H.B. 70

1

SALE OF CONSUMERS PERSONAL
2 INFORMATION
3 2000 GENERAL SESSION
4 STATE OF UTAH
5 Sponsor: Evan L. Olsen
6 AN ACT RELATING TO CONSUMER PROTECTION; LIMITING THE SALE OF PERSONAL
7 INFORMATION CONCERNING CONSUMERS TO THIRD PARTIES; REQUIRING NOTICE
8 TO CONSUMERS; PROVIDING FOR ENFORCEMENT BY THE DIVISION OF CONSUMER
9 PROTECTION; AND PROVIDING FOR PRIVATE RIGHTS OF ACTION.
10 This act affects sections of Utah Code Annotated 1953 as follows:
11 ENACTS:
12 13-33-101, Utah Code Annotated 1953
13 13-33-102, Utah Code Annotated 1953
14 13-33-103, Utah Code Annotated 1953
15 13-33-104, Utah Code Annotated 1953
16 13-33-105, Utah Code Annotated 1953
17 13-33-106, Utah Code Annotated 1953
18 Be it enacted by the Legislature of the state of Utah:
19 Section 1. Section 13-33-101 is enacted to read:
20 CHAPTER 33. PERSONAL INFORMATION PRIVACY ACT
21 13-33-101. Title.
22 This chapter is known as the "Personal Information Privacy Act."
23 Section 2. Section 13-33-102 is enacted to read:
24 13-33-102. Definitions.
25 As used in this chapter:
26 (1) "Division" means the Division of Consumer Protection.
27 (2) "Merchant" means any person or entity engaged in the sale or rental of goods or

28 services in this state.
29 (3) "Reasonable notice" means the posting of a sign in a conspicuous location or any other
30 reasonable method as defined by rule by the division in accordance with Title 63, Chapter 46a,
31 Utah Administrative Rulemaking Act.
32 Section 3. Section 13-33-103 is enacted to read:
33 13-33-103. Sale of customer information -- Limitations -- Notice.
34 A merchant shall not sell to any third person any information concerning a customer:
35 (1) that is gathered in connection with the sale, rental, or exchange of goods or services
36 to the customer without first giving reasonable notice to the customer;
37 (2) if the customer requests that the merchant not sell the information; or
38 (3) gathered solely as the result of any customer payment by personal check, credit card,
39 or where the merchant records the customer's driver's license number.
40 Section 4. Section 13-33-104 is enacted to read:
41 13-33-104. Exceptions.
42 The provisions of this chapter shall not apply to:
43 (1) information exchanged or transferred by the merchant, in the regular course of
44 business, for purposes of extending credit;
45 (2) the sale of information concerning a check or credit card transaction when it is
46 incidental to the sale or other disposition of accounts receivable;
47 (3) the transmission of information by a merchant relating to the check writing activity of
48 its customers in conjunction with check validation transactions; or
49 (4) information sold in connection with any sale of a business's retail operations at one or
50 more locations, provided that the information is sold only to the purchasers of the business.
51 Section 5. Section 13-33-105 is enacted to read:
52 13-33-105. Enforcement -- Penalties.
53 (1) The division shall investigate and assess administrative fines for violations of this
54 chapter.
55 (2) Any person who violates this chapter is subject to:
56 (a) an administrative cease and desist order; and
57 (b) an administrative fine of not less than $100 or more than $2,000 for each separate
58 violation of this chapter.

59 (3) All administrative fines collected under this chapter shall be deposited in the Consumer
60 Protection Education and Training Fund created in Section 13-2-8 .
61 (4) (a) Upon referral from the division, the attorney general or any district or county
62 attorney may:
63 (i) bring an action for temporary or permanent injunctive or other relief in any court of
64 competent jurisdiction for any violation of this chapter; or
65 (ii) bring an action in any court of competent jurisdiction for the collection of penalties
66 authorized under Subsection (2).
67 (b) The court may, upon entry of final judgment in an action brought under Subsection
68 (4)(a), award restitution when appropriate to any person suffering loss because of a violation of
69 this chapter if proof of loss is submitted to the satisfaction of the court.
70 Section 6. Section 13-33-106 is enacted to read:
71 13-33-106. Private right of action.
72 (1) In addition to any other remedies, a person whose personal information has been sold
73 in violation of this chapter may bring an action in any court of competent jurisdiction to recover
74 the greater of $250 or the amount of actual damages, if any.
75 (2) A person who brings a successful action against a merchant who has violated this
76 chapter shall be entitled to recover court costs and reasonable attorney's fees as determined by the
77 court.

Legislative Review Note
as of 1-12-00 2:04 PM

This legislation raises the following constitutional or statutory concerns:

This bill could be challenged as violating the free speech provisions of the First Amendment of
the United States Constitution and the comparable provisions of Utah's Constitution. The United
States Court of Appeals for the Tenth Circuit recently invalidated, on first amendment grounds,
federal regulations which required telecommunications carriers to receive affirmative approval
from customers before selling or disclosing certain customer information. See, U.S. West, Inc. v.
Federal Communications Commission, 182 F.3d 1224 (1999). Although this legislation is
distinguishable from the federal regulations invalidated in U.S. West, Inc. v. FCC by the
requirement that customers inform the merchant that they do not wish to have their information
resold, it is possible that this legislation may still be challenged on first amendment free speech
grounds.

Office of Legislative Research and General Counsel