a licensed Utah attorney.
How does Utah § 67-3-13 apply to my situation?
Statutes are interpreted in context, and application depends on your specific facts. Only a licensed attorney in Utah can advise on how this section applies to you. Contact your state or local bar association for a referral.
