→
Previous
Latest
HB0042S03 compared with HB0042S01 {Omitted text} shows text that was in HB0042S01 but was omitted in HB0042S03 inserted text shows text that was not in HB0042S01 but was inserted into HB0042S03 DISCLAIMER:
HB0042S03 compared with HB0042 {Omitted text} shows text that was in HB0042 but was omitted in HB0042S03 inserted text shows text that was not in HB0042 but was inserted into HB0042S03 DISCLAIMER:
This bill directs the State Board of Education to establish minimum cybersecurity standards for local education agencies.
This bill {establishes } directs the State Board of Education to establish minimum cybersecurity standards for local education agencies {(LEAs) and expands the Utah Cyber Center's services to include educational institutions} .
▸ directs the {State Board of Education } Cybersecurity Commission to make rules establishing minimum cybersecurity standards for {LEAs in collaboration with the Utah Education and Telehealth Network} local education agencies (LEAs) aligned with industry recognized frameworks;
▸ {establishes } directs the Cybersecurity Commission to make rules establishing minimum cybersecurity standards for {LEAs} local education agencies (LEAs) aligned with industry recognized frameworks;
▸ establishes a phased implementation timeline for LEA compliance;
▸ {requires LEAs to implement specific cybersecurity measures;} ▸ {expands the Utah Cyber Center's duties to include services for LEAs;} H ▸ establishes a phased implementation timeline for LEA compliance;
H ▸ requires coordination among the Utah Cyber Center, the State Board of Education, andBthe Utah Education and Telehealth Network;
B ▸ requires coordination {between } among the Utah Cyber Center, {LEAs} the State Board of Education, and the Utah Education and Telehealth Network;
0 ▸ establishes reporting requirements for cybersecurity incidents;
4 HB0042 compared with HB0042S03 ▸ establishes reporting requirements for cybersecurity incidents {in educational settings} ;
4 ▸ {expands the Utah Cyber Center's duties to include services for LEAs;} S 0 ▸ requires the State Board of Education to provide implementation support and resource1;
▸ requires the State Board of Education to {develop } provide implementation {guidelines} support and resources;
{and} HB0042S01 compared with HB0042S03 ▸ includes a coordination clause to incorporate changes made to Section 53G-7-227 with changes made to that section in S.B.
{and} ▸ includes a coordination clause to incorporate changes made to Section 53G-7-227 with changes made to that section in S.B.
53G-7-227 (Effective 05/06/26), as last amended by Laws of Utah 2025, First Special Session, Chapter 9 {53H-4-213.4 (Effective 05/06/26), as renumbered and amended by Laws of Utah 2025, First Special Session, Chapter 8} 63C-27-201 (Effective 05/06/26) (Repealed 07/01/32), as enacted by Laws of Utah 2022, Chapter 63C-27-202 (Effective 05/06/26) (Repealed 07/01/32), as enacted by Laws of Utah 2022, Chapter 153 ENACTS:
53G-7-227 (Effective 05/06/26), as last amended by Laws of Utah 2025, First Special Session, Chapter 9 {53H-4-213.4 (Effective 05/06/26), as renumbered and amended by Laws of Utah 2025, First Special Session, Chapter 8} {63A-16-1101 (Effective 05/06/26), as enacted by Laws of Utah 2024, Chapter 426} {63A-16-1102 (Effective 05/06/26), as last amended by Laws of Utah 2025, First Special Session, Chapter 9} {63A-16-1103 (Effective 05/06/26), as renumbered and amended by Laws of Utah 2024, Chapter 426} {63A-19-101 (Effective 05/06/26), as last amended by Laws of Utah 2025, Chapter 475} 63C-27-201 (Effective 05/06/26) (Repealed 07/01/32), as enacted by Laws of Utah 2022, Chapter 63C-27-202 (Effective 05/06/26) (Repealed 07/01/32), as enacted by Laws of Utah 2022, Chapter 153 ENACTS:
53G-7-227 (05/06/26) , as last amended by Laws of Utah 2025, First Special Session, Chapter 9 Be it enacted by the Legislature of the state of Utah:
- 2 - HB0042 compared with HB0042S03 53G-7-227 (05/06/26) , as last amended by Laws of Utah 2025, First Special Session, Chapter 9 Be it enacted by the Legislature of the state of Utah:
- 2 - HB0042S01 compared with HB0042S03 (A) incorporates one or more sensors, including cameras, microphones, accelerometers, gyroscopes, or biometric sensors;
(A) incorporates one or more sensors, including cameras, microphones, accelerometers, gyroscopes, or biometric sensors;
(ii) a feature phone;
- 3 - HB0042 compared with HB0042S03 (ii) a feature phone;
- 3 - HB0042S01 compared with HB0042S03 (B) during regular school operating hours;
(B) during regular school operating hours;
(i) shall establish a policy that allows a student to use a cellphone, smart watch, AI glasses, or emerging technology:
- 4 - HB0042 compared with HB0042S03 (i) shall establish a policy that allows a student to use a cellphone, smart watch, AI glasses, or emerging technology:
and - 4 - HB0042S01 compared with HB0042S03 (ii) may establish a policy that provides for other circumstances when a student may use a cellphone, smart watch, AI glasses, or emerging technology.
