H.B. 100

This document includes House Committee Amendments incorporated into the bill on Tue, Feb 12, 2013 at 10:53 AM by lerror. --> 1

INTERNET PRIVACY AMENDMENTS
2 2013 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Stewart Barlow
5 Senate Sponsor: J. Stuart Adams
6
7 LONG TITLE
8 General Description:
9 This bill modifies provisions addressing labor in general and higher education to enact
10 protections for personal Internet accounts.
11 Highlighted Provisions:
12 This bill:
13 . enacts the Internet Employment Privacy Act, including:
14 . defining terms;
15 . prohibiting certain actions by an employer;
16 . permitting certain actions by an employer;
17 . providing that the chapter does not create certain duties; and
18 . providing private right of action; and
19 . enacts the Internet Postsecondary Education Privacy Act, including:
20 . defining terms;
21 . prohibiting certain actions by a postsecondary institution;
22 . permitting certain actions by a postsecondary institution;
23 . providing that the chapter does not create certain duties; and
24 . providing for private right of action.
25 Money Appropriated in this Bill:
26 None
27 Other Special Clauses:

28 None
29 Utah Code Sections Affected:
30 ENACTS:
31 34-48-101, Utah Code Annotated 1953
32 34-48-102, Utah Code Annotated 1953
33 34-48-201, Utah Code Annotated 1953
34 34-48-202, Utah Code Annotated 1953
35 34-48-203, Utah Code Annotated 1953
36 34-48-301, Utah Code Annotated 1953
37 53B-24-101, Utah Code Annotated 1953
38 53B-24-102, Utah Code Annotated 1953
39 53B-24-201, Utah Code Annotated 1953
40 53B-24-202, Utah Code Annotated 1953
41 53B-24-203, Utah Code Annotated 1953
42 53B-24-301, Utah Code Annotated 1953
43
44 Be it enacted by the Legislature of the state of Utah:
45 Section 1. Section 34-48-101 is enacted to read:
46 CHAPTER 48. INTERNET EMPLOYMENT PRIVACY ACT
47 Part 1. General Provisions
48 34-48-101. Title.
49 This chapter is known as the "Internet Employment Privacy Act."
50 Section 2. Section 34-48-102 is enacted to read:
51 34-48-102. Definitions.
52 As used in this chapter:
53 (1) "Access information" means a user name, password, login information, or other
54 security information that protects access to a personal Internet account.
55 (2) "Employer" means a person, including the state or a political subdivision of the
56 state, that has one or more workers or operators employed in the same business, or in or about
57 the same establishment, under any contract of hire, express or implied, oral or written.
58 (3) "Personal Internet account" means an account created by way of a bounded system

59 established by an Internet-based service that requires a user to input or store access information
60 by way of an electronic device to view, create, use, or edit the user's account information,
61 profile, display, communications, or stored data.
62 Section 3. Section 34-48-201 is enacted to read:
63 Part 2. Prohibited and Permitted Activities
64 34-48-201. Employer may not request access to personal Internet account.
65 An employer may not do any of the following:
66 (1) request an employee or an applicant for employment to grant access to, allow
67 observation of, or disclose information that allows access to or observation of the employee's or
68 applicant's personal Internet account; or
69 (2) discharge, discipline, fail to hire, or otherwise penalize an employee or applicant
70 for employment for failure to grant access to, allow observation of, or disclose information that
71 allows access to or observation of the employee's or applicant's personal Internet account.
72 Section 4. Section 34-48-202 is enacted to read:
73 34-48-202. Permitted actions by an employer.
74 (1) This chapter does not prohibit an employer from doing any of the following:
75 (a) requesting or requiring an employee to disclose access information to the employer
76 to gain access to or operate any of the following:
77 (i) an electronic communications device paid for in whole or in part by the employer;
78 or
79 (ii) an account or service provided by the employer, obtained by virtue of the
80 employee's employment relationship with the employer, or used for the employer's business
81 purposes;
82 (b) disciplining or discharging an employee for transferring the employer's proprietary
83 or confidential information or financial data to an employee's personal Internet account
83a H. [ with ] without .H
84 the employer's authorization;
85 (c) conducting an investigation or requiring an employee to cooperate in an
86 investigation in any of the following:
87 (i) if there is specific information about activity on the employee's personal Internet
88 account, for the purpose of ensuring compliance with applicable laws, regulatory requirements,
89 or prohibitions against work-related employee misconduct; or

