10020A-11-160453-18-10263A-19-10163A-19-10263A-19-20263A-19-20363A-19-20463A-19-30163A-19-30263A-19-40163A-19-401.163A-19-401.263A-19-401.363A-19-401.463A-19-40363A-19-40563A-19-40663A-19-40763G-2-30363A-19-50163A-19-50263G-2-20163G-2-30163G-2-30263G-2-60163G-2-80367-1a-152Data Privacy Amendments2026 GENERAL SESSIONSTATE OF UTAHChief Sponsor: David ShallenbergerSenate Sponsor: Kirk A. CullimoreLONG TITLEGeneral Description:This bill amends the Government Data Privacy Act and the Government Records Access and Management Act.Highlighted Provisions:This bill:defines terms;requires governmental entities to obtain authorization from their elected legislative body before implementing high-risk surveillance activities;requires approved surveillance activities to be included in annual reports;restructures the Utah Privacy Commission to include representatives from state agencies, cities, counties, public education, and higher education;transfers support of the Utah Privacy Commission from the state auditor's office to the Office of Data Privacy;authorizes the commission to establish participation requirements for commission members;authorizes the Office of Data Privacy to provide recommendations and guidance;authorizes the Office of Data Privacy to partner with state institutions of higher education for research and support functions;establishes the data privacy ombudsman as a component of the Office of Data Privacy;establishes a data privacy complaint process;removes duplicative provisions from the Government Records Access and Management Act;expands amendment and correction procedures to cover information beyond personal data; andmakes technical and conforming changes.Money Appropriated in this Bill:NoneOther Special Clauses:NoneUtah Code Sections Affected:AMENDS:20A-11-1604, as last amended by Laws of Utah 2025, Chapters 90, 44853-18-102, as last amended by Laws of Utah 2022, Chapter 36763A-19-101, as last amended by Laws of Utah 2025, Chapter 47563A-19-102, as last amended by Laws of Utah 2025, Chapter 47563A-19-202, as enacted by Laws of Utah 2024, Chapter 41763A-19-203, as renumbered and amended by Laws of Utah 2025, Chapter 47563A-19-204, as renumbered and amended by Laws of Utah 2025, Chapter 47563A-19-301, as last amended by Laws of Utah 2025, Chapter 47563A-19-302, as enacted by Laws of Utah 2024, Chapter 41763A-19-401, as last amended by Laws of Utah 2025, Chapter 47563A-19-401.1, as enacted by Laws of Utah 2025, Chapter 47563A-19-401.2, as enacted by Laws of Utah 2025, Chapter 47563A-19-401.3, as enacted by Laws of Utah 2025, Chapter 47563A-19-401.4, as enacted by Laws of Utah 2025, Chapter 47563A-19-403, as enacted by Laws of Utah 2024, Chapter 41763A-19-405, as last amended by Laws of Utah 2025, Chapter 47563A-19-406, as last amended by Laws of Utah 2025, Chapter 47563A-19-501, as last amended by Laws of Utah 2025, Chapter 47563G-2-201, as last amended by Laws of Utah 2025, Chapters 299, 47663G-2-301, as last amended by Laws of Utah 2025, First Special Session, Chapter 963G-2-302, as last amended by Laws of Utah 2025, Chapter 17263G-2-601, as last amended by Laws of Utah 2025, Chapter 47563G-2-803, as last amended by Laws of Utah 2013, Chapter 42667-1a-15, as last amended by Laws of Utah 2025, First Special Session, Chapter 17ENACTS:63A-19-407, Utah Code Annotated 195363A-19-502, Utah Code Annotated 1953RENUMBERS AND AMENDS:63A-19-408, (Renumbered from 63G-2-303, as last amended by Laws of Utah 2025, Chapter 208)Be it enacted by the Legislature of the state of Utah:

