On the agenda: Slc Executive Coordinating Committee — facial recognition (Oct 26)

SALT LAKE COUNTY

2001 So. State Street
Salt Lake City, UT 84114

Executive Coordinating Committee
Meeting Agenda
Monday, October 26, 2026

1.

CALL TO ORDER

2.

PUBLIC COMMENT

3.

APPROVAL OF MINUTES

1:30 PM

3.1 September 28, 2026 Meeting Minutes

Room N2-800

26-1095

Presenter: Andrea De Paz - Senior Administrator & Council Liaison
Discussion - Vote Needed
Attachments:
1.
September ECC Meeting Minutes 9.28.26
4.

DISCUSSION ITEMS
4.1 ADA Web Compliance Update

26-1083

Presenter: Kelly Deleon, ADA/Employee Relations Coordinator
(15 minutes)
Informational
Attachments:
1.
ADA Web Compliance Presentation
4.2 SLCO Subsidies Related to Medicare Supplement Plan Premiums

26-1088

Presenter: David Delquadro
(5 minutes)
Informational
Attachments:
1.
DRAFT Medicare Supplement Policy Change 2026 Oct. 22

Page 1 of 19

Executive Coordinating Committee

5.

Meeting Agenda

October 26, 2026

STANDING UPDATES
5.1 Privacy Program and Smart Gov Fund Update

26-1089

Presenter: Javaid Lal - Director of Performance & Innovation
(10 Minutes)
Informational
Attachments: None
5.1 Privacy Program Update - Presentation

26-1093

Presenter: Javaid Lal - Director of Performance and & Innovation
(5 Minutes)
Informational
Attachments:
1.
SLCo_ECC_Privacy_Program_Update Oct 2026
5.1 Salt Lake County Policy on Personal Data Privacy

26-1094

Presenter: Javaid Lal - Director of Performance and Innovation1
(10 minutes)
Discussion - Vote Needed
Attachments:
1.
SLCo_Policy_2022_Proposed_Changes_2026
5.2 TAB Update

26-1090

Presenter: Tony Jolley - CIO
(Less than 5 Minutes)
Informational
Attachments: None
5.3 HR Update

26-1091

Presenter: Sharon Roux - Director of Human Resources
(Less than 5 Minutes)

Page 2 of 19

Executive Coordinating Committee

Meeting Agenda

October 26, 2026

Attachments: None
5.4 New Campus Update

26-1092

Presenter: Megan Hillyard - Director of Administrative Services
(Less than 5 Minutes)
Attachments: None
6.

OTHER BUSINESS

ADJOURN

Page 3 of 19

Executive Coordinating Committee Minutes
Monday, September 28th, 2026
1:30-3:00 Webex & N2-800

Office

Representative

Mayor
District Attorney
Auditor
Surveyor
Recorder
Assessor
Treasurer
Sheriff
Clerk
Public Works
Community Services
Admin Services
Human Services
Human Resources

Elise Courtney
Ralph Chamness
Chris Harding
Jerry Fletcher
Rashelle Hobbs
Chris Stavros
Sheila Srivastava
Rosa Rivera
Lannie Chapman
Scott Baird
Robin Chalhoub
Megan Hillyard
Kelly Colopy
Sharon Roux

Attorney
Staff

Adam Miller

Guests

Guests

Dave Delquadro
Robert Sampson
Nilsa Carter
Will Kocher
Isaac Higham
Tony Jolley
Hoa Nguyen
Alecia Williams
Chris Otto
Tom Hudachko
Cherie Root
Beth Graham
Maren Slaugh
Bridget Romano
Hannah Gorski
Carita Lucey
Beth Colosimo

Andrea DePaz

• A blank space denotes there was not a voting member for that agency in attendance.
Vote Needed – August Minutes
No discussion.
Motion to Approve: Megan Hillyard
2nd: Lannie Chapman
Unanimously approved
HR Policy 4-200 Leave Practices Policy Change – Nilsa Carter – Vote Needed
• Nilsa noted that this change moves the Leave approvals to the appropriate department.
Motion to approve: Scott Baird
2nd: Lannie Chapman
Unanimously approved

