As class actions based on decades-old data privacy laws proliferate, another “old” law that restricts data sharing is coming into the mix – Utah’s Notice of Intent to Sell Nonpublic Personal Information Act, Utah Code Ann. § 13-37-101-203 (“UNISNPIA”). Passed in 2003, the law states that a “commercial entity may not disclose nonpublic personal information that the commercial entity obtained on or after January 1, 2004, as a result of a consumer transaction if the commercial entity fails to comply with the [notice provisions].” § 202(1).¹ The statute explicitly prohibits class actions – hence its relative dormancy for 20 years – but a federal court in Utah has recently allowed a federal class action based on UNISNPIA to proceed, changing the landscape.

UNISNPIA, like other laws that have recently been the basis of waves of class action lawsuits, such as the federal Video Privacy Protection Act (Dentons analysis here), the California Invasion of Privacy Act, and Michigan’s Preservation of Personal Privacy Act, provides for statutory damages. The law provides for $500 for “each time the commercial entity fails to provide” the required notice. § 203(2)(a). Written notice must substantially read in dark bold: “We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation.” § 201(3)(a).

Notably, “nonpublic personal information” includes not just “(i) a person’s Social Security number; (ii) information used to determine a person’s credit worthiness including a person’s… income [and] employment history” but also “the purchasing patterns of a person” and “the personal preferences of a person.” § 102(5). Commercial entities are not required to provide notice if they are disclosing the nonpublic personal information as part of a transaction with a third party where the third party is providing them with something of value (such as “business outsource services” or “personal or real property”), and the compensation received is in consideration of that transaction. § 201(5)(a).

The law defines “commercial entity” as a person that has an office or other place of business located in Utah and in the ordinary course of business transacts a consumer transaction in Utah. § 102(2)(a). Consumer transactions are limited to those that are “initiated” or “completed” in Utah. § 102(4). There has not been significant judicial scrutiny of jurisdictional limits of the law yet, but in one recently filed case, the plaintiffs alleged that a defendant was a “commercial entity” within the meaning of the law because it had a registered agent for service of process in Utah and has employees who work for the company from Utah.

The statute explicitly prohibits class actions in section 203 (“A person may not bring a class action under this chapter”), however, in Curry v. Mrs. Fields Gifts, Inc., 2023 WL 6318108 (D. Utah, Sept. 28, 2023), the court nonetheless allowed the putative class action to proceed in federal court under the Class Action Fairness Act, citing Shady Grove Orthopedic Assocs., P.A. v. Allstate Ins. Co., 559 U.S. 393 (2010). The court ruled that “[s]urgical removal of the presumptively procedural class-action bar leaves the rights and remedies otherwise provided by the Act totally intact” and thus, the class action could proceed in federal court.

This ruling, coupled with UNISNPIA’s statutory damages, provides fertile ground for plaintiffs’ lawyers looking to reap massive fees in class actions against a variety of companies, such as retailers, subscription business and many others that may have disclosed “nonpublic personal information” for compensation, such as for direct marketing to customers.

Companies should consider proactive steps to assess and prevent liability. Your Dentons team can help your company evaluate whether your practices fall within the scope of UNISNPIA and if so, whether and how to update your notices. If your company is served with a complaint alleging violations of UNISNPIA, Dentons has experienced litigators who are well-versed in consumer privacy statutes like UNISNPIA and can help you efficiently evaluate and litigate the matter.

[1]This is separate from Utah’s Consumer Privacy Act, a comprehensive privacy act that went into effect December 31, 2023, which establishes notice requirements, controller and processor obligations, as well as consumers' rights around access, deletion, portability, and provides for enforcement by the Attorney General.