Section 1. Section 20A-11-1604 is amended to read:20A-11-1604. Failure to disclose conflict of interest -- Failure to comply with reporting requirements.(1)(a)Before or during the execution of any order, settlement, declaration, contract, or any other official act of office in which a state constitutional officer has actual knowledge that the state constitutional officer has a conflict of interest that is not stated in the conflict of interest disclosure, the state constitutional officer shall publicly declare that the state constitutional officer may have a conflict of interest and what that conflict of interest is.(b)Before or during any vote on legislation or any legislative matter in which a legislator has actual knowledge that the legislator has a conflict of interest that is not stated in the conflict of interest disclosure, the legislator shall orally declare to the committee or body before which the matter is pending that the legislator may have a conflict of interest and what that conflict is.(c)Before or during any vote on any rule, resolution, order, or any other board matter in which a member of the State Board of Education has actual knowledge that the member has a conflict of interest that is not stated in the conflict of interest disclosure, the member shall orally declare to the board that the member may have a conflict of interest and what that conflict of interest is.(2)Any public declaration of a conflict of interest that is made under Subsection (1) shall be noted:(a)on the official record of the action taken, for a state constitutional officer;(b)in the minutes of the committee meeting or in the Senate or House Journal, as applicable, for a legislator; or(c)in the minutes of the meeting or on the official record of the action taken, for a member of the State Board of Education.(3)A state constitutional officer shall make a complete conflict of interest disclosure on the website:(a)(i)no sooner than January 1 each year, and before January 11 each year; or(ii)if the state constitutional officer takes office after January 10, within 10 calendar days after the day on which the state constitutional officer takes office; and(b)each time the state constitutional officer changes employment.(4)A legislator shall make a complete conflict of interest disclosure on the website:(a)(i)no sooner than January 1 each year, and before January 11 each year; or(ii)if the legislator takes office after January 10, within 10 calendar days after the day on which the legislator takes office; and(b)each time the legislator changes employment.(5)A member of the State Board of Education shall make a complete conflict of interest disclosure on the website:(a)(i)no sooner than January 1 each year, and before January 11 each year; or(ii)if the member takes office after January 10, within 10 calendar days after the day on which the member takes office; and(b)each time the member changes employment.(6)A conflict of interest disclosure described in Subsection (3), (4), or (5) shall include:(a)the regulated officeholder's name;(b)subject to Subsection (7):(i)the name and address of each of the regulated officeholder's current employers and each of the regulated officeholder's employers during the preceding year; and(ii)for each employer described in this Subsection (6)(b), a brief description of the employment, including the regulated officeholder's occupation and, as applicable, job title;(c)for each entity in which the regulated officeholder is an owner or officer, or was an owner or officer during the preceding year:(i)the name of the entity;(ii)a brief description of the type of business or activity conducted by the entity; and(iii)the regulated officeholder's position in the entity;(d)in accordance with Subsection (8), for each individual from whom, or entity from which, the regulated officeholder has received $5,000 or more in income during the preceding year:(i)the name of the individual or entity; and(ii)a brief description of the type of business or activity conducted by the individual or entity;(e)for each entity in which the regulated officeholder holds any stocks or bonds having a fair market value of $5,000 or more as of the date of the disclosure form or during the preceding year, but excluding funds that are managed by a third party, including blind trusts, managed investment accounts, and mutual funds:(i)the name of the entity; and(ii)a brief description of the type of business or activity conducted by the entity;(f)for each entity not listed in Subsections (6)(c) through (e) in which the regulated officeholder currently serves, or served in the preceding year, in a paid leadership capacity or in a paid or unpaid position on a board of directors:(i)the name of the entity or organization;(ii)a brief description of the type of business or activity conducted by the entity; and(iii)the type of position held by the regulated officeholder;(g)at the option of the regulated officeholder, a description of any real property in which the regulated officeholder holds an ownership or other financial interest that the regulated officeholder believes may constitute a conflict of interest, including a description of the type of interest held by the regulated officeholder in the property;(h)subject to Subsection (7):(i)the name of the regulated officeholder's spouse; and(ii)the name of each of the regulated officeholder's spouse's current employers and each of the regulated officeholder's spouse's employers during the preceding year, if the regulated officeholder believes the employment may constitute a conflict of interest;(i)the name of any adult residing in the regulated officeholder's household who is not related to the officeholder by blood;(j)for each adult described in Subsection (6)(i), a brief description of the adult's employment or occupation, if the regulated officeholder believes the adult's presence in the regulated officeholder's household may constitute a conflict of interest;(k)at the option of the regulated officeholder, a description of any other matter or interest that the regulated officeholder believes may constitute a conflict of interest;(l)the date the form was completed;(m)a statement that the regulated officeholder believes that the form is true and accurate to the best of the regulated officeholder's knowledge; and(n)the signature of the regulated officeholder.(7)(a)In making the disclosure described in Subsection (6)(b) or (h), if a regulated officeholder or regulated officeholder's spouse is an at-risk government employee, as that term is defined in Subsection 63G-2-303(1)(a)Section 63A-19-408, the regulated officeholder may request the filing officer to redact from the conflict of interest disclosure:(i)the regulated officeholder's employment information under Subsection (6)(b); and(ii)the regulated officeholder's spouse's name and employment information under Subsection (6)(h).(b)A filing officer who receives a redaction request under Subsection (7)(a) shall redact the disclosures made under Subsection (6)(b) or (h) before the filing officer makes the conflict of interest disclosure available for public inspection.(8)In making the disclosure described in Subsection (6)(d), a regulated officeholder who provides goods or services to multiple customers or clients as part of a business or a licensed profession is only required to provide the information described in Subsection (6)(d) in relation to the entity or practice through which the regulated officeholder provides the goods or services and is not required to provide the information described in Subsection (6)(d) in relation to the regulated officeholder's individual customers or clients.(9)The disclosure requirements described in this section do not prohibit a regulated officeholder from voting or acting on any matter.(10)A regulated officeholder may amend a conflict of interest disclosure described in this part at any time.(11)A regulated officeholder who violates the requirements of Subsection (1) is guilty of a class B misdemeanor.(12)(a)A regulated officeholder who intentionally or knowingly violates a provision of this section, other than Subsection (1), is guilty of a class B misdemeanor.(b)In addition to the criminal penalty described in Subsection (12)(a), the lieutenant governor shall impose a civil penalty of $100 against a regulated officeholder who violates a provision of this section, other than Subsection (1).

Section 2. Section 53-18-102 is amended to read:53-18-102. Definitions.As used in this chapter:(1)"Access software provider" means a provider of software, including client or server software, or enabling tools that do any one or more of the following:(a)filter, screen, allow, or disallow content;(b)pick, choose, analyze, or digest content; or(c)transmit, receive, display, forward, cache, search, subset, organize, reorganize, or translate content.(2)"Correctional facility" means the same as that term is defined in Section 77-16b-102.(3)"Dispatcher" means the same as that term is defined in Section 53-6-102.(4)"Immediate family member" means a public safety employee's spouse, child, parent, or grandparent who resides with the public safety employee.(5)"Interactive computer service" means the same as that term is defined in Subsection 47 U.S.C. 230(f).(6)"Law enforcement officer" or "officer":(a)means the same as that term is defined in Section 53-13-103;(b)includes correctional officers as defined in Section 53-13-104; and(c)refers only to officers who are currently employed by, retired from, or were killed in the line of duty while in the employ of a state or local governmental law enforcement agency.(7)(a)"Personal information" means a public safety employee's or a public safety employee's immediate family member's home address, home telephone number, personal mobile telephone number, personal pager number, personal email address, or personal photograph, directions to locate the public safety employee's home, or photographs of the public safety employee's or the public safety employee's immediate family member's home or vehicle.(b)"Personal information" includes a record or a part of a record that:(i)a public safety employee who qualifies as an at-risk government employee under Section 63G-2-30363A-19-408 requests to be classified as private under Subsection 63G-2-302(1)(h); and(ii)is classified as private under Title 63G, Chapter 2, Government Records Access and Management Act.(8)"Public safety employee" means:(a)a law enforcement officer;(b)a dispatcher; or(c)a current or retired employee or contractor of:(i)a law enforcement agency; or(ii)a correctional facility.(9)"Publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public.

