On March 11, 2021, Utah Governor Spencer Cox signed the Cybersecurity Affirmative Defense Act (the “Act”) into law. The Act creates affirmative defenses to certain causes of action arising out of a breach of system security. See generallyUtah Code Ann. §78B-4-701 et seq.
The Act defines a breach of system security as including “an unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information.” Utah Code Ann. § 13-44-102(1)(a). Similarly, the Act defines personal information as including a person’s first name and last name when combined with a social security number, financial account number in combination with a required security code, and a driver’s license. Utah Code Ann. § 13-44-102(1)(a).
The Act provides that business that “creates, maintains, and reasonably complies with a written cybersecurity program” and that is “in place at the time of breach of system security” shall be afforded an affirmative defense to tort claims arising out of the business alleged “fail[ure] to implement reasonable information security controls that resulted in the breach of system security.” Utah Code Ann. § 78B-4-702.
Whereas the Act requires a written cybersecurity program, it does not set forth a new technical cybersecurity standard. Instead, the Act requires that a written cybersecurity program “shall provide administrative, technical, and physical safeguards to protect personal information” and that a cybersecurity program should “reasonably conforms to the current version of” NIST 800-171, NIST 800-53, ISO 2700, and the HIPAA Security rule. Utah Code Ann. § 78B-4-702(4); Utah Code Ann. § 78B-4-703(1)(b). Altogether this requirement for a written cybersecurity program is not entirely dissimilar to a business cybersecurity program requirements under New York’s “Stop Hacks and Improve Electronic Data Security Act” (SHIELD Act), which we further outlined here.
There are a couple other notable provisions to the Act. First, the Act does not create a private right of action if a business failed to comply with the Act. Utah Code Ann. § 78B-4-704. Second, the Act provides that if an action is brought in another state, but is governed by Utah law, then the Act should apply. Utah Code Ann. § 78B-4-705. As such, if a Utah business is sued in court for an alleged failure to implement information security standards and a resulting breach, it may rely on the Cybersecurity Affirmative Defense Act to the extent that it had and followed its written cybersecurity program. Moreover, Utah isn’t alone in providing for an affirmative defense as Ohio adopted similar legislation in 2018. See Ohio Rev. Code Ann. § 1354 et seq.
Octillo closely monitors for any and all changes in the law related to breaches of system security, data breaches, or other cyber security incidents. Octillo’s team of attorneys and technologist are especially entuned with both responding to a data breach and understand what a robust written cyber security program would entail.
*Attorney Advertising. Prior results do not guarantee future outcomes.
Subscribe to our Newsletter.