and (ii) may establish a policy that provides for other circumstances when a student may use a cellphone, smart watch, AI glasses, or emerging technology.
(1) "Cyber Center" means the Utah Cyber Center created in Section 63A-16-1102.
{(1) {"CIS Controls" means the Center for Internet Security Critical Security Controls, a prioritized set of actions for cybersecurity that provide specific and actionable ways to defend against common cyber attack methods.} } (2){(1)} "Cyber Center" means the Utah Cyber Center created in Section 63A-16-1102.
(2) "Data breach" means the same as that term is defined in Section 63A-16-1101.
- 5 - HB0042 compared with HB0042S03 {(3) {"Cyber defense plan" means a comprehensive strategy document that outlines an LEA's approach to preventing, detecting, responding to, and recovering from cybersecurity incidents.} } (4){(2)} "Data breach" means the same as that term is defined in Section 63A-16-1101.
(3) "UETN" means the Utah Education and Telehealth Network created in Section 53H-4-213.4.
{(5) {"Endpoint detection and response" or "EDR" means cybersecurity technology that continuously monitors end-user devices to detect and respond to cyber threats.} } {(6) {"Multi-factor authentication" or "MFA" means an authentication method that requires two or more verification factors to gain access to a resource.} } {(7) {"Patch management" means the process of identifying, acquiring, testing, and installing updates to software and systems to fix vulnerabilities and improve security.} } {(8) {"Personal data" means the same as that term is defined in Section 63A-16-1101.} } {(9) {"Phishing" means a fraudulent attempt to obtain sensitive information by disguising oneself as a trustworthy entity in electronic communications.} } {(10) {"Strong authentication" means enhanced identity verification mechanisms that utilize technologies such as multi-factor authentication, passkeys, or other equivalent or stronger authentication mechanisms that provide comparable or improved levels of security assurance.} } {(11) {"Tabletop exercise" means a discussion-based cybersecurity exercise where team members meet to discuss each team member's roles and responses during an emergency scenario in an informal, low-stress environment.} } (12){(3)} {"Utah } "UETN" means the Utah Education and Telehealth Network{" or "UETN" means the network } created in Section 53H-4-213.4.
{State board to establish minimum } LEA compliance with cybersecurity standards {-- Phased implementation } -- Coordination {with state entities} .
{Minimum } LEA compliance with cybersecurity standards {for an LEA -- Data breach reporting -- Coordination with Utah Cyber Center} -- Coordination.
(1) {In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, and in collaboration } An LEA shall comply with {UETN, the state board shall make rules establishing } the minimum cybersecurity standards {for an LEA that:} established by the Cybersecurity Commission created in Section 63C-27-201 in rule made in accordance with Subsection 63C-27-202(9).
(1) An LEA shall comply with the minimum cybersecurity standards established by the Cybersecurity Commission created in Section 63C-27-201 in rule made in accordance with Subsection 63C-27-202(9).
