Utah chief privacy officer describes government data privacy law and urges records-management reforms

At a community meeting in Lehi, Utah, Utah Chief Privacy Officer Chris Bramwell told attendees the state has consolidated government privacy requirements under the Government Data Privacy Act and is working to bring agencies into compliance.

Bramwell introduced himself as "Utah's first chief privacy officer" and said the position, appointed by Governor Cox and confirmed by the state senate, was created by the legislature to represent citizens' privacy interests in government systems. "My primary duty is to represent your privacy interest and rights," he said.

Why it matters: Bramwell said government privacy differs from consumer privacy because government agencies can make decisions that affect "life and limb," increasing the stakes when data is mismanaged. He warned that many states remain noncompliant with outdated records-management laws, arguing that keeping personal data indefinitely raises the risk of harm.

Bramwell described how audits found long-standing retention rules were often antiquated. "Almost every state is non compliant with antiquated records management laws that currently we would call privacy," he said, and added that older statutes once limited collection, required purpose-and-use constraints and gave people the right to amend incorrect records.

He said the 2022 and 2023 legislative sessions produced the Government Data Privacy Act, which consolidates privacy requirements for government entities so agencies can be trained and measured against a common standard. "When I say we are the only state with comprehensive government data privacy law, you can go and read that act," he said, framing it as a statutory consolidation Utah has pursued over several sessions.

Bramwell acknowledged implementation challenges. Agencies must update systems and practices, he said, and the office is developing strategies to measure compliance and be more transparent about government data handling. He encouraged local organizers to share materials and offered to receive email contact for follow-up.

Meeting hosts also raised other items of local interest. Organizer Irene noted she had observed a committee action on a bill by Representative Corey Malloy to require ID to register to vote and said it had moved out of committee with three Democrats voting against it; she said she would provide the bill number at a future meeting.

The Davis County Citizen Journalism group intends to discuss bills at its next meeting, scheduled in two weeks, and to hold debates and candidate forums in coming weeks, organizers said.