Enrolled Copy H B 57 1 ELECTRONIC INFORMATION OR DATA PRIVACY 2 2019 GENERAL SESSION 3 STATE OF UTAH 4 Chief Sponsor Craig Hall 5 Senate Sponsor Todd Weiler 6 7 LONG TITLE 8 General Description 9 This bill modifies provisions related to privacy of electronic information or data 10 Highlighted Provisions 11 This bill 12 defines terms 13 requires issuance of a search warrant to obtain certain electronic information or 14 data 15 addresses notification that electronic information or data was obtained 16 provides for transmission of electronic information or data to a remote computing 17 18 19 20 21 22 23 24 25 26 service including restrictions on government entities provides that the individual who transmits electronic information or data is the presumed owner of the electronic information or data provides for the exclusion of electronic information or data obtained without a warrant and makes technical and conforming changes Money Appropriated in this Bill None Other Special Clauses None 27 Utah Code Sections Affected 28 AMENDS 29 77-23c-102 as last amended by Laws of Utah 2016 Chapter 161 H B 57 30 31 Enrolled Copy 77-23c-103 as enacted by Laws of Utah 2014 Chapter 223 ENACTS 32 77-23c-101 1 Utah Code Annotated 1953 33 77-23c-104 Utah Code Annotated 1953 34 77-23c-105 Utah Code Annotated 1953 35 36 37 RENUMBERS AND AMENDS 77-23c-101 2 Renumbered from 77-23c-101 as enacted by Laws of Utah 2014 Chapter 223 38 39 40 Be it enacted by the Legislature of the state of Utah Section 1 Section 77-23c-101 1 is enacted to read 41 CHAPTER 23c ELECTRONIC INFORMATION OR DATA PRIVACY ACT 42 77-23c-101 1 Title 43 This chapter is known as the Electronic Information or Data Privacy Act 44 Section 2 Section 77-23c-101 2 which is renumbered from Section 77-23c-101 is 45 renumbered and amended to read 46 77-23c-101 47 As used in this chapter 48 1 Electronic communication service means a service that provides to users of the 49 50 51 52 77-23c-101 2 Definitions service the ability to send or receive wire or electronic communications 2 Electronic device means a device that enables access to or use of an electronic communication service remote computing service or location information service 3 Government entity means the state a county a municipality a higher education 53 institution a local district a special service district or any other political subdivision of the 54 state or an administrative subunit of any political subdivision including a law enforcement 55 entity or any other investigative entity agency department division bureau board or 56 commission or an individual acting or purporting to act for or on behalf of a state or local 57 agency -2- Enrolled Copy 58 H B 57 3 a Electronic information or data means information or data including a sign 59 signal writing image sound or intelligence of any nature transmitted or stored in whole or in 60 part by a wire radio electromagnetic photoelectronic or photooptical system 61 62 b Electronic information or data includes the location information stored data or transmitted data of an electronic device 63 c Electronic information or data does not include 64 i a wire or oral communication 65 ii a communication made through a tone-only paging device or 66 iii electronic funds transfer information stored by a financial institution in a 67 68 communications system used for the electronic storage and transfer of money 4 Law enforcement agency means an entity of the state or a political subdivision of 69 the state that exists to primarily prevent detect or prosecute crime and enforce criminal 70 statutes or ordinances 71 4 5 Location information means information obtained by means of a tracking 72 device concerning the location of an electronic device that in whole or in part is generated or 73 derived from or obtained by the operation of an electronic device 74 75 5 6 Location information service means the provision of a global positioning service or other mapping location or directional information service 76 7 Oral communication means the same as that term is defined in Section 77-23a-3 77 6 8 Remote computing service means the provision to the public of computer 78 79 80 81 82 storage or processing services by means of an electronic communications system 9 Transmitted data means electronic information or data that is transmitted wirelessly a from an electronic device to another electronic device without the use of an intermediate connection or relay or 83 b from an electronic device to a nearby antenna 84 10 Wire communication means the same as that term is defined in Section 85 77-23a-3 -3- H B 57 Enrolled Copy 86 Section 3 Section 77-23c-102 is amended to read 87 77-23c-102 Electronic information or data privacy -- Warrant required for 88 89 disclosure 1 a Except as provided in Subsection 2 a government entity for a criminal 90 investigation or prosecution a law enforcement agency may not obtain without a search 91 warrant issued by a court upon probable cause 92 93 94 95 96 i the location information stored data or transmitted data of an electronic device without a search warrant issued by a court upon probable cause or ii electronic information or data transmitted by the owner of the electronic information or data to a remote computing service provider b Except as provided in Subsection 1 c a government entity law enforcement 97 agency may not use copy or disclose for any purpose the location information stored data 98 or transmitted data of an electronic device or electronic information or data provided by a 99 remote computing service provider that is not the subject of the warrant that is collected as 100 part of an effort to obtain the location information stored