H.B. 100 Enrolled

1

INTERNET PRIVACY AMENDMENTS
2 2013 GENERAL SESSION
3 STATE OF UTAH
4 Chief Sponsor: Stewart Barlow
5 Senate Sponsor: J. Stuart Adams
6
7 LONG TITLE
8 General Description:
9 This bill modifies provisions addressing labor in general and higher education to enact
10 protections for personal Internet accounts.
11 Highlighted Provisions:
12 This bill:
13 . enacts the Internet Employment Privacy Act, including:
14 . defining terms;
15 . prohibiting certain actions by an employer;
16 . permitting certain actions by an employer;
17 . providing that the chapter does not create certain duties; and
18 . providing a private right of action; and
19 . enacts the Internet Postsecondary Education Privacy Act, including:
20 . defining terms;
21 . prohibiting certain actions by a postsecondary institution;
22 . permitting certain actions by a postsecondary institution;
23 . providing that the chapter does not create certain duties; and
24 . providing for a private right of action.
25 Money Appropriated in this Bill:
26 None
27 Other Special Clauses:
28 None
29 Utah Code Sections Affected:

30 ENACTS:
31 34-48-101, Utah Code Annotated 1953
32 34-48-102, Utah Code Annotated 1953
33 34-48-201, Utah Code Annotated 1953
34 34-48-202, Utah Code Annotated 1953
35 34-48-203, Utah Code Annotated 1953
36 34-48-301, Utah Code Annotated 1953
37 53B-24-101, Utah Code Annotated 1953
38 53B-24-102, Utah Code Annotated 1953
39 53B-24-201, Utah Code Annotated 1953
40 53B-24-202, Utah Code Annotated 1953
41 53B-24-203, Utah Code Annotated 1953
42 53B-24-301, Utah Code Annotated 1953
43
44 Be it enacted by the Legislature of the state of Utah:
45 Section 1. Section 34-48-101 is enacted to read:
46 CHAPTER 48. INTERNET EMPLOYMENT PRIVACY ACT
47 Part 1. General Provisions
48 34-48-101. Title.
49 This chapter is known as the "Internet Employment Privacy Act."
50 Section 2. Section 34-48-102 is enacted to read:
51 34-48-102. Definitions.
52 As used in this chapter:
53 (1) "Adverse action" means to discharge, threaten, or otherwise discriminate against an
54 employee in any manner that affects the employee's employment, including compensation,
55 terms, conditions, location, rights, immunities, promotions, or privileges.
56 (2) "Employer" means a person, including the state or a political subdivision of the
57 state, that has one or more workers or operators employed in the same business, or in or about

58 the same establishment, under any contract of hire, express or implied, oral or written.
59 (3) "Law enforcement agency" is as defined in Section 53-1-102 .
60 (4) (a) "Personal Internet account" means an online account that is used by an
61 employee or applicant exclusively for personal communications unrelated to any business
62 purpose of the employer.
63 (b) "Personal Internet account" does not include an account created, maintained, used,
64 or accessed by an employee or applicant for business related communications or for a business
65 purpose of the employer.
66 Section 3. Section 34-48-201 is enacted to read:
67 Part 2. Prohibited and Permitted Activities
68 34-48-201. Employer may not request disclosure of information related to
69 personal Internet account.
70 An employer may not do any of the following:
71 (1) request an employee or an applicant for employment to disclose a username and
72 password, or a password that allows access to the employee's or applicant's personal Internet
73 account; or
74 (2) take adverse action, fail to hire, or otherwise penalize an employee or applicant for
75 employment for failure to disclose information described in Subsection (1).
76 Section 4. Section 34-48-202 is enacted to read:
77 34-48-202. Permitted actions by an employer.
78 (1) This chapter does not prohibit an employer from doing any of the following:
79 (a) requesting or requiring an employee to disclose a username or password required
80 only to gain access to the following:
81 (i) an electronic communications device supplied by or paid for in whole or in part by
82 the employer; or
83 (ii) an account or service provided by the employer, obtained by virtue of the
84 employee's employment relationship with the employer, and used for the employer's business
85 purposes;

