13-37 - Notice of Intent to Sell Nonpublic Personal Information Act
Title 13 > 13-37
Sections (5)
General Provisions
13-37-101 - Title.
This chapter is known as the “Notice of Intent to Sell Nonpublic Personal Information Act.”
Enacted by Chapter 97, 2003 General Session
13-37-102 - Definitions.
As used in this chapter:
(1) “Affiliate” means a person that controls, is controlled by, or is under common control with:a commercial entity; anddirectly; orindirectly through one or more intermediaries.
(2) Subject to Subsection (2)(b), “commercial entity” means a person that:maintains a physical office in the state; andin the ordinary course transacts business at the physical office with consumers located in the state.”Commercial entity” does not include:a governmental entity; oran entity providing services on behalf of a governmental entity.
(3) “Compensation” means anything of economic value that is paid or transferred to a commercial entity for or in direct consideration of the disclosure of nonpublic personal information.
(4) “Consumer transaction” means:a sale, lease, assignment, award by chance, or other written or oral transfer or disposition:that is initiated or completed in this state; andof:goods;services; orother tangible or intangible property, except securities and insurance or services related thereto; ora transaction:that is initiated or completed in this state; andthat constitutes credit offered or extended by a commercial entity to a person primarily for personal, family, or household purposes.”Consumer transaction” includes:the use of nonpublic personal information in relation to a transaction with a person if the transaction is for primarily personal, family, or household purposes; andwith respect to any transaction described in Subsection (4)(a):an offer or solicitation;an agreement;the performance of an agreement; ora charitable solicitation as defined in Section 13-11-3.”Consumer transaction” does not include a transaction related to real property.
(5) “Nonpublic personal information” means information that:is not public information; andeither alone or in conjunction with public information, identifies a person in distinction from other persons.”Nonpublic personal information” includes:a person’s Social Security number;information used to determine a person’s credit worthiness including a person’s:income; oremployment history;the purchasing patterns of a person; orthe personal preferences of a person.
(6) “Physical office” means a location:accessible to the public during normal business hours;staffed by one or more individuals who conduct business on behalf of the commercial entity; andused for the primary purpose of transacting business with consumers in the state.”Physical office” does not include a post office box, mailing address, registered agent, or virtual office that a person solely relies on for business correspondence.
(7) “Public information” means a person’s:name;telephone number; orstreet address.
(8) Subject to Subsection (8)(b), “third party” means a person other than the commercial entity that obtains nonpublic personal information.”Third party” does not include an affiliate or agent of the commercial entity that obtains nonpublic personal information.
Amended by Chapter 542, 2025 General Session
Notice of Disclosure
13-37-201 - Required notice.
(1) In accordance with this section, a commercial entity shall provide the notice described in this section to a person if:the commercial entity enters into a consumer transaction with that person;as a result of the consumer transaction described in this Subsection (1)(a), the commercial entity obtains nonpublic personal information concerning that person; andthe commercial entity intends to or wants the ability to disclose the nonpublic personal information: to a third party; andfor compensation; andthe compensation described in Subsection (1)(a)(iii)(B): is the primary consideration for the commercial entity disclosing the nonpublic personal information;is directly related to the commercial entity disclosing the nonpublic personal information; andis not compensation received by the commercial entity in consideration of a transaction described in Subsection (5).For purposes of this chapter, a commercial entity is considered to have obtained information as a result of a consumer transaction if:the person provides the information to the commercial entity: at any time during the consumer transaction; andat the request of the commercial entity; orthe commercial entity otherwise obtains the information; andbut for the consumer transaction, the commercial entity would not obtain the information.
(2) The notice required by Subsection (1) shall be given before the earlier of: the point at which the person is requested to provide the nonpublic personal information; orthe commercial entity otherwise obtains the nonpublic personal information as a result of the consumer transaction described in Subsection (1)(a).
(3) The notice required by Subsection (1): shall read substantially as follows: “We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation.”;may be made:orally, if the consumer transaction itself is entirely conducted orally; orin writing, if the notice is written in dark bold; andshall be sufficiently conspicuous so that a reasonable person would perceive the notice before providing the nonpublic personal information.
(4) This chapter does not apply to: a commercial entity that is subject to a federal law or regulation that governs the disclosure of nonpublic information to a third party; ora covered entity as defined in 45 C.F.R. Parts 160 and 164.
(5) Notwithstanding the other provisions of this section, a commercial entity is not required to provide notice under this section if: the disclosure of the nonpublic personal information is related to the third party providing to the commercial entity:services, including business outsource services;personal or real property; orother thing of value; andcompensation received by the commercial entity as part of the transaction is received by the commercial entity for or in consideration of the transaction described in Subsection (5)(a).
Enacted by Chapter 97, 2003 General Session
13-37-202 - Disclosure of nonpublic personal information prohibited without notice.
(1) A commercial entity may not disclose nonpublic personal information that the commercial entity obtained on or after January 1, 2004, as a result of a consumer transaction if the commercial entity fails to comply with Section 13-37-201.
(2) This chapter may not be interpreted as authorizing a commercial entity to disclose nonpublic personal information to a greater extent than the commercial entity is otherwise permitted to disclose nonpublic personal information.
Enacted by Chapter 97, 2003 General Session
13-37-203 - Liability and remedy.
(1) As a person’s only remedy under this chapter, a person may bring an individual action, not a class action or act in a representative capacity, against a commercial entity in a federal or state court with jurisdiction if:the commercial entity enters into a consumer transaction with that person;as a result of the consumer transaction described in Subsection (1)(a), the commercial entity obtains nonpublic personal information concerning that person; andthe commercial entity violates this chapter.
(2) In an action brought under Subsection (1), a commercial entity that violates this chapter is liable to the person individually, but not to a class or to a person in a representative capacity, who brings the action for:$500 for each time the commercial entity fails to provide the notice required by this section in relation to the nonpublic personal information of the person who brings the action; andcourt costs.
(3) An action for a violation of this chapter may only be brought in accordance with Section 78B-2-302 within one year from the day of the consumer transaction at issue.
(4) The Legislature finds that since January 1, 2004, the prohibition on bringing a class action is a remedy provision and not merely procedural.
Amended by Chapter 542, 2025 General Session