Page 4 of 19

TAB Update – Tony Jolley – Informational
• Upcoming meeting scheduled for October 22, containing follow up items and working group updates, as well as
smart government fund update.
HR Update – Sharon Roux – Informational
• We will be having a Total Rewards Advisory Committee Meeting at 9:00AM Thursday, Oct 1st where the priority
is to put together recommendations/information for the 2027 budget year for compensation and benefits. The
meeting will then be repeated with our employee associations on Friday. Presentation to Council to follow on
the following Tuesday for the benefits portion, as open enrollment is coming up – November 1st through
November 21st.
• Benefits fairs are coming up: November 4th at the Government Center and November 5th at the Veridian Center.
• Couple of other items coming up:
o Cultivating Trust Training for leaders – assigned to all the Mayor’s Portfolio leaders and any elected
offices that want to join.
o Performance check in date (second of the three check ins), is due on the 30th. Reminder: we need
August, April, as we go into year end because we will be using those to make sure everybody hits the
performance threshold to be able to get the merit increases. More information will coming out in the
next 30 days or so, about what that is going to look like for year end.
New Campus Update – Megan Hillyard – Informational
• We just had our project steering committee meeting last Thursday. We’ve hit milestones with new campus
projects recently: the architectural drawings have been submitted and we’re moving to hiring our contractor,
with first round of review happening on Thursday. Hoping permitting goes as expected to be under construction
shortly.
• We completed our 24th tour of the new campus last week; our goal this summer was to get as many employees
through there as possible. We’ve received great feedback in those tours; cautious optimism at the beginning and
a lot more enthusiasm by the end. We’ve received lots of important comments from employees that we’re
continuing to sift through – things related to storage and workplace guidelines, which we will be circling back
with in this group and others to get ready for the big move.
• We are pivoting as we get into this construction phase to really lean into move preparedness. We will be
ramping up changed communications, leaning on our change ambassadors as well as groups that have been
working to help establish workplace guidelines, and the many layers of things that need to be worked on to get
us ready for our move in date.
• Many agencies are working with Maren and our records team to try and digitize items; we are here if we can
lend support in any areas – Maren is a great resource and also Wendy Hopkins. She is the employee we hired
this summer to help with this project – another great contact to reach out to. A shift toward the start line, 12 -14
months to get ready for move in.
Privacy Program and Smart Gov Fund Update – Tony Jolley (stepping in for Aaron Moyes) – Informational
• There are 8 projects that are in flight and seem to be going well: AI tax valuation and streamlining SOPS are
closing.
• Two new ideas: tool lending library and IT service desk AI bot. We’ve discussed those and we’re getting feedback
on those now.
Motion to adjourn

Page 5 of 19

2027 ADA Web Compliance
Page 6 of 19

Compliance is not optional

• Applies to all digital content, websites, applications, and electronic
documents (like PDFs, Word files, and spreadsheets) provided or
managed by public entities

• From the federal government
• Non-compliance will result in fines

Page 7 of 19

Why?
• To ensure that web content and applications are accessible to people
with disabilities
• Must be inclusive for all disabilities
• Once deadline hits, everyone must be in compliance

Page 8 of 19

When?
• All digital content must be compliant before the deadline
• All public-facing PDFs on your website MUST be reviewed for
compliance, confirmed, or modified to be accessible

• Internal Target Date is February 26, 2027
• Final Federal deadline is April 26, 2027

Page 9 of 19

How?
• The web team will assist with identifying issues in digital content
• The web team will help you generate a list of PDF content
• Your team will review and determine which content must remain in PDF
form

• IT will assist with identification and remediation on PDFs that have been
deemed critical
Page 10 of 19

Next Steps
• Meetings with your designated POC
• Need extra help? Let us know

Page 11 of 19

Salt Lake County Human Resources Policy 4-300
Post-Retirement Insurance

Section II.F.5 — Proposed Amendment
5. Retirees over age 65 who retire on or before December 31, 2026
a. A retiree or spouse over the age of 65 may enroll in the Medicare Supplement insurance
plan within 60 days of eligibility.
b. If the Medicare Supplement plan is discontinued, the county will not make any further
contribution towards the retiree’s insurance premium.

6. Employees who retire after December 31, 2026
a. A retiree or spouse over the age of 65 may enroll in the Medicare Supplement insurance
plan consistent with applicable federal eligibility requirements and enrollment
procedures. The county will contribute to the Medicare Supplement insurance plan
premiums consistent with applicable law and the provisions of this section.
b. A retiree may elect to postpone or to discontinue participating in the Medicare
Supplement insurance plan without jeopardizing eligibility for the county’s contribution.
No county contribution will occur whenever coverage is not in effect; however, eligibility for
the county’s contribution will not end. The county’s contribution will commence
whenever coverage in the Medicare Supplement insurance plan begins.