data or transmitted data of the 101 electronic device that is the subject of the warrant in Subsection 1 a 102 i is not the subject of the warrant and 103 ii is collected as part of an effort to obtain the location information stored data 104 transmitted data of an electronic device or electronic information or data provided by a remote 105 computing service provider that is the subject of the warrant in Subsection 1 a 106 c A government entity law enforcement agency may use copy or disclose the 107 transmitted data of an electronic device used to communicate with the electronic device that is 108 the subject of the warrant if the government entity law enforcement agency reasonably 109 believes that the transmitted data is necessary to achieve the objective of the warrant 110 d The electronic information or data described in Subsection 1 b shall be destroyed 111 in an unrecoverable manner by the government entity law enforcement agency as soon as 112 reasonably possible after the electronic information or data is collected 113 2 a A government entity law enforcement agency may obtain location information -4- Enrolled Copy 114 H B 57 without a warrant for an electronic device 115 i in accordance with Section 53-10-104 5 116 ii if the device is reported stolen by the owner 117 iii with the informed affirmative consent of the owner or user of the electronic 118 119 120 device iv in accordance with a judicially recognized exceptions exception to warrant requirements or 121 v if the owner has voluntarily and publicly disclosed the location information or 122 vi from the remote computing service provider if the remote computing service 123 124 provider voluntarily discloses the location information A under a belief that an emergency exists involving an imminent risk to an individual 125 of death serious physical injury sexual abuse live-streamed sexual exploitation kidnapping 126 or human trafficking or 127 B that is inadvertently discovered by the remote computing service provider and 128 appears to pertain to the commission of a felony or of a misdemeanor involving physical 129 violence sexual abuse or dishonesty 130 b A law enforcement agency may obtain stored or transmitted data from an electronic 131 device or electronic information or data transmitted by the owner of the electronic information 132 or data to a remote computing service provider without a warrant 133 134 i with the informed consent of the owner of the electronic device or electronic information or data 135 ii in accordance with a judicially recognized exception to warrant requirements 136 iii in connection with a report forwarded by the National Center for Missing and 137 138 Exploited Children under 18 U S C Sec 2258A or iv subject to Subsection 77-23c-102 2 a vi B from a remote computing service 139 provider if the remote computing service provider voluntarily discloses the stored or 140 transmitted data as otherwise permitted under 18 U S C Sec 2702 141 b c A prosecutor may obtain a judicial order as defined described in Section -5- H B 57 142 143 Enrolled Copy 77-22-2 5 for the purposes enumerated in Section 77-22-2 5 3 An electronic communication service provider its or remote computing service 144 provider the provider's officers employees agents or other specified persons may not be held 145 liable for providing information facilities or assistance in accordance with good faith 146 reliance on the terms of the warrant issued under this section or without a warrant pursuant to 147 in accordance with Subsection 2 148 4 a Notwithstanding Subsections 1 through 3 a government entity may receive 149 and utilize electronic data containing the location information of an electronic device from a 150 non-government entity as long as the electronic data contains no information that includes or 151 may reveal the identity of an individual 152 153 154 155 156 157 b Electronic data collected in accordance with this subsection may not be used for investigative purposes by a law enforcement agency 4 Nothing in this chapter limits or affects the disclosure of public records under Title 63G Chapter 2 Government Records Access and Management Act 5 Nothing in this chapter affects the rights of an employer under Subsection 34-48-202 1 e or an administrative rule adopted under Section 63F-1-206 158 Section 4 Section 77-23c-103 is amended to read 159 77-23c-103 Notification required -- Delayed notification 160 1 a Except as provided in Subsection 2 a government entity law enforcement 161 agency that executes a warrant pursuant to Subsection 77-23c-102 1 a or 77-23c-104 3 shall 162 within 14 days after the day on which the operation concludes electronic information or data 163 that is the subject of the warrant is obtained by the law enforcement agency issue a notification 164 to the owner of the electronic device or electronic information or data specified in the warrant 165 that states 166 a i that a warrant was applied for and granted 167 b ii the kind of warrant issued 168 c iii the period of time during which the collection of the electronic information or 169 data from the electronic device was authorized -6- Enrolled Copy H B 57 170 d iv the offense specified in the application for the warrant 171 e v the identity of the government entity law enforcement agency that filed the 172 application and 173 f vi the identity of the judge who issued the warrant 174 b The notification requirement under Subsection 1 a is not triggered until the 175 owner of the electronic device or electronic information or data specified in the warrant is 176 known or could be reasonably identified by the law enforcement agency 177 2 A government entity law