Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
Mountainland official briefs Genola council on Utah’s Government Data Privacy Act; council told to appoint privacy leads and fill report by year-end
Summary
Spencer Foster of the Mountainland Association of Governments summarized the 2024 Government Data Privacy Act and told Genola officials they should appoint program leadership, review their privacy policy, inventory data holdings and complete the state privacy-program report by December 31 to show active progress toward compliance.
Mountainland Association of Governments (MAG) staff briefed the Genola Town Council on the Utah Government Data Privacy Act (GDPA), outlining near-term steps municipalities should take to show progress toward compliance.
Spencer Foster, MAG’s local administrative adviser for Wasatch, Summit and Utah counties, told the council the GDPA was passed in 2024 and applies to state and local government entities, including municipalities and special districts. He said the state initially set an earlier deadline but extended the timeline; municipalities must complete a privacy-program report (an internal, non-public form) by December 31 of the current year and show ongoing program development, with a longer-term expectation of full maturity by 2027 or later.
Foster recommended that the town designate a chief administrative officer (CAO) to oversee the privacy program (the mayor is commonly assigned) and a records officer (the city recorder is typically appropriate). He said the office of data privacy provides templates and trainings, including a short training video that municipalities can use to document staff training. Foster offered MAG assistance to populate the report and to review the town’s privacy policy and data-inventory practices.
Council members said the town had recently implemented a privacy policy in April, and staff confirmed the recorder (Lucinda) is positioned to serve as records officer and to coordinate training. Foster advised the council to document what personal data the town collects, why it is collected, who receives it (vendors or other agencies) and to adopt reasonable retention and access controls. He also recommended documenting vendor protections when the town shares personal data with outside entities.
Council members asked about interaction with GRAMA (the state records-access law). Foster said municipalities remain subject to GRAMA requests but should classify data consistently and document what is public versus private under GRAMA and the GDPA. Foster suggested using a resolution to name program leads and asked the town to contact MAG if staff want help filling out the state privacy-program report.
Council members did not enact a formal resolution at the meeting but directed staff to move forward with assigning program leadership and to work with MAG on next steps as needed.
