In one paragraph
Utah H.B. 444 (2025) amends the Government Data Privacy Act for state and local governmental entities. It defines "automated decision making" (decisions about a person by automated processing without human review) and says high-risk processing activities may include facial recognition technology and automated decision making. Each entity must describe its high-risk processing in an annual privacy program report, and the Utah Office of Data Privacy, which monitors high-risk processing, must help identify best practices on automated decision making and synthetic data. It applies to government, not businesses. Passed by two-thirds, it took effect when signed on March 27, 2025.
Plain-English summary, written with AI assistance. The official text controls.
What it means for business
Vendors selling facial recognition or automated decision tools to Utah state and local agencies should expect those uses to be treated as high-risk processing subject to reporting and oversight.
Key provisions
- Utah Code 63A-19-101: defines automated decision making (decisions about an individual by automated processing without human review)
- High-risk processing activities may include facial recognition technology and automated decision making
- New 63A-19-401.3: annual privacy program report by each governmental entity must describe its high-risk processing activities
- Utah Office of Data Privacy to monitor high-risk processing and identify best practices on automated decision making and synthetic data
- Took effect on the Governor's signature (Mar. 27, 2025) after two-thirds passage
Latest legislative action
Mar 27, 2025. Governor Signed
Topics and industries
Related topics
Affected industries
This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error