{(a) {take into account varying LEA resources and needs;
(1){(2)} {Beginning July 1, 2027, each } An LEA shall {implement and maintain the following } comply with the minimum cybersecurity standards{:} according to the phased implementation timeline established in rule under Subsection 63C-27-202(9).
and} } - 5 - HB0042S01 compared with HB0042S03 {(b) {may address:} } {(i) {user authentication and access controls;} } {(ii) {cybersecurity oversight and governance within an LEA;} } {(iii) {device and endpoint security;} } {(iv) {cybersecurity awareness and training for staff;} } {(v) {system maintenance and software updates;} } {(vi) {data backup and recovery procedures;} } {(vii) {incident response planning and coordination;} } {(viii) {third-party vendor management and oversight;
{(a) {implement strong authentication for all staff, administrators, and authorized users accessing LEA systems containing personal data or sensitive information;} } - 6 - HB0042 compared with HB0042S03 {(b) {designate at least one individual with defined responsibility for overseeing and implementing the LEA's cyber defense plan;} } {(c) {implement endpoint detection and response or equivalent advanced endpoint protection across all LEA-managed devices;} } {(d) {provide annual cybersecurity awareness training for all staff, including training on:} } {(i) {identifying and reporting phishing attempts;} } {(ii) {strong authentication practices;} } {(iii) {safe data handling procedures;
and} } {(ix) {phased implementation approaches based on LEA size, capacity, and resources.} } {(2) } (a){(2)} {The state board } An LEA shall {ensure the rules made } comply with the minimum cybersecurity standards according to the phased implementation timeline established in rule under Subsection {(1) align with industry recognized cybersecurity frameworks and best practices} 63C-27-202(9).
and} } {(iv) {reporting suspicious activity;} } {(e) {establish and maintain regular patch management cycles for all operating systems and applications, with documentation of compliance;} } {(f) {maintain regular, immutable backups with:} } {(i) {redundant storage locations;} } {(ii) {encrypted backup files;} } {(iii) {regular testing of recovery procedures;
{(b) {The state board may establish different compliance timelines or requirements for LEAs based on the LEA's size, existing cybersecurity infrastructure, or available resources.} } (3) {The state board} UETN, in consultation with the Cyber Center and {UETN} the state board, shall:
and} } {(iv) {documentation of backup and recovery processes;} } {(g) {develop and maintain a documented incident response plan that:} } {(i) {aligns with the CIS Controls or equivalent cybersecurity frameworks;} } {(ii) {includes clear roles and responsibilities;} } (iii){(3)} {establishes communication protocols } UETN, in consultation with the Cyber Center{;
(a) develop implementation guidelines and technical resources to assist LEAs in meeting the minimum cybersecurity standards;
} andthe state board, shall:
(b) provide technical assistance and support to LEAs;and {(c) {establish a method to assess LEA compliance with the minimum cybersecurity standards;
{(iv) {is tested through regular tabletop exercises at least annually;
and } } (d){(c)} coordinate the provision of cybersecurity services and resources to LEAs.
and} } {(h) {strengthen oversight of third-party vendors by:} } {(i) {maintaining current inventories of all vendors with access to student or staff personal data;} } {(ii) {ensuring all vendor agreements include appropriate data protection clauses;} } {(iii) {conducting regular reviews of vendor security practices;
(4) (a) The Cyber Center, the state board, and UETN shall coordinate services to LEAs to:
and} } {(iv) {ensuring compliance with the state's student data privacy laws.} } {(2) {An LEA shall report any data breach to the Cyber Center in accordance with Section 63A-19-405.} } {(3) {In addition to the requirements in Section 63A-19-405, an LEA shall:} } {(a) {notify the state board within 24 hours of discovering the data breach;} } - 7 - HB0042 compared with HB0042S03 (a) develop implementation guidelines and technical resources to assist LEAs in meeting the minimum cybersecurity standards;
(i) avoid duplication of efforts;
(b) provide technical assistance and support to LEAs;
and (b){(c)} coordinate {with UETN if the data breach involves network infrastructure or } the provision of cybersecurity services {provided by UETN;
} andresources to LEAs.
(4) (c){(a)} { cooperate with the } The Cyber {Center's investigation } Center, the state board, and {response efforts.} UETN shall coordinate services to LEAs to:
{(4) {The Cyber Center shall provide assistance to an LEA in the same manner the Cyber Center does for any governmental entity as described in Title 63A, Chapter 16, Part 11, Utah Cyber Center.} } {(5) {An LEA shall:} } (i) avoid duplication of efforts;
and (iv) facilitate information sharing regarding cybersecurity threats and best practices.
and (a){(iv)} {participate in cybersecurity } facilitate information sharing {initiatives coordinated by the Cyber Center;} regarding cybersecurity threats and best practices.