Page 12 of 19

Privacy Program Update for ECC

Oct. 2026

Recent progress and near-term focus

1 RECENTLY COMPLETED

Privacy Notice training
delivered

Data Coordinator notice training
completed and posted on SharePoint.
Templates are ready for agency use.

2 NOW UNDERWAY

Agency implementation
support

3 COMING NEXT

Annual reporting cycle

Starting individual agency follow-up
meetings.

Annual Privacy Program Report training
targeted for early October.

Helping agencies identify purposes,
sharing classes, consequences, and
record series.

Agency input form, activity-detail form,
and tracker are being finalized.

SharePoint resources and the Data
Privacy Resource Guide support
consistent answers.

Inputs will support the County report
package for CAO review and the Dec. 31
deadline.

ECC support requested: reinforce timely Data Coordinator participation and agency-owner support for
privacy notices and annual report inputs.

Sources: SLCo Policy CW-2022 §§ 5, 7, 13; Utah Code § 63A-19-401.3; SLCo Annual Reporting Plan

Page
1 13 of 19

2022

SALT LAKE COUNTY
COUNTY-WIDE POLICY
ON
PERSONAL DATA PRIVACY
Purpose
To ensure that County Aagencies collect and process personal data in a manner consistent, with the Utah’s
Government Data Privacy Act; Utah Code §§ 63A-19-101 et seq. ("GDPA").
Reference
The Policy and Sstandards set forth herein are provided in accordance with the Utah Government Data Privacy
Act; Utah Code §§ 63A-19-101 et seqGDPA. Also referencing referenced are the following:
Salt Lake County Ordinance Chapter 2.98 - Information Technology Advisory Board
Salt Lake County Policy 2010 Public Records Access GRAMA
Salt Lake County Policy 2020 Records and Information Management
Countywide Information Technology Standard on Cyber Security Incident Reporting and Response
Salt Lake County Standards on Personal Data Privacy. (to be created)
Utah Code § 63A-19-101 et seq. GDPA
1

Scope

Commented [AB1]: We just abbreviated it
above.

Commented [AB2]: I don't think we need to rereference -- it is referenced in this section
opening.

This Policy applies to all Salt Lake County Aagencies, employees, and contractors that collect, process, or
share personal data.
2

Definitions

Some statutory terms are defined here for ease of reference. These and other relevant terms are also defined in
the GDPA, Utah Code Title 63A Chapter 19, and the Government Records Access and Management Act
("GRAMA"), Utah Code Title 63G Chapter 2. Clarification may also be offered in Sstandards developed by the
Chief Administrative Officer.
High-risk processing activities means a governmental entity’s processing of personal data that may
have a significant impact on an individual's privacy interests, based on factors that include: (1) the
sensitivity of the personal data processed; (2) the amount of personal data being processed; (3) the
individual's ability to consent to the processing of personal data; and (4) risks of unauthorized access
or use. "High-risk processing activities" may include the use of: (a) facial recognition technology; (b)
automated decision making; (c) profiling; (d) genetic data of a living person; (e) biometric data; or (f)
specific geolocation data as defined in Utah Code § 13-61-1(33).
Information Technology Resource(s) ("Resource") and/or Information Technology System
("System") means computers, hardware, software, data, storage media, electronic communications
(including, but not limited to, e-mail, fax, phones, phone systems, and voice mail); networks,
operational procedures, and processes used in the collection, processing, storage, sharing, or
distribution of information within, or with any access beyond ordinary public access to, the County's
shared computing and network infrastructure.
Personal Data means information that is linked or can be reasonably linked to an identified individual
or an identifiable individual.
Potential Security Incident means an observed event that could potentially compromise the
confidentiality, integrity, or availability of the County's Information Technology Resources
("System(s)"). This includes but is not limited to: unusual system behavior, unauthorized access
attempts, phishing emails, malware infections, or any activity that deviates from normal operations and
may indicate a security threat or breach such as: a missing or stolen County-owned device; an email to

Commented [AB3]: Isn't that the same as a
phishing email, included already?

