Utah Code § 13-44-301 Enforcement -- Confidentiality agreement -- Penalties.
13-44-301. Enforcement -- Confidentiality agreement -- Penalties.
(1) The attorney general may enforce this chapter's provisions.
(2)
(a) Nothing in this chapter creates a private right of action.
(b) Nothing in this chapter affects any private right of action existing under other law, including contract or tort.
(3) A person who violates this chapter's provisions is subject to a civil penalty of:
(a) no greater than $2,500 for a violation or series of violations concerning a specific consumer; and
(b) no greater than $100,000 in the aggregate for related violations concerning more than one consumer, unless:
(i) the violations concern:
(A) 10,000 or more consumers who are residents of the state; and
(B) 10,000 or more consumers who are residents of other states; or
(ii) the person agrees to settle for a greater amount.
(4)
(a) In addition to the penalties provided in Subsection (3), the attorney general may seek, in an action brought under this chapter:
(i) injunctive relief to prevent future violations of this chapter; and
(ii) attorney fees and costs.
(b) Notwithstanding Title 78B, Chapter 3a, Venue for Civil Actions, if the attorney general brings an action under this chapter in the district court, the attorney general shall bring the action in:
(i) Salt Lake City; or
(ii) the county in which resides a consumer who is affected by the violation.
(5) The attorney general shall deposit any amount received under Subsection (3), (4), or (10) into the Attorney General Litigation Fund created in Section 67-5-40.
(6) In enforcing this chapter, the attorney general may:
(a) investigate the actions of any person alleged to violate Section 13-44-201 or 13-44-202;
(b) subpoena a witness;
(c) subpoena a document or other evidence;
(d) require the production of books, papers, contracts, records, or other information relevant to an investigation;
(e) conduct an adjudication in accordance with Title 63G, Chapter 4, Administrative Procedures Act, to enforce a civil provision under this chapter; and
(f) enter into a confidentiality agreement in accordance with Subsection (7).
(7)
(a) If the attorney general has reasonable cause to believe that an individual is in possession, custody, or control of information that is relevant to enforcing this chapter, the attorney general may enter into a confidentiality agreement with the individual.
(b) In a civil action brought under this chapter, a court may issue a confidentiality order that incorporates the confidentiality agreement described in Subsection (7)(a).
(c) A confidentiality agreement entered into under Subsection (7)(a) or a confidentiality order issued under Subsection (7)(b) may:
(i) address a procedure;
(ii) address testimony taken, a document produced, or material produced under this section;
(iii) provide whom may access testimony taken, a document produced, or material produced under this section;
(iv) provide for safeguarding testimony taken, a document produced, or material produced under this section; or
(v) require that the attorney general:
(A) return a document or material to an individual; or
(B) notwithstanding Section 63A-12-105 or a retention schedule created in accordance with Section 63G-2-604, destroy the document or material at a designated time.
(8) A subpoena issued under Subsection (6) may be served by certified mail.
(9) A person's failure to respond to a request or subpoena from the attorney general under Subsection (6)(b), (c), or (d) is a violation of this chapter.
(10)
(a) The attorney general may inspect and copy all records related to the business conducted by the person alleged to have violated this chapter, including records located outside the state.
(b) For records located outside of the state, the person who is found to have violated this chapter shall pay the attorney general's expenses to inspect the records, including travel costs.
(c) Upon notification from the attorney general of the attorney general's intent to inspect records located outside of the state, the person who is found to have violated this chapter shall pay the attorney general $500, or a higher amount if $500 is estimated to be insufficient, to cover the attorney general's expenses to inspect the records.
(d) To the extent an amount paid to the attorney general by a person who is found to have violated this chapter is not expended by the attorney general, the amount shall be refunded to the person who is found to have violated this chapter.
(e) The Division of Corporations and Commercial Code or any other relevant entity shall revoke any authorization to do business in this state of a person who fails to pay any amount required under this Subsection (10).
(11)
(a) Subject to Subsection (11)(c), the attorney general shall keep confidential a procedure agreed to, testimony taken, a document produced, or material produced under this section pursuant to a subpoena, confidentiality agreement, or confidentiality order, unless the individual who agreed to the procedure, provided testimony, produced the document, or produced material waives confidentiality in writing.
(b) Subject to Subsections (11)(c) and (11)(d), the attorney general may use, in an enforcement action taken under this section, testimony taken, a document produced, or material produced under this section to the extent the use is not restricted or prohibited by a confidentiality agreement or a confidentiality order.
(c) The attorney general may use, in an enforcement action taken under this section, testimony taken, a document produced, or material produced under this section that is restricted or prohibited from use by a confidentiality agreement or a confidentiality order if the individual who provided testimony or produced the document or material waives the restriction or prohibition in writing.
(d) The attorney general may disclose testimony taken, a document produced, or material produced under this section, without consent of the individual who provided the testimony or produced the document or material, or the consent of an individual being investigated, to:
(i) a grand jury; or
(ii) a federal or state law enforcement officer, if the person from whom the information was obtained is notified 20 days or greater before the day on which the information is disclosed, and the federal or state law enforcement officer certifies that the federal or state law enforcement officer will:
(A) maintain the confidentiality of the testimony, document, or material; and
(B) use the testimony, document, or material solely for an official law enforcement purpose.
(12)
(a) An administrative action filed under this chapter shall be commenced no later than 10 years after the day on which the alleged breach of system security last occurred.
(b) A civil action under this chapter shall be commenced no later than five years after the day on which the alleged breach of system security last occurred.
Amended by Chapter 173, 2025 General Session