(b) The coordination required under Subsection (4)(a) shall include:
{(b) {designate a primary point of contact for cybersecurity matters who shall interface with the Cyber Center and UETN;
(i) regular meetings among the entities to discuss LEA cybersecurity needs and initiatives;
and} } (b) The coordination required under Subsection (4)(a) shall include:
- 6 - HB0042S01 compared with HB0042S03 (ii) joint development of training materials and resources;
(c){(i)} {cooperate with statewide } regular meetings among the entities to discuss LEA cybersecurity {assessments } needs and {improvement } initiatives{.} ;
(ii) joint development of training materials and resources;
{(5) {An LEA shall comply with the minimum cybersecurity standards established in rule under Subsection (1) according to the phased implementation timeline established by the state board.} } Section 4.
Section 4.
Data breach reporting -- Coordination with Utah Cyber Center.
{Coordination between } Data breach reporting -- Coordination with Utah Cyber Center {and Utah Education and Telehealth Network} .
Show all 255 changed rows (215 more)
Previous
Latest
(1) An LEA shall report a data breach to the Cyber Center {in accordance with Section 63A-19-405.} :
{(1) {The Cyber Center and UETN shall coordinate each entity's respective services to an LEA according to the division of responsibilities described in this section.} } (1) An LEA shall report a data breach to the Cyber Center:
(a) in accordance with Section 63A-19-405;
- 8 - HB0042 compared with HB0042S03 (2){(a)} {In } in accordance with Section {53H-4-213.4, UETN shall be responsible for network infrastructure and connectivity, including:} 63A-19-405;
and (b) consistent with standards and procedures established in rule under Subsection 63C-27-202(9).
and {(a) {providing and maintaining the physical network infrastructure and Internet connectivity for an LEA;} } {(b) {implementing network-level security controls including firewalls, network segmentation, and traffic monitoring at the infrastructure level;} } {(c) {procuring, installing, and maintaining telecommunication services and equipment on behalf of an LEA;} } {(d) {providing technical support for network connectivity issues;} } {(e) {coordinating with the Cyber Center when network infrastructure is involved in a data breach or security incident;
and} } {(f) {implementing network-level security policies that complement the cybersecurity standards required under Section 53G-8-902.} } {(3) {In accordance with Title 63A, Chapter 16, Part 11, Utah Cyber Center, the Cyber Center shall be responsible for a cybersecurity strategy and incident response, including:} } (a){(b)} {developing and maintaining cybersecurity } consistent with standards and {best practices for an LEA as required } procedures established in rule under {Section 53G-8-902;} Subsection 63C-27-202(9).
(a) notify the state board within 24 hours of discovering the data breach;
(b){(a)} {providing cybersecurity incident response services when an LEA experiences a } notify the state board within 24 hours of discovering the data breach;
(b) coordinate with UETN if the data breach involves network infrastructure or services provided by UETN;
{(c) {conducting cybersecurity assessments and vulnerability testing of an LEA's systems;} } {(d) {providing threat intelligence and security alerts to an LEA;} } {(e) {delivering cybersecurity awareness training and resources to an LEA and all relevant staff as the Cyber Center determines;} } (f){(b)} {coordinating } coordinate with UETN {when incidents involve } if the data breach involves network infrastructureor services provided by UETN;
and (c) cooperate with the Cyber Center's investigation and response efforts.
and {(g) {maintaining the statewide incident response repository for education-related security breaches.} } (c) cooperate with the Cyber Center's investigation and response efforts.
(3) {In collaboration with UETN, the } The Cyber Center shall provide assistance to an LEA in responding to a data breach in the same manner the Cyber Center provides assistance to a governmental entity as described in Title 63A, Chapter 16, Part 11, Utah Cyber Center.
- 9 - HB0042 compared with HB0042S03 (3) The Cyber Center shall provide assistance to an LEA in responding to a data breach in the same manner the Cyber Center provides assistance to a governmental entity as described in Title 63A, Chapter 16, Part 11, Utah Cyber Center.