Page 14 of 19

a County-email address asking for sensitive information; unusual pop-ups or downloads you didn't
authorize on your County-owned device; or anything that seems unusual on a County-owned device,
Information Technology Resource or System.
Process, Processing, or Processing Activity means any operation or set of operations performed on
personal data, including collection, recording, organization, structuring, storage, adaptation, alteration,
access, retrieval, consultation, use, disclosure by transmission, transfer, dissemination, alignment,
combination, restriction, erasure, or destruction.
Share or Sharing means providing, disclosing, transmitting, or transferring non publicnon-public
personal data to another person or entity. Sharing must be authorized by applicable law, including
GRAMA where applicable. as allowed under GRAMA, Utah Code § 63G-2-206 titled "Sharing
Records."
3

Policy Statement
3.1 Salt Lake County recognizes that individuals who provide their personal data to the County have a
fundamental interest in, and a reasonable expectation of, privacy regarding that information.
3.2 Accordingly, the Council delegates authority to the Office of Data & Innovation to establish, maintain,
and publish standards consistent with this Policy to provide implementation guidance to agencies to
implement this Policy.
3.3 All standards established under this Policy shall be reviewed by the Technology Advisory Board, which
must recommend adoption of the standard before it becomes effective.
3.4 All standards established under this Policy will apply to all individuals who fall within the scope of this
Policy.

4 Designation of County's Privacy Program Chief Administrative Officer, Data Coordinators, and
Data Custodians
4.1 The Office of Data & Innovation Director is designated as the County's Privacy Program Chief
Administrative Officer to fulfill the responsibilities set out in Utah Code § 63A-12-103. assigned to that
role under the GDPA.
4.2 Each aAgency shall designate one or more agency-wide data coordinator(s). Agencies shall document in
writing the name of their designated data coordinator(s) and notify the Chief Administrative Officer of
the individual designated individual(s). The aAgency Ddata Ccoordinator(s) shall guide their agency's
implementation of countywide privacy policies and data governance standards required under the GDPA
and as described in the Data Privacy Standards.
4.3 Each aAgency shall designate at least one dData Ccustodian for each system the Aagency uses to ensure
technical management and safeguarding of data. Agencies shall document in writing the name(s) of their
designated data custodians and notify the Chief Administrative Officer of the individuals designated.
Agency data custodians shall implement system technical safeguards to comply with GDPA and as
required in the Data Privacy Standards.
5

Privacy Notices – Personal Data Privacy Notice
5.1 Agencies shall provide a privacy notice to individuals from whom they request or collect personal data
as outlined below.

Commented [AM4]: @Javaid Lal @Anneliese
Booher Thoughts?

Commented [AB5]: We capitalize these titles
sometimes, sometimes not. We also capitalize
Agency and Standard sometimes, sometimes not.
Usually, with cases or courts or party, we
capitalize when referring to a specific case or
court or party. Do you want me to go through and
adopt a specific capitalization? I made some
changes, but not everywhere.

5.2 If personal data is requested or collected from a minor or an individual with a legal guardian, the
aAgency shall provide the notice to the legal guardian.
5.3 Public Record. If the Aagency is requesting or collecting personal data that would be classified as a
public record under GRAMA, Utah Code § 63G-2-301, the privacy notice may shall be limited to a
statement indicating that the individual's personal data may be available to the public as permitted by
GRAMA, Utah Code § 63G-2-201.

Page 15 of 19

5.4 Non-public Record. If the Aagency is requesting or collecting personal data that would not be classified
as a public record under GRAMA, Utah Code § 63G-2-301, the privacy notice shall describe:
5.4.1 aAll intended purposes and uses of the personal data;
5.4.2 tThe consequences for refusing to provide the personal data;
5.4.3 tThe classes of persons and governmental entities: (a) with whom the aAgency shares personal
data; or (b) to whom the aAgency sells personal data; and
5.4.4 tThe record series in which the personal data is included.
5.5 The Aagency shall provide the privacy notice in a manner that individuals providing their personal data
are most likely to be aware of the notice. Agencies can consider providing this privacy notice by:
5.5.1 Posting it in a prominent place where the agency collects the data;
5.5.2 Including the notice as part of any document or form used by the agency to collect the personal
data; or
5.5.3 Including the notice as part ofin any document or form used by the agency to collect personal data,
a conspicuous link or QR code that links to an electronic version of the privacy notice.
5.6 Public Safety Data Notice. When processing personal data to provide emergency services; law
enforcement; security cameral monitoring; ambulance and emergency medical services; or 911
emergency communication that serves a public safety interest and produces a public benefit that is
greater than or equal to An aAgency may satisfy the potential impact on an individual's privacy interest
that the notice protects, the Agency shall satisfy its obligations to provide a personal data privacy notice
requirement for qualifying public-safety processing activities by posting it on their website.using the
alternate notice method authorized by Utah Code § 63A-19-402(5).
5.7 Website Privacy Notice. The Information Technology DivisionChief Administrative Officer, or
designee, shall ensure that Salt Lake County government websites prominently providepost a website
privacy notice on the County homepage in complianceaccordance with Utah Code § 63A-19-402.5. Any
County AgencyAgencies that operates a separate government website under a domain name that is
different than outside the County's primaryofficial domain shall coordinate with the Chief Administrative
Officer or designee to ensure the applicable prominently display a website privacy notice requirements
are met. A County government website may not collect user data unless the applicable requirements of
the GDPA, Utah Code § 63A-19-402.5, have been satisfied. on the homepage of that site.
6

Commented [AB6]: I like the changes.

