| (1) |
The requirements described in this chapter do not restrict a controller's or processor's ability to:
| (a) |
comply with a federal, state, or local law, rule, or regulation; |
| (b) |
comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, local, or other governmental entity; |
| (c) |
cooperate with a law enforcement agency concerning activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations; |
| (d) |
investigate, establish, exercise, prepare for, or defend a legal claim; |
| (e) |
provide a product or service requested by a consumer or a parent or legal guardian of a child; |
| (f) |
perform a contract to which the consumer or the parent or legal guardian of a child is a party, including fulfilling the terms of a written warranty or taking steps at the request of the consumer or parent or legal guardian before entering into the contract with the consumer; |
| (g) |
take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or of another individual; |
| (h) |
| (i) |
detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any illegal activity; or |
| (ii) |
investigate, report, or prosecute a person responsible for an action described in Subsection (1)(h)(i); |
|
| (i) |
| (i) |
preserve the integrity or security of systems; or |
| (ii) |
investigate, report, or prosecute a person responsible for harming or threatening the integrity or security of systems, as applicable; |
|
| (j) |
if the controller discloses the processing in a notice described in Section 13-61-302, engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws; |
| (k) |
assist another person with an obligation described in this subsection; |
| (l) |
process personal data to:
| (i) |
conduct internal analytics or other research to develop, improve, or repair a controller's or processor's product, service, or technology; |
| (ii) |
identify and repair technical errors that impair existing or intended functionality; or |
| (iii) |
effectuate a product recall; |
|
| (m) |
process personal data to perform an internal operation that is:
| (i) |
reasonably aligned with the consumer's expectations based on the consumer's existing relationship with the controller; or |
| (ii) |
otherwise compatible with processing to aid the controller or processor in providing a product or service specifically requested by a consumer or a parent or legal guardian of a child or the performance of a contract to which the consumer or a parent or legal guardian of a child is a party; or |
|
| (n) |
retain a consumer's email address to comply with the consumer's request to exercise a right. |
|
