Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Until recently, Utah’s Notice of Intent to Sell Nonpublic Personal Information Act (UNISNPIA) had not been on the national privacy radar. However, a string of recent lawsuits has made clear it is a law of which companies should be aware.

core/paragraph

The law states that “[a] commercial entity may not disclose nonpublic personal information that the commercial entity obtained on or after January 1, 2004, as a result of a consumer transaction if the commercial entity fails to comply with the [notice provisions].” Notably, the law provides specific notice requirements detailing when and how notice should be given. Expanding its potential reach, the law includes “purchasing patterns of a person” in the definition of “nonpublic personal information.” However, it limits the definition of “commercial entity” to a person that has an office or other place of business located in Utah and in the ordinary course of business transacts a consumer transaction in Utah. Consumer transactions are limited to those that are “initiated” or “completed” in Utah. Of significant note, the law provides for a $500 per violation.

Despite being in effect for over 20 years, the law has not been one often discussed because it includes specific language stating that a “person may not bring a class action under this chapter.” However, the District of Utah recently issued a decision holding that because Rule 23 does not “abridge, enlarge or modify” Utah’s substantive rights under UNISNPIA, Rule 23 permits plaintiffs to maintain a class action suit. Curry v. Mrs. Fields Gifts, Inc., No. 222CV00651JNPDBP, 2023 WL 6318108, at *7 (D. Utah, Sept. 28, 2023). This decision, if followed, renders the class action ban moot in federal court. Therefore, until other courts in the Tenth Circuit hold otherwise, which we believe they should (though we note the Curry decision is not currently under appeal), we predict there will be an increased risk of lawsuits being filed against companies that do business in Utah and can be alleged to “disclose” customer information.

We are closely monitoring these developments and can provide counsel on potential avenues for mitigation and defense.

A Mountain of Privacy Lawsuits Might Be Coming to Utah