State Chief Privacy Officers Can Have Real Power

July 22, 2026 - 21:28

When Utah created its Office of the Chief Privacy Officer, it did not just hang a new title on an existing bureaucrat. The state gave the position actual authority over data protection, and the man holding that job now has clear advice for other states looking to follow suit.

Ken Stalder, Utah's first chief privacy officer, says the key is not just writing privacy laws but building an office that can enforce them. In Utah, his team can investigate complaints, issue subpoenas, and work directly with the attorney general on enforcement actions. That is a far cry from many states where the privacy officer is a figurehead buried inside an IT department with no real power.

Stalder argues that states need to stop treating privacy as a technical issue and start treating it as a consumer protection issue. He points to the growing patchwork of state privacy laws across the country, from California to Virginia, and says the only way to make them work is to have someone in charge who can actually do something when a company breaks the rules.

His office has already handled hundreds of complaints from Utah residents about data misuse, and he says the mere existence of a strong privacy office has changed how companies operate in the state. Businesses know that if they ignore the law, someone will come knocking.

For other states, Stalder's message is simple: give the privacy officer a budget, a staff, and the legal authority to act. Without those things, the title is just window dressing.