Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Data Counsel

The ‘New-Look’ Song-Beverly Credit Card Act: Web-Tracker Edition

2024 Advertising CLE Showcase –  AI in Advertising: Practical Uses and Risk Management

Health Law Update

OHCA Proposes Material Updates to CMIR Regulations

Jonathan Barr, Jimmy Fokas and Maria Luevano Author Article for Corporate Governance Advisor

Until recently, Utah’s Notice of Intent to Sell Nonpublic Personal Information Act (UNISNPIA) had not been on the national privacy radar. However, a string of recent lawsuits has made clear it is a law of which companies should be aware.

core/paragraph

The law states that “[a] commercial entity may not disclose nonpublic personal information that the commercial entity obtained on or after January 1, 2004, as a result of a consumer transaction if the commercial entity fails to comply with the [notice provisions].” Notably, the law provides specific notice requirements detailing when and how notice should be given. Expanding its potential reach, the law includes “purchasing patterns of a person” in the definition of “nonpublic personal information.” However, it limits the definition of “commercial entity” to a person that has an office or other place of business located in Utah and in the ordinary course of business transacts a consumer transaction in Utah. Consumer transactions are limited to those that are “initiated” or “completed” in Utah. Of significant note, the law provides for a $500 per violation.

Despite being in effect for over 20 years, the law has not been one often discussed because it includes specific language stating that a “person may not bring a class action under this chapter.” However, the District of Utah recently issued a decision holding that because Rule 23 does not “abridge, enlarge or modify” Utah’s substantive rights under UNISNPIA, Rule 23 permits plaintiffs to maintain a class action suit. Curry v. Mrs. Fields Gifts, Inc., No. 222CV00651JNPDBP, 2023 WL 6318108, at *7 (D. Utah, Sept. 28, 2023). This decision, if followed, renders the class action ban moot in federal court. Therefore, until other courts in the Tenth Circuit hold otherwise, which we believe they should (though we note the Curry decision is not currently under appeal), we predict there will be an increased risk of lawsuits being filed against companies that do business in Utah and can be alleged to “disclose” customer information.

We are closely monitoring these developments and can provide counsel on potential avenues for mitigation and defense.

A Mountain of Privacy Lawsuits Might Be Coming to Utah

Featured Insights

Related Services

Featured Insights