(a) participate in cybersecurity information sharing initiatives coordinated by the Cyber Center;
{(a) {comply with all cybersecurity requirements established in Section 53G-8-902;} } (a) participate in cybersecurity information sharing initiatives coordinated by the Cyber Center;
(b) designate a primary point of contact for cybersecurity matters who shall interface with the Cyber Center, the state board, and UETN;
(b) designate a primary {cybersecurity } point of contact for cybersecurity matters who {interfaces } shall interface with {both } the Cyber Center {for security matters } , the state board, and UETN {for network infrastructure matters} ;and {(c) {report data breaches to the Cyber Center as required under Section 53G-8-902;} } {(d) {report network infrastructure issues to UETN;
and (c) cooperate with statewide cybersecurity assessments and improvement initiatives.
and} } {(e) {participate in security initiatives coordinated by both entities within each entity's respective areas of responsibility.} } {(5) } (c) cooperate with statewide cybersecurity assessments and improvement initiatives.
(i) coordinate with the Cyber Center, the state board, and UETN on behalf of the participating LEAs;
(i) coordinate with the Cyber Center , the state board, and UETN on behalf of the participating LEAs;
(ii) ensure each participating LEA meets the minimum cybersecurity standards established under {Section 53G-8-902} Subsection 63C-27-202(9);
(ii) ensure each participating LEA meets the {requirements of Section 53G-8-902} minimum cybersecurity standards established under Subsection 63C-27-202(9);
and - 7 - HB0042S01 compared with HB0042S03 (iii) maintain documentation of cybersecurity services provided to each LEA.
and (iii) maintain documentation of cybersecurity services provided to each LEA.
{Section 5.
{(6) {The state board shall:
} } {(a) { in consultation with both the Cyber Center and UETN:} } {(i) {develop implementation guidelines that clearly delineate which entity provides specific services;
and} } {(ii) {establish a method to assess compliance with this part;
and} } {(b) {ensure coordination between the two entities to avoid duplication of services.} } {Section 5.
} 53H-4-213.4.
} - 10 - HB0042 compared with HB0042S03 53H-4-213.4.
- 8 - HB0042S01 compared with HB0042S03 (i) implement network-level security controls for local education agencies;
(i) implement network-level security controls for local education agencies;
and (iii) ensure alignment between network infrastructure and cybersecurity standards required under Section 53G-8-902.
and - 11 - HB0042 compared with HB0042S03 (iii) ensure alignment between network infrastructure and cybersecurity standards required under Section 53G-8-902.
- 9 - HB0042S01 compared with HB0042S03 (c) When a vacancy occurs in the membership for any reason, the replacement shall be appointed for the unexpired term.
(c) When a vacancy occurs in the membership for any reason, the replacement shall be appointed for the unexpired term.
(d) (i) The Utah Education and Telehealth Network Board shall elect a chair.
- 12 - HB0042 compared with HB0042S03 (d) (i) The Utah Education and Telehealth Network Board shall elect a chair.
{Section 6.
Section 63A-16-1101 is amended to read:
} 63A-16-1101.
Definitions.
As used in this part:
- 13 - HB0042 compared with HB0042S03 (1) "Cyber Center" means the Utah Cyber Center created in Section 63A-16-1102.
(2) "Data breach" means the unauthorized access, acquisition, disclosure, loss of access, or destruction of:
(a) personal data affecting 500 or more individuals;
or (b) data that compromises the security, confidentiality, availability, or integrity of the computer systems used or information maintained by the governmental entity.
(3) "Governmental entity" means the same as that term is defined in Section 63G-2-103 and includes a local education agency as that term is defined in Section 53E-1-102.
(4) "Personal data" means information that is linked or can be reasonably linked to an identified individual or an identifiable individual.
(5) "Utah Education and Telehealth Network" or "UETN" means the network created in Section 53H-4-213.4.
{Section 7.
Section 63A-16-1102 is amended to read:
} 63A-16-1102.
Utah Cyber Center -- Creation -- Duties.
(1) (a) There is created within the division the Utah Cyber Center.
(b) The chief information security officer appointed under Section 63A-16-210 shall serve as the director of the Cyber Center.
(2) The division shall operate the Cyber Center in partnership with the following entities within the Department of Public Safety created in Section 53-1-103:
(a) the Statewide Information and Analysis Center;
(b) the State Bureau of Investigation created in Section 53-10-301;
and (c) the Division of Emergency Management created in Section 53-2a-103.
(3) In addition to the entities described in Subsection [(3)] (2), the Cyber Center shall collaborate with:
(a) the Cybersecurity Commission created in Section 63C-27-201;
(b) the Office of the Attorney General;
(c) the Utah Education and Telehealth Network created in Section 53H-4-213.4;
(d) appropriate federal partners, including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency;
(e) appropriate information sharing and analysis centers;
- 14 - HB0042 compared with HB0042S03 (f) information technology directors, cybersecurity professionals, or equivalent individuals representing political subdivisions and local education agencies, as that term is defined in Section 53E-1-102, in the state;
and (g) any other person the division believes is necessary to carry out the duties described in Subsection (4).