Minimum Reasonable Personal Data Collection
6.1 Agencies may only request and process the minimum amount of personal data from individuals that is
reasonably necessary to efficiently achieve the purpose for which it is requested.
6.2 Agencies shall regularly review their data collection practices to ensure compliance with the data
minimization requirement.
6.3 Agencies may only use personal data furnished by an individual for the purposes identified in the
privacy notice provided to that individual.

7

Privacy Training.
7.1 AgenciesAll County employees shall ensure that employees who have access to personal data as part of
their work duties or who supervise an employee who has access to personal data complete the data
privacy training that meets the requirements of Utah Code § 63A-19-401.2 offered by the Utah Office of
Data Privacy within 30 days afterafter commencement of beginning employment and at least once each
calendar year thereafter. The County may provide its own data privacy training that satisfies these
statutory requirements or use training provided by the Utah Office of Data Privacy.

Page 16 of 19

7.2 In addition to the general privacy awareness training, the Office of Data and Innovation and Information
Technology Division may create and require employees to complete aAgency-specific privacy training
tailored to the unique privacy needs, practices, and requirements of the Aagency.
7.3 The Agency Ddata Coordinator is responsible for monitoring Ccoordinators shall monitor and reporting
thesupport completion of required data privacy training within their agencies in accordance with
procedures established by the employees.Chief Administrative Officer.
8

Privacy Impact Assessments
8.1 Agencies shall complete the County's privacy review impact assessment process before developing or
procuring new technology that processes personal data or initiating a new or materially changed
personal data processing activity.
8.2 piaThe assessment shall identify and evaluate material privacy impacts associated with the proposed
processing of personal data and appropriate measures to reduce or manage identified privacy risks.

Commented [AB7]: should we use the
terminology introduced in the heading?
Commented [AB8R7]: Or is a review a broader
notion than a PIA?

8.3 Agencies shall provide information reasonably necessary to complete the privacy review assessment
and shall address applicable privacy requirements and mitigation measures identified through the review
assessment before implementation.
8.4 The Chief Administrative Officer may establish and maintain standards, forms, procedures, assessment
criteria, and tiered review processes for Pprivacy Iimpact Aassessments, including criteria for
determining when a preliminary (rapid) assessment or Ffull Privacy Impact Aassessment is required.
8.5 Privacy iImpact Aassessments evaluate GDPA compliance privacy impacts and do not replace any
required review, determination, or approval by Legal, Records, Information Technology or Security,
Procurement, the data owner, or another responsible County function.

Commented [AB9]: Not married to this
change...change back if too narrow or wording is
deficient.

98 Inventorying and Mapping Personal Data Processing Activities.
98.1 For processing activities implemented before May 7, 2025, on or before July 1, 2027, aAgencies shall:
98.1.1 Maintain an inventory of all systems used to process personal data.
98.1.2 Maintain an inventory of all records and record series that contain personal data.
98.1.3 Identify the types of data included in the records and records series (i.e. public, private, protected,
controlled).
98.1.4 Map how the aAgency processes personal data collectedthey collect from individuals.
98.1.5 Identify whether any processing activities are inconsistent with Section 6.0 of this Policy.
98.1.6 Prepare a strategy for bringing non-compliant processing activities into compliance with the
GDPA on or before July 1, 2027.
98.1.7 Agencies shall ensure that all personal data processing activities implemented after May 7, 2025,
are subject to the requirements of Sections 9.1.1 through 9.1.6Section 8.1.1 – 8.1.6 upon
implementation.
910 Prohibited Personal Data Processing Activities.
109.1 Unless granted an extension of time to comply or an exemption from compliance from the Utah
Office of Data Privacy, Aagencies may not:
910.1.1 Establish, maintain, or use undisclosed or covert surveillance of individuals unless permitted by
law;
910.1.2 Sell personal data unless expressly required by law; and

Page 17 of 19

109.1.3 Share personal data unless permitted by law.
109.1.4 Agencies must follow GRAMA's Rrecord Ssharing provision when sharing personal data. This
provision is located found at Utah Code § 63G-2-206.
1110

Requirements for Contractors

1011.1 After July 1, 20262027, a contract entered into or renewed with a contractor that processes or has
access to personal data as part of the contractor's duties shall contain specific language that requires the
contractor to comply with the requirements of Utah Code § 63A-19-401.4.
1011.2 Contractors are not required to comply with the data privacy training program requirements
described in the Utah Code § 63A-19-401.2.
1211

Amendment or Correction of Personal Data.

