Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy Gdpa topic
No spam. Unsubscribe anytime.
Regional advisor outlines Utah Government Data Privacy Act requirements for Interlaken
Summary
Spencer Foster of the Mountainland Association of Governments summarized the new Utah Government Data Privacy Act (Utah Code 63A-19), explained immediate reporting requirements, and offered free technical assistance to help Interlaken meet a Dec. 31, 2025 deadline for a privacy program report.
Spencer Foster, local administrative advisor with the Mountainland Association of Governments, briefed the Interlaken Town Council on the state's Government Data Privacy Act (GDPA), which he said is codified at Utah Code 63A-19 and took effect after the 2024 legislative session.
Foster told the council the immediate requirement under the new law is that each local agency complete a privacy program report by Dec. 31, 2025. He said the report is largely a questionnaire about what data the town collects, how it is stored and shared, and whether staff and local officials have received basic training.
"The program allows me to do that for free," Foster said, offering his assistance to compile the report and to provide templates for a future privacy policy and staff training. He said the state is taking a phased approach: the privacy program report is the only mandatory submission this year and will remain an internal document for 2025; agencies will later adopt privacy policies and perform maturity assessments.
Foster recommended that Interlaken appoint two privacy leads: a chief administrative officer (CAO) for the privacy program and a records officer. He noted the CAO position for the privacy program is distinct from other CAO or records responsibilities and suggested the council promptly name local staff to those roles so the town can complete the report before the deadline. He also outlined routine practices that will reduce risk: collecting only necessary personal data, posting notices on web forms, not selling personal data, maintaining a data inventory of vendors and shared systems, and annual staff training.
Councilmembers asked for the presentation materials and a template resolution to appoint privacy leadership. Foster said he would email the slide deck, the training video link, and sample resolution language and would work with town staff to customize templates and resources.
Foster and council members noted the state's timeline for program maturity: agencies are expected to develop more complete privacy programs over several years and the state does not expect mature programs from all local agencies for five to 10 years.
The council did not take formal action at the meeting; Foster's presentation concluded with an offer of follow-up assistance and training materials.