86 (b) disciplining or discharging an employee for transferring the employer's proprietary
87 or confidential information or financial data to an employee's personal Internet account without
88 the employer's authorization;
89 (c) conducting an investigation or requiring an employee to cooperate in an
90 investigation in any of the following:
91 (i) if there is specific information about activity on the employee's personal Internet
92 account, for the purpose of ensuring compliance with applicable laws, regulatory requirements,
93 or prohibitions against work-related employee misconduct; or
94 (ii) if the employer has specific information about an unauthorized transfer of the
95 employer's proprietary information, confidential information, or financial data to an employee's
96 personal Internet account;
97 (d) restricting or prohibiting an employee's access to certain websites while using an
98 electronic communications device supplied by, or paid for in whole or in part by, the employer
99 or while using an employer's network or resources, in accordance with state and federal law; or
100 (e) monitoring, reviewing, accessing, or blocking electronic data stored on an
101 electronic communications device supplied by, or paid for in whole or in part by, the employer,
102 or stored on an employer's network, in accordance with state and federal law.
103 (2) Conducting an investigation or requiring an employee to cooperate in an
104 investigation as specified in Subsection (1)(c) includes requiring the employee to share the
105 content that has been reported in order to make a factual determination.
106 (3) This chapter does not prohibit or restrict an employer from complying with a duty
107 to screen employees or applicants before hiring or to monitor or retain employee
108 communications that is established under federal law, by a self-regulatory organization under
109 the Securities and Exchange Act of 1934, 15 U.S.C. Sec. 78c(a)(26), or in the course of a law
110 enforcement employment application or law enforcement officer conduct investigation
111 performed by a law enforcement agency.
112 (4) This chapter does not prohibit or restrict an employer from viewing, accessing, or
113 using information about an employee or applicant that can be obtained without the information

114 described in Subsection 34A-48-201 (1) or that is available in the public domain.
115 Section 5. Section 34-48-203 is enacted to read:
116 34-48-203. Chapter does not create duties.
117 (1) This chapter does not create a duty for an employer to search or monitor the activity
118 of a personal Internet account.
119 (2) An employer is not liable under this chapter for failure to request or require that an
120 employee or applicant for employment grant access to, allow observation of, or disclose
121 information that allows access to or observation of the employee's or applicant for
122 employment's personal Internet account.
123 Section 6. Section 34-48-301 is enacted to read:
124 Part 3. Remedy
125 34-48-301. Private right of action.
126 (1) A person aggrieved by a violation of this chapter may bring a civil cause of action
127 against an employer in a court of competent jurisdiction.
128 (2) In an action brought under Subsection (1), if the court finds a violation of this
129 chapter, the court shall award the aggrieved person not more than $500.
130 Section 7. Section 53B-24-101 is enacted to read:
131 CHAPTER 24. INTERNET POSTSECONDARY INSTITUTION PRIVACY ACT
132 Part 1. General Provisions
133 53B-24-101. Title.
134 This chapter is known as the "Internet Postsecondary Institution Privacy Act."
135 Section 8. Section 53B-24-102 is enacted to read:
136 53B-24-102. Definitions.
137 As used in this chapter:
138 (1) (a) "Personal Internet account" means an online account that is used by a student or
139 prospective student exclusively for personal communications unrelated to any purpose of the
140 postsecondary institution.
141 (b) "Personal Internet account" does not include an account created, maintained, used,

142 or accessed by a student or prospective student for education related communications or for an
143 educational purpose of the postsecondary institution.
144 (2) "Postsecondary institution" means an institution that provides educational services
145 offered primarily to persons who have completed or terminated their secondary or high school
146 education or who are beyond the age of compulsory school attendance.
147 Section 9. Section 53B-24-201 is enacted to read:
148 Part 2. Prohibited and Permitted Activities
149 53B-24-201. Prohibited activities.
150 A postsecondary institution may not do any of the following:
151 (1) request a student or prospective student to disclose a username and password, or a
152 password that allows access to the student's or prospective student's personal Internet account;
153 or
154 (2) expel, discipline, fail to admit, or otherwise penalize a student or prospective
155 student for failure to disclose information specified in Subsection (1).
156 Section 10. Section 53B-24-202 is enacted to read:
157 53B-24-202. Permitted activities.
158 (1) This chapter does not prohibit a postsecondary institution from requesting or
159 requiring a student to disclose a username or password to gain access to or operate the
160 following:
161 (a) an electronic communications device supplied by or paid for in whole or in part by
162 the postsecondary institution; or
163 (b) an account or service provided by the postsecondary institution that is either
164 obtained by virtue of the student's admission to the postsecondary institution or used by the
165 student for educational purposes.
166 (2) This chapter does not prohibit or restrict a postsecondary institution from viewing,
167 accessing, or using information about a student or prospective student that can be obtained
168 without the information described in Subsection 53B-24-201 (1) or that is available in the
169 public domain.

170 Section 11. Section 53B-24-203 is enacted to read:
171 53B-24-203. Duties not created.
172 (1) This chapter does not create a duty for a postsecondary institution to search or
173 monitor the activity of a personal Internet account.
174 (2) A postsecondary institution is not liable under this chapter for failure to request or
175 require that a student or prospective student grant access to, allow observation of, or disclose
176 information that allows access to or observation of the student's or prospective student's
177 personal Internet account.
178 Section 12. Section 53B-24-301 is enacted to read:
179 Part 3. Remedy
180 53B-24-301. Private right of action.
181 (1) A person aggrieved by a violation of this chapter may bring a civil cause of action
182 against a postsecondary institution in a court of competent jurisdiction.
183 (2) In an action brought under Subsection (1), if the court finds a violation of this
184 chapter, the court shall award the aggrieved person not more than $500.

[Bill Documents]