Section 3. Section 63A-19-101 is amended to read:63A-19-101. Definitions.As used in this chapter:(1)"Anonymized data" means information that has been irreversibly modified so that there is no possibility of using the information, alone or in combination with other information, to identify an individual.(2)"At-risk government employee" means the same as that term is defined in Section 63G-2-30363A-19-408.(3)"Automated decision making" means using personal data to make a decision about an individual through automated processing, without human review or intervention.(4)"Biometric data" means the same as that term is defined in Section 13-61-101.(5)"Chief administrative officer" means the same as that term is defined in Section 63A-12-100.5., and is a separate and distinct role from the chief administrative officer role described in Section 11-50-202, though a governmental entity may designate the same individual to serve in both roles.(6)"Chief privacy officer" means the individual appointed under Section 63A-19-302.(7)"Commission" means the Utah Privacy Commission established in Section 63A-19-203.(8)"Contract" means an agreement between a governmental entity and a person for goods or services that involve personal data.(9)(a)"Contractor" means a person who:(i)has entered into a contract with a governmental entity; and(ii)may process personal data under the contract.(b)"Contractor" includes a contractor's employees, agents, or subcontractors.(10)"Cyber Center" means the Utah Cyber Center created in Section 63A-16-1102.(11)"Data breach" means the unauthorized access, acquisition, disclosure, loss of access, or destruction of personal data held by a governmental entity, unless the governmental entity concludes, according to standards established by the Cyber Center, that there is a low probability that personal data has been compromised.(12)(11)"Data privacy complaint" means a complaint or concern raised by an individual regarding:(a)an alleged infringement on the individual's data privacy interests described in Subsection 63A-19-102(1); or(b)a governmental entity's data privacy practices described in Part 4, Duties of Governmental Entities.(12)"De-identified data" means information from which personal data has been removed or obscured so that the information is not readily identifiable to a specific individual, and which may not be re-identified.(13)"Genetic data" means the same as that term is defined in Section 13-60-102.(14)"Governing board" means the Utah Privacy Governing Board established in Section 63A-19-201.(15)"Governmental entity" means the same as that term is defined in Section 63G-2-103.(16)"Government website" means a set of related web pages that is operated by or on behalf of a governmental entity and is:(a)located under a single domain name or web address; and(b)accessible directly through the Internet or by the use of a software program.(17)(a)"High-risk processing activities" means a governmental entity's processing of personal data that may have a significant impact on an individual's privacy interests, based on factors that include:(i)the sensitivity of the personal data processed;(ii)the amount of personal data being processed;(iii)the individual's ability to consent to the processing of personal data; and(iv)risks of unauthorized access or use.(b)"High-risk processing activities" may include the use of:(i)facial recognition technology;(ii)automated decision making;(iii)profiling;(iv)license plate readers;(v)genetic data;(v)(vi)biometric data; or(vi)(vii)specific geolocation data.(18)"Independent entity" means the same as that term is defined in Section 63E-1-102.(19)"Individual" means the same as that term is defined in Section 63G-2-103.(20)"Legal guardian" means:(a)the parent of a minor; or(b)an individual appointed by a court to be the guardian of a minor or incapacitated individual and given legal authority to make decisions regarding the person or property of the minor or incapacitated individual.(21)"License plate reader" means a computerized system of:(a)automated high-speed cameras used to capture license plate data; and(b)optical character recognition software that converts the license plate data into computer-readable data.(21)(22)"Office" means the Utah Office of Data Privacy created in Section 63A-19-301.(22)(23)"Ombudsperson" means the data privacy ombudsperson appointed under Section 63A-19-501.(23)(24)"Person" means the same as that term is defined in Section 63G-2-103.(24)(25)"Personal data" means information that is linked or can be reasonably linked to an identified individual or an identifiable individual.(25)(26)"Privacy annotation" means a summary of personal data contained in a record series as described in Section 63A-19-401.1.(26)(27)"Privacy practice" means a governmental entity's:(a)organizational, technical, administrative, and physical safeguards designed to protect an individual's personal data;(b)policies and procedures related to the acquisition, use, storage, sharing, retention, and disposal of personal data; and(c)practice of providing notice to an individual regarding the individual's privacy rights.(27)(28)"Process," "processing," or "processing activity" means any operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, access, retrieval, consultation, use, disclosure by transmission, transfer, dissemination, alignment, combination, restriction, erasure, or destruction.(28)(29)"Profiling" means the processing of personal data to evaluate or predict an individual's:means any form of automated processing performed on personal data to evaluate, analyze, or predict an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.(a)economic situation;(b)health;(c)personal preferences;(d)interests;(e)reliability;(f)behavior;(g)location; or(h)movements.(29)(30)"Purchase" or "purchasing" means the exchange of monetary consideration to obtain the personal data of an individual who is not a party to the transaction.(30)(31)"Record" means the same as that term is defined in Section 63G-2-103.(31)(32)"Record series" means the same as that term is defined in Section 63G-2-103.(32)(33)"Retention schedule" means a governmental entity's schedule for the retention or disposal of records that has been approved by the Records Management Committee pursuant to Section 63A-12-113.(34)"Security incident" means the unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations in the information system used by a governmental entity.(33)(35)(a)"Sell" means an exchange of personal data for monetary consideration by a governmental entity to a third party.(b)"Sell" does not include a fee:(i)charged by a governmental entity for access to a record pursuant to Section 63G-2-203; or(ii)assessed in accordance with an approved fee schedule.(36)"Specific geolocation data" means the same as that term is defined in Section 13-61-101.(34)(37)(a)"State agency" means the following entities that are under the direct supervision and control of the governor or the lieutenant governor:(i)a department;(ii)a commission;(iii)a board;(iv)a council;(v)an institution;(vi)an officer;(vii)a corporation;(viii)a fund;(ix)a division;(x)an office;(xi)a committee;(xii)an authority;(xiii)a laboratory;(xiv)a library;(xv)a bureau;(xvi)a panel;(xvii)another administrative unit of the state; or(xviii)an agent of an entity described in Subsections (34)(a)(i) (39)(a)(i) through (xvii).(b)"State agency" does not include:(i)the legislative branch;(ii)the judicial branch;(iii)an executive branch agency within the Office of the Attorney General, the state auditor, the state treasurer, or the State Board of Education; or(iv)an independent entity.(35)(38)"State privacy auditor" means the same as that term is defined in Section 67-3-13.(36)(39)"Synthetic data" means artificial data that:(a)is generated from personal data; and(b)models the statistical properties of the original personal data.(37)(40)"User" means an individual who accesses a government website.(38)(41)(a)"User data" means any information about a user that is automatically collected by a government website when a user accesses the government website.(b)"User data" includes information that identifies:(i)a user as having requested or obtained specific materials or services from a government website;(ii)Internet sites visited by a user;(iii)the contents of a user's data-storage device;(iv)any identifying code linked to a user of a government website; and(v)a user's:(A)IP or Mac address; or(B)session ID.(39)(42)"Website tracking technology" means any tool used by a government website to:(a)monitor a user's behavior; or(b)collect user data.

Section 4. Section 63A-19-102 is amended to read:63A-19-102. State data privacy policy.It is the policy of Utah that:(1)an individual has a fundamental interest in and inherent expectation of privacy regarding the individual's personal data that the individual provides to a governmental entity;(2)a governmental entity shall process personal data in a manner that is consistent with the interests and expectations described in Subsection (1);(3)the state shall encourage innovation to enhance the ability of a governmental entity to:(a)protect the privacy of an individual's personal data;(b)(i)provide clear notice, where possible, to an individual regarding the governmental entity's processing of the individual's personal data; or(ii)for processing activities for which an individual's personal data may be collected without the ability to provide direct notice, provide that public notice be given and that governmental entity's legislative bodies or elected officials authorize the data processing prior to implementation;(c)process personal data only for specified, lawful purposes and only process the minimum amount of an individual's personal data necessary to achieve those purposes;(d)implement appropriate consent mechanisms regarding the uses of an individual's personal data;(e)provide an individual with the ability to access, control, and request corrections to the individual's personal data held by a governmental entity;(f)maintain appropriate safeguards to protect the confidentiality, integrity, and availability of personal data;(g)account for compliance with privacy related laws, rules, and regulations that are specific to a particular governmental entity, program, or personal data; and(h)meet a governmental entity's and an individual's business and service needs;(4)the state shall promote training and education programs for employees of governmental entities focused on:(a)data privacy best practices, obligations, and responsibilities; and(b)the overlapping relationship with privacy, records management, and security; and (5)the state shall promote consistent terminology in data privacy requirements across governmental entities.

