Work and private use of data online are intertwined and both need to be protected.
There is good news and bad news in the recent enactment of the Utah Consumer Privacy Act (UCPA), which has now been signed into law by Governor Spencer Cox. It takes effect on January 1, 2023.
On the positive side, consumers in Utah will have the right to access and delete certain personal data maintained by certain companies and to opt out of the collection and use of that data by those companies. The law also creates a right for consumers to know what personal data companies collect, how companies use that data, and whether they sell that data to others. At the request of a consumer, businesses will also be required to end these practices.
Unfortunately, the new law does not adequately reflect the “new normal” of COVID-19 and the post-pandemic world we will live in for years to come. Indeed, the UCPA explicitly excludes consumers who “act in an employment or commercial context”.
But in practice, those who work from home operate simultaneously in a domestic context and “a business or employment context”. The lines between the two are blurred and seem destined to remain so in a world where working from home is an established way of life that is destined to endure.
During the pandemic, when business sites and offices closed or limited physical operations, large numbers of Americans remained employed in work-from-home environments. According to Statista, a leading market and consumer data provider, 17% of U.S. employees worked from home five or more days a week prior to March 2020, a share that rose to 44% during the coronavirus pandemic. And according to a Reset Work survey, 86% of employers said they were considering adopting a hybrid working model among those who made firm commitments to home/work mix; only 6% expect employees to return to a traditional five-day work week in the office.
Many, if not most, of these employees use their own laptops, tablets, cell phones and other devices on home broadband networks, managing all aspects of their personal and professional lives. Work and leisure are now merged as a practical matter. Our lives have converged on a new digital reality where we switch between these two worlds with increasing fluidity.
The most important lesson for this legislation is simple: digital privacy must be considered for post-pandemic times, where an exponential amount of personal data is generated with an inevitable mix between what was once considered work and what was leisure.
All Utah residents should be protected by a law that allows them to turn on and off at home with a greater sense of digital privacy.