(4) The Cyber Center shall, within legislative appropriations:
(a) [by June 30, 2024, ]develop a statewide strategic cybersecurity plan for governmental entities;
(b) with respect to executive branch agencies:
(i) identify, analyze, and, when appropriate, mitigate cyber threats and vulnerabilities;
(ii) coordinate cybersecurity resilience planning;
(iii) provide cybersecurity incident response capabilities;
and (iv) recommend to the division standards, policies, or procedures to increase the cyber resilience of executive branch agencies individually or collectively;
(c) at the request of a governmental entity, coordinate cybersecurity incident response for a data breach affecting the governmental entity in accordance with Section 63A-19-405;
(d) promote cybersecurity best practices;
(e) share cyber threat intelligence with governmental entities and, through the Statewide Information and Analysis Center, with other public and private sector organizations;
(f) serve as the state cybersecurity incident response repository to receive reports of breaches of system security, including notification or disclosure under Section 13-44-202 and data breaches under Section 63A-16-1103;
(g) develop incident response plans to coordinate federal, state, local, and private sector activities and manage the risks associated with an attack or malfunction of critical information technology systems within the state;
(h) coordinate, develop, and share best practices for cybersecurity resilience in the state;
(i) identify sources of funding to make cybersecurity improvements throughout the state;
(j) develop a sharing platform to provide resources based on information, recommendations, and best practices;
[and] (k) partner with institutions of higher education, the Utah Education and Telehealth Network, and other public and private sector organizations to increase the state's cyber resilience[.] ;
and - 15 - HB0042 compared with HB0042S03 (l) provide cybersecurity services to a local education agency as defined in Section 53E-1-102, including:
(i) cybersecurity assessments and vulnerability testing;
(ii) incident response coordination and support;
(iii) threat intelligence sharing relevant to the education sector;
(iv) technical assistance in implementing cybersecurity standards required under Section 53G-8-902;
(v) cybersecurity awareness training resources;
and (vi) coordination with the Utah Education and Telehealth Network on relevant security matters in accordance with Section 53H-4-213.4.
{Section 8.
Section 63A-16-1103 is amended to read:
} 63A-16-1103.
Assistance to governmental entities -- Records.
(1) The Cyber Center shall provide a governmental entity with assistance in responding to a data breach reported under Section 63A-19-405, which may include:
(a) conducting all or part of an internal investigation into the data breach;
(b) assisting law enforcement with the law enforcement investigation if needed;
(c) determining the scope of the data breach;
(d) assisting the governmental entity in restoring the reasonable integrity of the system;
or (e) providing any other assistance in response to the reported data breach.
(2) (a) A governmental entity that is required to submit information under Section 63A-19-405 shall provide records to the Cyber Center as a shared record in accordance with Section 63G-2-206.
(b) The following information may be deemed confidential and may only be shared as provided in Section 63G-2-206:
(i) the information provided to the Cyber Center by a governmental entity under Section 63A-19-405;
and (ii) the information produced by the Cyber Center in response to a report of a data breach under Subsection (1).
(3) In addition to all requirements for a governmental entity in this part, a local education agency shall submit information in accordance with Section 53G-8-902.
{Section 9.
Section 63A-19-101 is amended to read:
} 63A-19-101.
Definitions.
- 16 - HB0042 compared with HB0042S03 As used in this chapter:
(1) "Anonymized data" means information that has been irreversibly modified so that there is no possibility of using the information, alone or in combination with other information, to identify an individual.
(2) "At-risk government employee" means the same as that term is defined in Section 63G-2-303.
(3) "Automated decision making" means using personal data to make a decision about an individual through automated processing, without human review or intervention.
(4) "Biometric data" means the same as that term is defined in Section 13-61-101.
(5) "Chief administrative officer" means the same as that term is defined in Section 63A-12-100.5.
(6) "Chief privacy officer" means the individual appointed under Section 63A-19-302.
(7) "Commission" means the Utah Privacy Commission established in Section 63A-19-203.