Section 5. Section 63A-19-202 is amended to read:2. Utah Privacy Governing Board and Utah Privacy Commission63A-19-202. Governing board duties.(1)The governing board shall:(a)recommend changes to the state data privacy policy;(b)by July 1 of each year, approve the data privacy agenda items for the commission and make recommendations for additional items for the data privacy agenda;(c)(b)hear issues raised by the ombudsperson regarding existing governmental entity privacy practices;(d)(c)evaluate and recommend the appropriate:(i)structure and placement for the office within state government; and(ii)authority to be granted to the office, including any authority to make rules; and(e)(d)recommend funding mechanisms and strategies for governmental entities to enable compliance with data privacy responsibilities, including:(i)appropriations;(ii)rates;(iii)grants; and(iv)internal service funds.(2)In fulfilling the duties under this part, the governing board may receive and request input from:(a)governmental entities;(b)elected officials;(c)subject matter experts; and(d)other stakeholders.

Section 6. Section 63A-19-203 is amended to read:63A-19-203. Utah Privacy Commission created.(1)There is created the Utah Privacy Commission.(2)(a)The commission shall be composed of 12no more than 14 members.(b)The governor shall appoint:(i)one member who, at the time of appointment provides internet technology services for a county;(ii)one member with experience in cybersecurity;(iii)one member representing private industry in technology;(iv)one member representing law enforcement; and(v)one member with experience in data privacy law.; and(vi)one member who is a private citizen representing the public.(c)The State Board of Education shall appoint one member representing public education entities and the privacy interests of students.(c)(d)The state auditor shall appoint:(i)one member with experience in internet technology services;(ii)one member with experience in cybersecurity;(iii)one member representing private industry in technology;(iv)one member with experience in data privacy law; and(v)one member representing municipalities who, at the time of appointment, has expertise in civil liberties law, the ethical use of data, or the impacts of the use of a technology on different populations..(d)(e)The attorney general shall appoint:(i)one member with experience as a prosecutor or appellate attorney and with experience in data privacy or civil liberties law; and(ii)one member representing law enforcement.(3)(a)Except as provided in Subsection (3)(b), a member is appointed for a term of four years.(b)The initial appointments of members described in Subsections (2)(b)(i) through (b)(iii), (2)(c)(iv) through (c)(v), and (2)(d)(ii)(2)(b)(i) through (iii), (2)(d)(iv) and (v), and (2)(e)(ii) shall be for two-year terms.(c)When the term of a current member expires, a member shall be reappointed or a new member shall be appointed in accordance with Subsection (2).(4)(a)When a vacancy occurs in the membership for any reason, a replacement shall be appointed in accordance with Subsection (2) for the unexpired term.(b)A member whose term has expired may continue to serve until a replacement is appointed.(5)The commission shall select officers from the commission's members as the commission finds necessary.(6)(a)A majority of the members of the commission is a quorum.(b)The action of a majority of a quorum constitutes an action of the commission.(7)A member may not receive compensation or benefits for the member's service but may receive per diem and travel expenses incurred as a member of the commission at the rates established by the Division of Finance under:(a)Sections 63A-3-106 and 63A-3-107; and(b)rules made by the Division of Finance in accordance with Sections 63A-3-106 and 63A-3-107.(8)A member shall refrain from participating in a review of:(a)an entity of which the member is an employee; or(b)a technology in which the member has a financial interest.(9)The state auditoroffice shall provide staff and support to the commission.(10)The commission shall meet up to 12 times a year to accomplish the duties described in Section 63A-19-204.(11)(a)The commission shall, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, make rules establishing participation requirements for commission members.(b)A commission member who fails to meet the participation requirements established under Subsection (11)(a) may be removed by the official who appointed the member in accordance with Subsection (2).

Section 7. Section 63A-19-204 is amended to read:63A-19-204. Commission duties.(1)The commission shall:(a)annually develop a data privacy agenda that identifies for the upcoming year:(i)governmental entity privacy practices to be reviewed by the commission;(ii)educational and training materials that the commission intends to develop;(iii)any other items related to data privacy the commission intends to study; and(iv)best practices and guiding principles that the commission plans to develop related to government privacy practices;(b)(a)develop guiding standards and best practices with respect to government privacy practices;(c)(b)develop educational and training materials that include information about:(i)the privacy implications and civil liberties concerns of the privacy practices of government entities;(ii)best practices for government collection and retention policies regarding personal data; and(iii)best practices for government personal data security standards; and(d)(c)review the privacy implications and civil liberties concerns of government privacy practices; and.(e)provide the data privacy agenda to the governing board by May 1 of each year.(2)The commission may, in addition to the approved items in the data privacy agenda prepared under Subsection (1)(a):(a)review specific government privacy practices as referred to the commission by the chief privacy officer described in Section 63A-19-302 or the state privacy auditor described in Section 67-3-13; (b)review a privacy practice not accounted for in the data privacy agenda only upon referral by the chief privacy officer or the state privacy auditor in accordance with this section;(c)(b)review and provide recommendations regarding consent mechanisms used by governmental entities to collect personal informationdata;(d)(c)develop and provide recommendations to the Legislature on how to balance transparency and public access of public records against an individual's reasonable expectations of privacy and data protection; and(e)(d)develop recommendations for legislation regarding the guiding standards and best practices the commission has developed in accordance with Subsection (1)(a).;(e)endorse any policy, practice, or report of the office; and(f)consult with relevant public and private entities in the performance of the commission's duties listed in Subsection (1).(3)At least annually, on or before October 1, the commission shall report to the JudiciaryGovernment Operations Interim Committee:(a)the results of any reviews the commission has conducted;(b)the guiding standards and best practices described in Subsection (1)(b); and(c)any recommendations for legislation the commission has developed in accordance with Subsection (2)(e).(4)(a)Upon request by the governing board, a member of the commission shall give an update on the work of the commission at any governing board meeting.(b)The governing board may at any time instruct the commission to review and report upon any privacy developments related to governmental privacy within the scope of the commission's duties.(4)At least annually, on or before June 1, the commission shall report to the governing board regarding:(a)governmental entity privacy practices the commission plans to review in the next year;(b)any educational and training programs the commission intends to develop in relation to government data privacy best practices;(c)results of the commission's data privacy practice reviews from the previous year; and(d)recommendations from the commission related to data privacy legislation, standards, or best practices.(5)The data privacy agenda detailed in Subsection (1)(a) does not add to or expand the authority of the commission.

