Following passage by both chambers of the state legislature, the Utah Consumer Privacy Act, which excludes HR data and does not include a private right of action, awaits signature by Governor Spencer Cox (R).
Utah is likely to become the fourth state to enact a comprehensive consumer privacy measure, following the footsteps of California, Colorado, and Virginia. Each of the state measures includes provisions ensuring HR data is not covered. However, the California Consumer Privacy Act’s HR data exclusion sunsets on January 1, 2023.
As federal lawmakers consider privacy legislation, the trend at the state level to exclude HR data is a positive signal for employers, particularly with HR technologies an increasingly important aspect of HR management, recruitment, and retention strategies.
However, federal activity slow to develop: Last week, the House Energy and Commerce Committee held a hearing on five tech-related bills, but did not consider any particular comprehensive consumer privacy measure. The hearing did cover the Algorithmic Accountability Act of 2022, which would require large employers to conduct impact assessments of automated employment decisions and submit such reports to the FTC, which would then publish a repository of information on the automated systems companies reported.