§ 13-61-402 — Enforcement powers of the attorney general.

(1) The attorney general has the exclusive authority to enforce this chapter.
(2) Upon referral from the division, the attorney general may initiate an enforcement action against a controller or processor for a violation of this chapter.
(3) (3)(a) At least 30 days before the day on which the attorney general initiates an enforcement action against a controller or processor, the attorney general shall provide the controller or processor:
(3)(a)(i) written notice identifying each provision of this chapter the attorney general alleges the controller or processor has violated or is violating; and
(3)(a)(ii) an explanation of the basis for each allegation.
(3)(b) The attorney general may not initiate an action if the controller or processor:
(3)(b)(i) cures the noticed violation within 30 days after the day on which the controller or processor receives the written notice described in Subsection (3)(a); and
(3)(b)(ii) provides the attorney general an express written statement that:

(3)(b)(ii)(A) the violation has been cured; and
(3)(b)(ii)(B) no further violation of the cured violation will occur.
(3)(c) The attorney general may initiate an action against a controller or processor who:
(3)(c)(i) fails to cure a violation after receiving the notice described in Subsection (3)(a); or
(3)(c)(ii) after curing a noticed violation and providing a written statement in accordance with Subsection (3)(b), continues to violate this chapter.
(3)(d) In an action described in Subsection (3)(c), the attorney general may recover:
(3)(d)(i) actual damages to the consumer; and
(3)(d)(ii) for each violation described in Subsection (3)(c), an amount not to exceed $7,500.
(4) All money received from an action under this chapter shall be deposited into the Consumer Privacy Account established in Section 13-61-403.
(5) If more than one controller or processor are involved in the same processing in violation of this chapter, the liability for the violation shall be allocated among the controllers or processors according to the principles of comparative fault.

Legislative History

Enacted by Chapter 462, 2022 General Session