If a holder is required to include confidential information in a report to the administrator, the information shall be provided by a secure means.
Terms Used In Utah Code 67-4a-1406
Administrator: means the deputy state treasurer assigned by the state treasurer. See Utah Code 67-4a-102
Confidential information: means records, reports, and information that is confidential under Section 67-4a-1402. See Utah Code 67-4a-102
Contract: A legal written agreement that becomes binding when signed.
Holder: means a person obligated to hold for the account of, or to deliver or pay to, the owner property subject to this chapter. See Utah Code 67-4a-102
Record: means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form. See Utah Code 67-4a-102
Security: means :
(a)
a security as defined in Revised Article 8 of the Uniform Commercial Code; or
(b)
a security entitlement as defined in Revised Article 8 of the Uniform Commercial Code, including a customer security account held by a registered broker-dealer, to the extent the financial assets held in the security account are not:
(i)
registered on the books of the issuer in the name of the person for which the broker-dealer holds the assets;
(ii)
payable to the order of the person;
(iii)
specifically endorsed to the person; or
(iv)
an equity interest in a business association not included in this Subsection (32). See Utah Code 67-4a-102
(2)
If confidential information in a record is provided to and maintained by the administrator or the administrator’s agent as required by this chapter, the administrator or the administrator’s agent shall:
(a)
implement administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of the information required by Section 13-44-202 and federal privacy and data security law regardless of whether the administrator or the administrator’s agent is subject to the law;
(b)
protect against reasonably anticipated threats or hazards to the security, confidentiality, or integrity of the information; and
(c)
protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to a holder or the holder’s customers, including insureds, annuitants, and policy or contract owners and the insureds’, annuitants’, and policy or contract owners’ beneficiaries.
(3)
The administrator:
(a)
after notice and comment, shall adopt and implement a security plan that identifies and assesses reasonably foreseeable internal and external risks to confidential information in the administrator’s possession and seeks to mitigate the risks; and
(b)
shall ensure that an administrator’s agent adopts and implements a similar plan with respect to confidential information in the administrator’s agent’s possession.
(4)
The administrator and the administrator’s agent shall educate and train the administrator’s and the administrator’s agent’s employees regarding the plan adopted under Subsection (3).
(5)
The administrator and the administrator’s agent shall in a secure manner return or destroy all confidential information no longer reasonably needed under this chapter.