(8) "Contract" means an agreement between a governmental entity and a person for goods or services that involve personal data.
(9) (a) "Contractor" means a person who:
(i) has entered into a contract with a governmental entity;
and (ii) may process personal data under the contract.
(b) "Contractor" includes a contractor's employees, agents, or subcontractors.
(10) "Cyber Center" means the Utah Cyber Center created in Section 63A-16-1102.
(11) "Data breach" means the unauthorized access, acquisition, disclosure, loss of access, or destruction of personal data held by a governmental entity, unless the governmental entity concludes, according to standards established by the Cyber Center, that there is a low probability that personal data has been compromised.
(12) "De-identified data" means information from which personal data has been removed or obscured so that the information is not readily identifiable to a specific individual, and which may not be re- identified.
(13) "Genetic data" means the same as that term is defined in Section 13-60-102.
(14) "Governing board" means the Utah Privacy Governing Board established in Section 63A-19-201.
(15) "Governmental entity" means the same as that term is defined in Section 63G-2-103 and includes a local education agency as that term is defined in Section 53E-1-102.
- 17 - HB0042 compared with HB0042S03 (16) "Government website" means a set of related web pages that is operated by or on behalf of a governmental entity and is:
(a) located under a single domain name or web address;
and (b) accessible directly through the Internet or by the use of a software program.
(17) (a) "High-risk processing activities" means a governmental entity's processing of personal data that may have a significant impact on an individual's privacy interests, based on factors that include:
(i) the sensitivity of the personal data processed;
(ii) the amount of personal data being processed;
(iii) the individual's ability to consent to the processing of personal data;
and (iv) risks of unauthorized access or use.
(b) "High-risk processing activities" may include the use of:
(i) facial recognition technology;
(ii) automated decision making;
(iii) profiling;
(iv) genetic data;
(v) biometric data;
or (vi) geolocation data.
(18) "Independent entity" means the same as that term is defined in Section 63E-1-102.
(19) "Individual" means the same as that term is defined in Section 63G-2-103.
(20) "Legal guardian" means:
(a) the parent of a minor;
or (b) an individual appointed by a court to be the guardian of a minor or incapacitated individual and given legal authority to make decisions regarding the person or property of the minor or incapacitated individual.
(21) "Office" means the Utah Office of Data Privacy created in Section 63A-19-301.
(22) "Ombudsperson" means the data privacy ombudsperson appointed under Section 63A-19-501.
(23) "Person" means the same as that term is defined in Section 63G-2-103.
(24) "Personal data" means information that is linked or can be reasonably linked to an identified individual or an identifiable individual.
- 18 - HB0042 compared with HB0042S03 (25) "Privacy annotation" means a summary of personal data contained in a record series as described in Section 63A-19-401.1.
(26) "Privacy practice" means a governmental entity's:
(a) organizational, technical, administrative, and physical safeguards designed to protect an individual's personal data;
(b) policies and procedures related to the acquisition, use, storage, sharing, retention, and disposal of personal data;
and (c) practice of providing notice to an individual regarding the individual's privacy rights.
(27) "Process," "processing," or "processing activity" means any operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, access, retrieval, consultation, use, disclosure by transmission, transfer, dissemination, alignment, combination, restriction, erasure, or destruction.
(28) "Profiling" means the processing of personal data to evaluate or predict an individual's:
(a) economic situation;
(b) health;
(c) personal preferences;
(d) interests;
(e) reliability;
(f) behavior;
(g) location;
or (h) movements.
(29) "Purchase" or "purchasing" means the exchange of monetary consideration to obtain the personal data of an individual who is not a party to the transaction.
(30) "Record" means the same as that term is defined in Section 63G-2-103.
(31) "Record series" means the same as that term is defined in Section 63G-2-103.
(32) "Retention schedule" means a governmental entity's schedule for the retention or disposal of records that has been approved by the Records Management Committee pursuant to Section 63A-12-113.
(33) (a) "Sell" means an exchange of personal data for monetary consideration by a governmental entity to a third party.
- 19 - HB0042 compared with HB0042S03 (b) "Sell" does not include a fee:
(i) charged by a governmental entity for access to a record pursuant to Section 63G-2-203;
or (ii) assessed in accordance with an approved fee schedule.