Section 8. Section 63A-19-301 is amended to read:63A-19-301. Utah Office of Data Privacy.(1)There is created within the department the Utah Office of Data Privacy.(2)The office shall coordinate with the governing board and the commission to perform the duties in this section.(3)The office shall:(a)create and maintain a data privacy framework designed to:(i)assist governmental entities to identify and implement effective and efficient data privacy practices, tools, and systems that:(A)protect the privacy of personal data;(B)comply with data privacy laws and regulations specific to the governmental entity, program, or data;(C)empower individuals to protect and control their personal data; and(D)enable information use and sharing among governmental entities, as allowed by law; and(ii)account for differences in a governmental entity's resources, capabilities, populations served, data types, and maturity level regarding data privacy practices;(b)review statutory provisions related to governmental data privacy and records management to:(i)identify conflicts and gaps in data privacy law; and(ii)standardize language;(c)work with governmental entities to study, research, and identify:(i)additional data privacy practices that are feasible for governmental entities;(ii)potential remedies and accountability mechanisms for non-compliance of a governmental entity;(iii)ways to expand an individual's control over the individual's personal data processed by a governmental entity;(iv)resources needed to develop, implement, and improve data privacy programs; and(v)best practices regarding:(A)automated decision making;(B)the creation and use of synthetic, de-identified, or anonymized data; and(C)the use of website tracking technology;(d)monitor high-risk data processing activities within governmental entities;(e)coordinate with the Cyber Center to develop an incident response plan for data breaches affecting governmental entities;(f)coordinate with the state archivist to:(i)incorporate data privacy practices into records management; and(ii)include data privacy content in the trainings described in Section 63A-12-110; and(g)develop, maintain, and make available data privacy training, education, and awareness materials that meet the requirements of Section 63A-19-401.2.(g)create a data privacy training program for employees of governmental entities as described in Section 63A-19-401.3.(4)The office may:(a)provide expertise and assistance to governmental entities for high-risk data processing activities;(b)create assessment tools and resources that a governmental entity may use to:(i)review, evaluate, and mature the governmental entity's privacy program, practices, and processing activities; and(ii)evaluate the privacy impact, privacy risk, and privacy compliance of the governmental entity's privacy program, practices, and processing activities;(c)charge a governmental entity a service fee, established in accordance with Section 63J-1-504, for providing services that enable a governmental entity to perform the governmental entity's duties under Section 63A-19-401, if the governmental entity requests the office provide those services;(d)bill a state agency, as provided in Section 63J-1-410, for any services the office provides to a state agency;(e)provide funding to assist a governmental entity in complying with:(i)this chapter; and(ii)Title 63G, Chapter 2, Part 3, Classification, and Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records; (f)advise the governing board about widespread or systemic data privacy matters or alleged violations;(g)work with the Division of Purchasing and General Services to develop cooperative contracts that a governmental entity may choose to use to support the governmental entity's data privacy compliance;(h)make available to governmental entities privacy compliance assessment tools that may be used by governmental entities to assess the governmental entity's reasonable compliance of processing activities described in this chapter;(i)upon request of a governmental entity or on the office's own initiative, issue guidance or recommendations regarding:(i)interpretation of this chapter;(ii)compliance with this chapter; and(iii)best practices for data privacy and data governance;(j)contract with an institute, component, or department at a state institution of higher education to support the office in:(i)conducting research and prepare reports regarding data privacy and data governance;(ii)providing support to the commission;(iii)holding data governance summits and educational programs;(iv)developing systems and tools to support data privacy and data governance; and(v)providing other services in support of the office's duties under this chapter;(k)create data governance models that may be used by governmental entities; and(f)(l)make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, to administer this partchapter.(5)(a)Upon application by a governmental entity, the office may:(i) grant, for a limited period of time, a governmental entity with an:(A)(i)extension of time to comply with certain requirements of Part 4, Duties of Governmental Entities; or(B)(ii)exemption from complying with certain requirements of Part 4, Duties of Governmental Entities; or.(ii)allow a governmental entity to establish a data privacy training program for the governmental entity's employees to complete, instead of the data privacy training program established by the office under Section 63A-19-401.3, if the governmental entity's data privacy training program contains the same information contained in the office's data privacy training program.(b)On the office's own initiative, the office may issue a one-time extension to a category or group of governmental entities to comply with certain requirements of Part 4, Duties of Governmental Entities.(c)An extension issued under Subsection (5)(b):(i)shall:(A)identify the specific duty for which the extension is granted and the section that imposes the duty; and(B)specify the category or group of governmental entities to which the extension applies; and(ii)may not be longer than 12 months.(d)An application for an extension or exemption submitted under Subsection (5)(a)(i) (5)(a) shall:(i)identify the specific duty from which the governmental entity seeks an extension or exemption and the section that imposes that duty; and(ii)include a justification for the requested extension or exemption.(c)(e)If the office grants an exemption under Subsection (5)(a), the office shall report at the next board meeting:(i)the name of the governmental entity that received an exemption; and(ii)the nature of the exemption.(d)(f)The office shall notify the state privacy auditor of any approved extensions or exemptions.

Section 9. Section 63A-19-302 is amended to read:63A-19-302. Chief privacy officer -- Appointment -- Powers -- Reporting.(1)The governor shall, with the advice and consent of the Senate, appoint a chief privacy officer.(2)The chief privacy officer is the director of the office.(3)The chief privacy officer:(a)shall exercise all powers given to and perform all duties imposed on the office;(b)has administrative authority over the office;(c)may make changes in office personnel and service functions under the chief privacy officer's administrative authority;(d)may authorize a designee to assist with the chief privacy officer's responsibilities; and(e)shall report annually, on or before October 1June 30, to the Judiciary Interim CommitteeGovernment Operations Interim Committee regarding:(i)recommendations for legislation to address data privacy concerns; and(ii)reports received from state agencies regarding the sale or sharing of personal data provided under Subsection 63A-19-401(2)(f)(ii).Section 63A-19-401.3.

Section 10. Section 63A-19-401 is amended to read:63A-19-401. Duties of governmental entities.(1)(a)Except as provided in Subsections (1)(b) and (c), a governmental entity shall comply with the requirements of this part.(b)If any provision in this part conflicts with any other provisions of law, the more specific or more restrictive lawprovision shall control.(c)A governmental entity that is exempt under Section 63G-2-702, 63G-2-703, or 63G-2-704 from complying with the requirements in Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records, is exempt from complying with the requirements in this chapter.(2)(a)A governmental entity shall:(i)initiate a data privacy program before December 31, 2025;(ii)obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose;(iii)meet the requirements of this part for all new processing activities implemented by a governmental entity; and(iv)for any processing activity implemented before May 7, 2025, as soon as is reasonably practicable, but no later than July 1, 2027:(A)identify any non-compliant processing activity;(B)document the non-compliant processing activity;(C)(B)prepare a strategy for bringing the non-compliant processing activity into compliance with this part; and(D)(C)include the information described in Subsections (2)(a)(iv)(A) through (C)and (B) in the privacy program report described in Section 63A-19-401.3.(b)A governmental entity that fulfills the reporting requirement under Section 63A-19-401.3 satisfies the requirement to initiate a privacy program under Subsection (2)(a)(i).(3)A governmental entity may not:(a)establish, maintain, or use undisclosed or covert surveillance of individuals unless permitted by law;(b)sell personal data unless expressly required by law; and(c)share personal data unless permitted by law.