enforcement agency seeking a warrant pursuant to 178 Subsection 77-23c-102 1 a or 77-23c-104 3 may submit a request and the court may grant 179 permission to delay the notification required by Subsection 1 for a period not to exceed 30 180 days if the court determines that there is probable reasonable cause to believe that the 181 notification may 182 a endanger the life or physical safety of an individual 183 b cause a person to flee from prosecution 184 c lead to the destruction of or tampering with evidence 185 d intimidate a potential witness or 186 e otherwise seriously jeopardize an investigation or unduly delay a trial 187 3 a When a delay of notification is granted under Subsection 2 and upon 188 application by the government entity law enforcement agency the court may grant additional 189 extensions of up to 30 days each 190 b Notwithstanding Subsection 3 a when a delay of notification is granted under 191 Subsection 2 and upon application by a law enforcement agency the court may grant an 192 additional extension of up to 60 days if the court determines that a delayed notification is 193 justified because the investigation involving the warrant 194 i is interstate in nature and sufficiently complex or 195 ii is likely to extend up to or beyond an additional 60 days 196 4 Upon expiration of the period of delayed notification granted under Subsection 2 197 or 3 the government entity law enforcement agency shall serve upon or deliver by -7- H B 57 Enrolled Copy 198 first-class mail or by other means if delivery is impracticable to the owner of the electronic 199 device or electronic information or data a copy of the warrant together with notice that 200 a states with reasonable specificity the nature of the law enforcement inquiry and 201 b contains 202 i the information described in Subsections 1 a i through f vi 203 ii a statement that notification of the search was delayed 204 iii the name of the court that authorized the delay of notification and 205 iv a reference to the provision of this chapter that allowed the delay of notification 206 5 A government entity law enforcement agency is not required to notify the owner 207 of the electronic device or electronic information or data if the owner is located outside of the 208 United States 209 Section 5 Section 77-23c-104 is enacted to read 210 77-23c-104 Third-party electronic information or data 211 1 As used in this section subscriber record means a record or information of a 212 provider of an electronic communication service or remote computing service that reveals the 213 subscriber's or customer's 214 a name 215 b address 216 c local and long distance telephone connection record or record of session time and 217 duration 218 d length of service including the start date 219 e type of service used 220 f telephone number instrument number or other subscriber or customer number or 221 222 223 224 225 identification including a temporarily assigned network address and g means and source of payment for the service including a credit card or bank account number 2 Except as provided in Chapter 22 Subpoena Powers for Aid of Criminal Investigation and Grants of Immunity a law enforcement agency may not obtain use copy or -8- Enrolled Copy 226 H B 57 disclose a subscriber record 227 3 A law enforcement agency may not obtain use copy or disclose for a criminal 228 investigation or prosecution any record or information other than a subscriber record of a 229 provider of an electronic communication service or remote computing service related to a 230 subscriber or customer without a warrant 231 4 Notwithstanding Subsections 2 and 3 a law enforcement agency may obtain 232 use copy or disclose a subscriber record or other record or information related to a subscriber 233 or customer without a warrant 234 a with the informed affirmed consent of the subscriber or customer 235 b in accordance with a judicially recognized exception to warrant requirements 236 c if the subscriber or customer voluntarily discloses the record in a manner that is 237 publicly accessible or 238 239 d if the provider of an electronic communication service or remote computing service voluntarily discloses the record 240 241 i under a belief that an emergency exists involving the imminent risk to an individual of 242 A death 243 B serious physical injury 244 C sexual abuse 245 D live-streamed sexual exploitation 246 E kidnapping or 247 F human trafficking 248 ii that is inadvertently discovered by the provider if the record appears to pertain to 249 the commission of 250 A a felony or 251 B a misdemeanor involving physical violence sexual abuse or dishonesty or 252 iii subject to Subsection 77-23c-104 4 d ii as otherwise permitted under 18 U S C 253 Sec 2702 -9- H B 57 Enrolled Copy 254 5 A provider of an electronic communication service or remote computing service or 255 the provider's officers employees agents or other specified persons may not be held liable for 256 providing information facilities or assistance in good faith reliance on the terms of a warrant 257 issued under this section or without a warrant in accordance with Subsection 3 258 Section 6 Section 77-23c-105 is enacted to read 259 77-23c-105 Exclusion of records 260 All electronic information or data and records of a provider of an electronic 261 communications service or remote computing service pertaining to a subscriber or customer 262 that are obtained in violation of the provisions of this chapter shall be subject to the rules 263 governing exclusion as if the records were obtained in violation of the Fourth Amendment to 264 the United States Constitution and Utah Constitution Article I Section 14 - 10 -