Utah Code § 63A-19-302: Chief privacy officer -- Appointment -- Powers -- Reporting.

(1) The governor shall, with the advice and consent of the Senate, appoint a chief privacy officer.

(2) The chief privacy officer is the director of the office.

(3) The chief privacy officer:

(a) shall exercise all powers given to and perform all duties imposed on the office;

(b) has administrative authority over the office;

(c) may make changes in office personnel and service functions under the chief privacy officer's administrative authority;

(d) may authorize a designee to assist with the chief privacy officer's responsibilities; and

(e) shall report annually, on or before June 30, to the Government Operations Interim Committee regarding:

(i) recommendations for legislation to address data privacy concerns; and

(ii) reports received from state agencies regarding the sale or sharing of personal data provided under Section 63A-19-401.3.