Section 11. Section 63A-19-401.1 is amended to read:63A-19-401.1. Privacy annotations.(1)(a)Beginning July 1, 2027, a state agency shall make a complete and accurate privacy annotation for each record series containing personal data that the state agency collects, maintains, or uses.(b)After July 1, 2027, a state agency that has not createdcompleted a privacy annotation for a record series containing personal data, may not collect, maintain, or use the personal data in the record series.(2)If a state agency determines that a record series:(a)does not contain personal data, the privacy annotation shall be limited to a statement indicating that the record series does not include personal data; or(b)contains personal data, the privacy annotation shall include:(i)an inventory of all types of personal data included in the record series;(ii)a description of all purposes for which the state agency collects, keeps, or uses the personal data;(iii)a citation to the state agency's legal authority for collecting, keeping, or using the personal data; and(iv)any other information required by the rules created by the office under Section 63A-19-301.

Section 12. Section 63A-19-401.2 is amended to read:63A-19-401.2. Training requirements.(1)The data privacy training program created by the office under Section 63A-4-301 shall be:(a)designed to provide instruction regarding:(i)data privacy best practices, obligations, and responsibilities; and(ii)the relationship between privacy, records management, and security; and(b)required for all employees of a governmental entity who:(i)have access to personal data as part of the employee's work duties; or(ii)supervise an employee who has access to personal data.(2)The training described in Subsection (1) shall be completed:(a)within 30 days after an employee of a governmental entity begins employment; and(b)at least once in each calendar year.(3)A governmental entity is responsible for:(a)ensuring that each employee of the governmental entity completes the data privacy training as required by Subsection (2); and(b)reporting the governmental entity's compliance with the training requirements as described in Section 63A-19-401.3.(1)An employee of a governmental entity shall complete data privacy training that includes instruction on:(a)data privacy best practices, obligations, and responsibilities;(b)the relationship between privacy, records management, and security;(c)the privacy interests and requirements of this chapter; and(d)the privacy interests and requirements of Title 63G, Chapter 2, Government Records Access and Management Act.(2)An employee of a governmental entity shall complete the data privacy training described in Subsection (1) if the employee:(a)has access to personal data as part of the employee's assigned duties; or(b)supervises an employee who has access to personal data.(3)The training described in Subsection (1) shall be completed:(a)within 30 days after the day on which the employee begins employment with a governmental entity; and(b)at least once in each calendar year.(4)A governmental entity shall:(a)ensure that each employee described in Subsection (2) completes a data privacy training that meets the requirements described in Subsection (1); and(b)report the percentage of the governmental entity's employees required to complete the data privacy training under this section that have completed the training as part of the privacy program report described in Section 63A-19-401.3.(5)A governmental entity may use the data privacy training created by the office to satisfy the requirements of this section, or may provide separate data privacy training that meets the requirements of this section.

Section 13. Section 63A-19-401.3 is amended to read:63A-19-401.3. Privacy program report.(1)On or before December 31 of each year, the chief administrative officer of each governmental entity shall prepare a report that includes:(a)whetherhow the governmental entity has initiated athe governmental entity's privacy program;(b)a description of:(i)any privacy practices implemented by the governmental entitythe governmental entity's privacy program including privacy practices;(ii)strategies for improving and maturing the governmental entity's privacy program and practices; and(iii)the governmental entity's high-risk processing activities;(c)a list of the types of personal data the governmental entity currently shares, sells, or purchases;(d)the legal basis for sharing, selling, or purchasing personal data;(e)the category of individuals or entities:(i)with whom the governmental entity shares personal data;(ii)to whom the governmental entity sells personal data; or(iii)from whom the governmental entity purchases personal data;(f)the percentage of the governmental entity's employees that have fulfilled the data privacy training requirements described in Section 63A-19-401.2the percentage of the governmental entity's employees required to complete the data privacy training under Section 63A-19-401.2 that have completed the training; and(g)a description of any non-compliant processing activities identified under Subsection 63A-19-401(2)(a)(iv) and the governmental entity's strategy for bringing those activities into compliance with this part.(2)The report described in Subsection (1) shall be:(a)shall be considered a protected record under Section 63G-2-305; and(b)may be made available at the request of the office.shared with the office, in accordance with Section 63G-2-206, on or before December 31 each year; and(c)retained by the governmental entity for no less than five years.

Section 14. Section 63A-19-401.4 is amended to read:63A-19-401.4. Requirements for contractors.(1)Except as provided in Subsection (4), a contractor that processes or has access to personal data as a part of the contractor's duties under a contract with a governmental entity is subject to the requirements of this chapter to the same extent as the governmental entity for any personal data the contractor processes or has access to under a contract with the governmental entity.(2)A contract entered into or renewed between a contractor and a governmental entity after July 1, 20262027, shall contain specific language that requires a contractor to comply with the requirements of this chapter with regard to the personal data processed or accessed by the contractor as a part of the contractor's duties under a contract to the same extent as required of the governmental entity.(3)The requirements under this section are in addition to and do not replace any other requirements or liability that may be imposed for the contractor's violation of other laws protecting privacy rights or government records.(4)A contractor is not subject to the data privacy training program requirements described in Section 63A-19-401.2.

Section 15. Section 63A-19-403 is amended to read:63A-19-403. Procedure to request amendment or correction of personal data.(1)A governmental entity that collects personal data shall provide a procedure by which an individual or legal guardian of an individual may request an amendment or correction of: (a)personal data that has been furnished to the governmental entity.; and(b)information concerning an identifiable individual contained in a record maintained by the governmental entity, as allowed by law.(2)The procedure by which an individual or legal guardian of an individual may request an amendment or correction shall comply with all applicable laws and regulations to which the personal data or information at issue and to which the governmental entity is subject.(3)The procedure to request an amendment or correction described in this section does not obligate the governmental entity to make the requested amendment or correction.