90 (ii) if the employer has specific information about an unauthorized transfer of the
91 employer's proprietary information, confidential information, or financial data to an employee's
92 personal Internet account;
93 (d) restricting or prohibiting an employee's access to certain websites while using an
94 electronic communications device paid for in whole or in part by the employer or while using
95 an employer's network or resources, in accordance with state and federal law; or
96 (e) monitoring, reviewing, or accessing electronic data stored on an electronic
97 communications device paid for in whole or in part by the employer, or traveling through or
98 stored on an employer's network, in accordance with state and federal law.
99 (2) This chapter does not prohibit or restrict an employer from complying with a duty
100 to screen employees or applicants before hiring or to monitor or retain employee
101 communications that is established under federal law or by a self-regulatory organization under
102 the Securities and Exchange Act of 1934, 15 U.S.C. Sec. 78c(a)(26).
103 (3) This chapter does not prohibit or restrict an employer from viewing, accessing, or
104 using information about an employee or applicant that can be obtained without any required
105 access information or that is available in the public domain.
106 Section 5. Section 34-48-203 is enacted to read:
107 34-48-203. Chapter does not create duties.
108 (1) This chapter does not create a duty for an employer to search or monitor the activity
109 of a personal Internet account.
110 (2) An employer is not liable under this chapter for failure to request or require that an
111 employee or applicant for employment grant access to, allow observation of, or disclose
112 information that allows access to or observation of the employee's or applicant for
113 employment's personal Internet account.
114 Section 6. Section 34-48-301 is enacted to read:
115 Part 3. Remedy
116 34-48-301. Private right of action.
117 (1) A person aggrieved by a violation of this chapter may bring a civil cause of action
118 against an employer in a court of competent jurisdiction.
119 (2) In an action brought under Subsection (1), if the court finds a violation of this
120 chapter, the court shall award the aggrieved person H. not more than .H $500.

121 Section 7. Section 53B-24-101 is enacted to read:
122 CHAPTER 24. INTERNET POSTSECONDARY INSTITUTION PRIVACY ACT
123 Part 1. General Provisions
124 53B-24-101. Title.
125 This chapter is known as the "Internet Postsecondary Institution Privacy Act."
126 Section 8. Section 53B-24-102 is enacted to read:
127 53B-24-102. Definitions.
128 As used in this chapter:
129 (1) "Access information" means a user name, password, login information, or other
130 security information that protects access to a personal Internet account.
131 (2) "Personal Internet account" means an account created by way of a bounded system
132 established by an Internet-based service that requires a user to input or store access information
133 by way of an electronic device to view, create, use, or edit the user's account information,
134 profile, display, communications, or stored data.
135 (3) "Postsecondary institution" means an institution that provides educational services
136 offered primarily to persons who have completed or terminated their secondary or high school
137 education or who are beyond the age of compulsory school attendance.
138 Section 9. Section 53B-24-201 is enacted to read:
139 Part 2. Prohibited and Permitted Activities
140 53B-24-201. Prohibited activities.
141 A postsecondary institution may not do any of the following:
142 (1) request a student or prospective student to grant access to, allow observation of, or
143 disclose information that allows access to or observation of the student's or prospective
144 student's personal Internet account; or
145 (2) expel, discipline, fail to admit, or otherwise penalize a student or prospective
146 student for failure to grant access to, allow observation of, or disclose information that allows
147 access to or observation of the student's or prospective student's personal Internet account.
148 Section 10. Section 53B-24-202 is enacted to read:
149 53B-24-202. Permitted activities.
150 (1) This chapter does not prohibit a postsecondary institution from requesting or
151 requiring a student to disclose access information to the postsecondary institution to gain

152 access to or operate the following:
153 (a) an electronic communications device paid for in whole or in part by the
154 postsecondary institution; or
155 (b) an account or service provided by the postsecondary institution that is either
156 obtained by virtue of the student's admission to the postsecondary institution or used by the
157 student for educational purposes.
158 (2) This chapter does not prohibit or restrict a postsecondary institution from viewing,
159 accessing, or using information about a student or prospective student that can be obtained
160 without required access information or that is available in the public domain.
161 Section 11. Section 53B-24-203 is enacted to read:
162 53B-24-203. Duties not created.
163 (1) This chapter does not create a duty for a postsecondary institution to search or
164 monitor the activity of a personal Internet account.
165 (2) A postsecondary institution is not liable under this chapter for failure to request or
166 require that a student or prospective student grant access to, allow observation of, or disclose
167 information that allows access to or observation of the student's or prospective student's
168 personal Internet account.
169 Section 12. Section 53B-24-301 is enacted to read:
170 Part 3. Remedy
171 53B-24-301. Private right of action.
172 (1) A person aggrieved by a violation of this chapter may bring a civil cause of action
173 against a postsecondary institution in a court of competent jurisdiction.
174 (2) In an action brought under Subsection (1), if the court finds a violation of this
175 chapter, the court shall award the aggrieved person H. not more than .H $500.




Legislative Review Note
as of 1-30-13 5:13 PM

Office of Legislative Research and General Counsel

[Bill Documents]