(34) (a) "State agency" means the following entities that are under the direct supervision and control of the governor or the lieutenant governor:
(i) a department;
(ii) a commission;
(iii) a board;
(iv) a council;
(v) an institution;
(vi) an officer;
(vii) a corporation;
(viii) a fund;
(ix) a division;
(x) an office;
(xi) a committee;
(xii) an authority;
(xiii) a laboratory;
(xiv) a library;
(xv) a bureau;
(xvi) a panel;
(xvii) another administrative unit of the state;
or (xviii) an agent of an entity described in Subsections (34)(a)(i) through (xvii).
(b) "State agency" does not include:
(i) the legislative branch;
(ii) the judicial branch;
(iii) an executive branch agency within the Office of the Attorney General, the state auditor, the state treasurer, or the State Board of Education;
or (iv) an independent entity.
(35) "State privacy auditor" means the same as that term is defined in Section 67-3-13.
- 20 - HB0042 compared with HB0042S03 (36) "Synthetic data" means artificial data that:
(a) is generated from personal data;
and (b) models the statistical properties of the original personal data.
(37) "User" means an individual who accesses a government website.
(38) (a) "User data" means any information about a user that is automatically collected by a government website when a user accesses the government website.
(b) "User data" includes information that identifies:
(i) a user as having requested or obtained specific materials or services from a government website;
(ii) Internet sites visited by a user;
(iii) the contents of a user's data-storage device;
(iv) any identifying code linked to a user of a government website;
and (v) a user's:
(A) IP or Mac address;
or (B) session ID.
(39) "Website tracking technology" means any tool used by a government website to:
(a) monitor a user's behavior;
or (b) collect user data.
- 10 - HB0042S01 compared with HB0042S03 63C-27-201.
63C-27-201.
(g) the executive director of the Utah Department of Transportation shall designate a representative with professional experience in information technology or cybersecurity;
- 21 - HB0042 compared with HB0042S03 (g) the executive director of the Utah Department of Transportation shall designate a representative with professional experience in information technology or cybersecurity;
(q) two local education agency employees tasked with job duties that include systems and security management from one charter school and one school district whom the state superintendent selects;
{(q) {the state superintendent of public instruction or the state superintendent's designee;} } (r)(q) two local education agency employees tasked with job duties that include systems and security management from one charter school and one school district whom the state superintendent selects;
- 11 - HB0042S01 compared with HB0042S03 [(q)] (r) the highest ranking information technology official, or the official's designee, from each of:
[(q)] (s){(r)} the highest ranking information technology official, or the official's designee, from each of:
[(r)] (s) the governor shall appoint:
[(r)] (t){(s)} the governor shall appoint:
[(s)] (t) the president of the Senate shall appoint one member of the Senate;
[(s)] (u){(t)} the president of the Senate shall appoint one member of the Senate;
and [(t)] (u) the speaker of the House of Representatives shall appoint one member of the House of Representatives.
and - 22 - HB0042 compared with HB0042S03 [(t)] (v){(u)} the speaker of the House of Representatives shall appoint one member of the House of Representatives.
- 12 - HB0042S01 compared with HB0042S03 (c) Notwithstanding the requirements of Subsection (7)(a), the governor shall, at the time of appointment or reappointment, adjust the length of terms to ensure that the terms of commission members are staggered so that approximately half of the commission members appointed under Subsection [(2)(r)] (2) are appointed every two years.
(c) Notwithstanding the requirements of Subsection (7)(a), the governor shall, at the time of appointment or reappointment, adjust the length of terms to ensure that the terms of commission members are staggered so that approximately half of the commission members appointed under Subsection [(2)(r)] (2) are appointed every two years.
(9) (a) A majority of the members of the commission is a quorum.
- 23 - HB0042 compared with HB0042S03 (9) (a) A majority of the members of the commission is a quorum.
- 13 - HB0042S01 compared with HB0042S03 (4) share information;
(4) share information;
(a) align with industry recognized cybersecurity frameworks and standards, including frameworks developed by the National Institute of Standards and Technology, the Center for Internet Security, or a successor organization;
- 24 - HB0042 compared with HB0042S03 (a) align with industry recognized cybersecurity frameworks and standards, including frameworks developed by the National Institute of Standards and Technology, the Center for Internet Security, or a successor organization;
- 14 - HB0042S01 compared with HB0042S03 If H.B.
If H.B.
2-13-26 12:22 PM - 15 -
2-13-26 12:22 PM - 25 -
⬇ Download PDF