Section 16. Section 63A-19-405 is amended to read:63A-19-405. Data breach notification to the Cyber Center and the Office of the Attorney General.(1)As used in this section, "data breach" means:(a)the unauthorized access, unauthorized acquisition, unauthorized disclosure, loss of access, or unauthorized destruction of personal data affecting 500 or more individuals; or(b)a compromise of the security, confidentiality, availability, or integrity of the computer systems used by a governmental entity.(2)(a)A governmental entity that identifies a security incident shall:(i)determine whether the security incident constitutes a data breach; and(ii)document the governmental entity's determination under Subsection (2)(a)(i).(b)A governmental entity that identifies a data breach affecting 500 or more individuals shall notify the Cyber Center and the attorney general of the data breach.determines under Subsection (2)(a) that a security incident constitutes a data breach shall provide notification of the data breach to:(i)the attorney general; and(ii)the Cyber Center in accordance with Section 63A-16-1103.(b)(c)In addition to the notification required by Subsection (1)(a), (2)(b), a governmental entity that identifies the unauthorized access, acquisition, disclosure, loss of access, or destruction of data that compromises the security, confidentiality, availability, or integrity of the computer systems used or information maintained by the governmental entity shall notifyprovide notification to the Cyber Center in accordance with Section 63A-16-1103.(2)(3)The notification under Subsection (1) (2) shall:(a)be made without unreasonable delay, but no later than five days from the discovery of the data breach; and(b)include the following information:(i)the date and time the data breach occurred;(ii)the date the data breach was discovered;(iii)a short description of the data breach that occurred;(iv)the means by which access was gained to the system, computer, or network;(v)the person who perpetrated the data breach;(vi)steps the governmental entity is or has taken to mitigate the impact of the data breach; and(vii)any other details requested by the Cyber Center.(3)(4)For a data breach underdescribed in Subsection (1)(a), (2)(b) the governmental entity shall provide the following information to the Cyber Center and the attorney general in addition to the information required under Subsection (2)(b)(3)(b):(a)the total number of individuals affected by the data breach, including the total number of Utah residents affected; and(b)the type of personal data involved in the data breach.(4)(5)If the information required by Subsections (2)(b)(3)(b) and (3)(4) is not available within five days of discovering the breach, the governmental entity shall provide as much of the information required under Subsections (2)(b)(3)(b) and (3) (4) as is available and supplement the notification with additional information as soon as the information becomes available.(5)(a)A governmental entity that experiences a data breach affecting fewer than 500 individuals shall create an internal incident report containing the information in Subsection (2)(b) as soon as practicable and shall provide additional information as the information becomes available.(b)A governmental entity shall provide to the Cyber Center:(i)an internal incident report described in Subsection (5)(a) upon request of the Cyber Center; and(ii)an annual report logging all of the governmental entity's data breach incidents affecting fewer than 500 individuals.

Section 17. Section 63A-19-406 is amended to read:63A-19-406. Data breach notice to individuals affected by data breach.(1)As used in this section, "data breach" means the unauthorized access, unauthorized acquisition, unauthorized disclosure, loss of access, or unauthorized destruction of personal data held by a governmental entity, unless the governmental entity concludes that there is a low probability that personal data has been compromised.(1)(2)(a)Except as provided in Subsection (1)(b), (2)(b), a governmental entity shall providecause a data breach notice to be sent to an individual or legal guardian of an individual affected by the data breach:(i)after determining the scope of the data breach;(ii)after restoring the reasonable integrity of the affected system, if necessary; and(iii)without unreasonable delay except as provided in Subsection (2).(3).(b)A governmental entity or the governmental entity's contractor is not required to provide a data breach notice to an affected individual as described in Subsection (1)(a) (2)(a) if the:(i)personal data involved in the data breach would be classified as a public record under Section 63G-2-301; and(ii)the governmental entity prominently posts notice of the data breach on the homepage of the governmental entity's government website.(2)(3)A governmental entity or the governmental entity's contractor shall delay providing notification under Subsection (1) (2) at the request of a law enforcement agency that determines that notification may impede a criminal investigation, until such time as the law enforcement agency informs the governmental entity that notification will no longer impede the criminal investigation.(3)(4)The data breach notice to an affected individual shall include:(a)a description of the data breach;(b)the individual's personal data that was accessed or may have been accessed;(c)steps the governmental entity is taking or has taken to mitigate the impact of the data breach; and(d)recommendations to the individual on how to protect themselvesthe individual from identity theft and other financial losses; and.(e)any other language required by the Cyber Center.(4)(5)Unless the governmental entity reasonably believes that providing notification would pose a threat to the safety of an individual, or unless an individual has designated to the governmental entity a preferred method of communication, a governmental entity or the governmental entity's contractor shall provide notice by:(a)(i)email, if reasonably available and allowed by law; or(ii)mail; and(b)one of the following methods, if the individual's contact information is reasonably available and the method is allowed by law:(i)text message with a summary of the data breach notice and instructions for accessing the full notice; or(ii)telephone message with a summary of the data breach notice and instructions for accessing the full data breach notice.(5)(6)A governmental entity shall also provide a data breach notice in a manner that is reasonably calculated to have the best chance of being received by the affected individual or the legal guardian of an individual, such as through a press release, posting on appropriate social media accounts, or publishing notice in a newspaper of general circulation when:(a)a data breach affects more than 500 individuals; and(b)a governmental entity is unable to obtain an individual's contact information to provide notice for any method listed in Subsection (4).(5).

Section 18. Section 63A-19-407 is enacted to read:63A-19-407. Truth in surveillance.(1)As used in this section:(a)"Cell site simulator" means a device that mimics a cell tower to force cellular devices to connect to the device, allowing the device to intercept communications or track the location of cellular devices.(b)"Facial recognition system" means a technology that uses biometric data to identify or verify an individual's identity by analyzing facial features.(c)"Persistent aerial surveillance" means the continuous or extended monitoring of an area for individuals or vehicles using an unmanned aircraft system or other aerial platform.(2)In accordance with the state data privacy policy described in Section 63A-19-102, before implementing a facial recognition system, persistent aerial surveillance, a license plate reader, or a cell site simulator, a governmental entity that is not a state agency shall:(a)obtain authorization from the governmental entity's legislative body or elected official through action taken in an open public meeting under Title 52, Chapter 4, Open and Public Meetings Act; and(b)provide in the public meeting described in Subsection (2)(a):(i)a description of the technology to be implemented;(ii)all intended purposes and uses of the personal data;(iii)the classes of persons and governmental entities with whom the governmental entity shares the personal data; and(iv)a description of how the technology will be governed and overseen.(3)A governmental entity that implements a technology described in Subsection (2) in accordance with this section shall:(a)include the technology in the governmental entity's annual report required under Section 63A-19-401.3; and(b)biannually review and acknowledge to the legislative body or elected official the continued use of the technology.(4)A governmental entity that has implemented a technology described in Subsection (2) before May 6, 2026, shall:(a)on or before November 30, 2027, report to the governmental entity's legislative body or elected official the information described in Subsection (2)(b); and(b)obtain authorization from the governmental entity's legislative body or elected official in accordance with Subsection (2) on or before May 6, 2028, to continue using the technology.(5)The office shall work with the commission and state agencies to:(a)study the best manner of disclosure for state agencies that implement a technology described in Subsection (2); and(b)prepare recommendations that would appropriately allow for public notice of the implementation of a technology described in Subsection (2) by a state agency.