12.1 Agencies that collect personal data shall implement a procedure allowing individuals, or their legal
guardians, to request the amendment or correction of personal data, in accordance with applicable laws
and regulations.
1312

Personal Data Security Incident Reporting and Data Breach Notifications.

1213.1 Agencies shall adoptpromptly report and respond to suspected or confirmed cybersecurity incidents,
privacy incidents, and data breaches in accordance with follow the Countywide Information Technology
Standard on Cyber sSecurity Incident Reporting and Response to manage and address all security
incidents, including data breaches, and privacy violations.
1213.2 In the event of a data breach, AgenciesThe County shall coordinate with Information Technology
Cyber Security Incident Response Team (CSIRT)required cybersecurity incident and to issue data
breach noticesreporting to affected individuals in accordance with Utah Code § 63A-19-406.The Utah
Cyber Center, the Utah Office of the Attorney General, and other required recipients in accordance with
applicable law and County incident-response procedures.
13.3 The Office of Data & Innovation shall coordinate with the Cybersecurity Incident Response Team,
Legal, affected aAgencies, and other appropriate County functions regarding applicable GDPA privacy
requirements, privacy documentation, and required notifications.
13.4 If required, the County shall provide notice to individuals affected by a data breach when required by
Utah Code § 63A-19-406 and other applicable law.
1314

Privacy Program Report:

1314.1 On or before October 31, 2025, and annually on that day thereafter, AgenciesDecember 1 of each
year, each agency shall provide a report to the Office of Data & Innovation with a report including the
following information:information required under this section, in the form and manner established by the
Chief Administrative Officer, for inclusion in the County’s annual privacy program report.
1314.2 Each Aagency Sshall Pprovide, as applicable:
14.2.1 A description of how the aAgency has implemented and supports the County’s privacy
program, including the Aagency’s privacy practices;
14.2.2 A description of any privacy practices implemented by the Aagency’s and strategies for improving
the Agency'sand maturing its privacy practices;
1413.2.31 A description of the Aagency's high-risk processing activities;
1314.2.42 A list of the types of personal data the Aagency currently shares, sells, or purchases;
1314.2.53 The legal basis for each activity involving the sharing, selling, or purchasing personal data;

Page 18 of 19

1314.2.63 The categoriesy of individuals or entities:
13 14.23.6.11 wWith whom the aAgency shares personal data;
13 14.23.62.2 tTo whom the aAgency sells personal data; or
13 14.23.36.3 fFrom whom the Aagency purchases personal data;
1314.2.74 The percentage of Aathe agency employees who have thatcompleted data privacy training.
have completed the required privacy training described in this policy;
1314.2.85 A description of any non-compliant processing activities identified under Section 5.0 of this
Policy and identified pursuant to Utah Code § 63A-19-401(2)(a)(iv), together with the aaAgency's
strategy for bringing those activities into compliance with this Policy.
14.3 The Chief Administrative Officer shall prepare the County's annual privacy program report using the
information provided by Aagencies and other Countywide privacy program information. The report shall
include the information required by Utah Code § 63A-19-401.3 and shall be shared with the Utah Office
of Data Privacy on or before December 31 of each year in accordance with Utah Code § 63G-2-206.
14.4 The County's annual privacy program report shall be considered a protected record under Utah Code §
63G-2-305.
14.5 The County shall retain each annual privacy program report for no less than five years.
1415

Periodic Review

1415.1 This policy will be reviewed periodically and updated to ensure ongoing compliance with applicable
laws and regulations.
APPROVED and PASSED this _____ day of ____________, 2026.

SALT LAKE COUNTY COUNCIL
____________________________________
Chair

ATTEST:
____________________________________
Lannie Chapman
Salt Lake County Clerk
Reviewed & Advised as to Form & Legality:
By: ________________________________
Anneliese Booher
Deputy District Attorney
Date: ________________________

Page 19 of 19