Section 19. Section 63A-19-408, which is renumbered from Section 63G-2-303 is renumbered and amended to read:63G-2-30363A-19-408. Private information concerning certain government employees.(1)As used in this section:(a)"At-risk government employee" means a current or former:(i)peace officer as specified in Section 53-13-102;(ii)state or federal judge of an appellate, district, justice, or juvenile court, or court commissioner;(iii)judge authorized by Title 39A, Chapter 5, Utah Code of Military Justice;(iv)judge authorized by Armed Forces, Title 10, United States Code;(v)federal prosecutor;(vi)prosecutor appointed pursuant to Armed Forces, Title 10, United States Code;(vii)law enforcement official as defined in Section 53-5a-311;(viii)prosecutor authorized by Title 39A, Chapter 5, Utah Code of Military Justice; or(ix)state or local government employee who, because of the unique nature of the employee's regular work assignments or because of one or more recent credible threats directed to or against the employee, would be at immediate and substantial risk of physical harm if the employee's personal information is disclosed.(b)"Family member" means the spouse, child, sibling, parent, or grandparent of an at-risk government employee who is living with the employee.(c)"Personal information" means the employee's or the employee's family member's home address, home telephone number, personal mobile telephone number, personal pager number, personal email address, social security number, insurance coverage, marital status, or payroll deductions.(2)(a)Pursuant to Subsection 63G-2-302(1)(h), an at-risk government employee may file a written application that:(i)gives notice of the employee's status as an at-risk government employee to each agency of a government entity holding a record or a part of a record that would disclose the employee's personal information; and(ii)requests that the government agency classify those records or parts of records as private.(b)An at-risk government employee desiring to file an application under this section may request assistance from the government agency to identify the individual records containing personal information.(c)Each government agency shall develop a form that:(i)requires the at-risk government employee to designate each specific record or part of a record containing the employee's personal information that the applicant desires to be classified as private;(ii)affirmatively requests that the government entity holding those records classify them as private;(iii)informs the employee that by submitting a completed form the employee may not receive official announcements affecting the employee's property, including notices about proposed municipal annexations, incorporations, or zoning modifications; and(iv)contains a place for the signature required under Subsection (2)(d).(d)A form submitted by an employee under Subsection (2)(c) shall be signed by the highest ranking elected or appointed official in the employee's chain of command certifying that the employee submitting the form is an at-risk government employee.(3)A county recorder, county treasurer, county auditor, or a county tax assessor may fully satisfy the requirements of this section by:(a)providing a method for the assessment roll and index and the tax roll and index that will block public access to the home address, home telephone number, situs address, and Social Security number; and(b)providing the at-risk government employee requesting the classification with a disclaimer informing the employee that the employee may not receive official announcements affecting the employee's property, including notices about proposed annexations, incorporations, or zoning modifications.(4)A government agency holding records of an at-risk government employee classified as private under this section may release the record or part of the record if:(a)the employee or former employee gives written consent;(b)a court orders release of the records; (c)the government agency receives a certified death certificate for the employee or former employee; or(d)as it relates to the employee's voter registration record:(i)the person to whom the record or part of the record is released is a qualified person under Subsection 20A-2-104(4)(n); and(ii)the government agency's release of the record or part of the record complies with the requirements of Subsection 20A-2-104(4)(o).(5)(a)If the government agency holding the private record receives a subpoena for the records, the government agency shall attempt to notify the at-risk government employee or former employee by mailing a copy of the subpoena to the employee's last-known mailing address together with a request that the employee either:(i)authorize release of the record; or(ii)within 10 days of the date that the copy and request are mailed, deliver to the government agency holding the private record a copy of a motion to quash filed with the court who issued the subpoena.(b)The government agency shall comply with the subpoena if the government agency has:(i)received permission from the at-risk government employee or former employee to comply with the subpoena;(ii)not received a copy of a motion to quash within 10 days of the date that the copy of the subpoena was mailed; or(iii)received a court order requiring release of the records.(6)(a)Except as provided in Subsection (6)(b), a form submitted under this section remains in effect until the earlier of:(i)four years after the date the employee signs the form, whether or not the employee's employment terminates before the end of the four-year period; and(ii)one year after the government agency receives official notice of the death of the employee.(b)A form submitted under this section may be rescinded at any time by:(i)the at-risk government employee who submitted the form; or(ii)if the at-risk government employee is deceased, a member of the employee's immediate family.

Section 20. Section 63A-19-501 is amended to read:63A-19-501. Data privacy ombudsperson.(1)The governor shall appoint a data privacy ombudsperson with the advice of the governing board.There is created within the office the position of data privacy ombudsperson.(2)The governor shall appoint the ombudsperson with the advice of the governing board.(2)(3)The ombudsperson shall:(a)be an attorney in good standing and authorized to practice law in this state;(b)be familiar with the provisions of:(i)this chapter;(ii)Chapter 12, Division of Archives and Records Service and Management of Government Records; and(iii)Title 63G, Chapter 2, Government Records Access and Management Act; and(b)(c)serve as a resource for:(i)an individual who is making or responding to a complaint about a governmental entity's data privacy practicea data privacy complaint; and(ii)a governmental entity whichthat is the subject of a data privacy complaint.(3)(4)The ombudsperson may,: (a)(i)upon request by a governmental entity or individual, mediate data privacy disputes between individuals and governmental entitiesa dispute between the governmental entity and the individual regarding the individual's data privacy complaint; and(ii)upon resolution of a data privacy complaint described in Subsection (4)(a)(i), post on the office's website a brief summary of the data privacy complaint and the resolution of the matter; and(b)provide data privacy education and training in accordance with Subsection 63A-19-301(3)(g).(5)The ombudsperson may not:(a)mediate a dispute between a governmental entity and an individual if the individual's data privacy complaint is within the authority of:(i)the Government Records Office created in Section 63A-12-202; or(ii)the government records ombudsman established in Section 63A-12-204;(b)expand the scope of a mediation beyond the individual's data privacy complaint;(c)testify, or be compelled to testify, regarding a matter for which the ombudsperson provides services under this section; or(d)conduct an audit of a governmental entity's privacy practices.(4)(6)After consultation with the chief privacy officer, the ombudsperson may raise issuesmatters and questions beforeto the governing board regarding serious and repeated violations of data privacy from:.(a)a specific governmental entity; or(b)widespread governmental entity data privacy practices.(5)When a data privacy complaint has been resolved, the ombudsperson shall post on the office's website a summary of the complaint and the resolution of the matter.

Section 21. Section 63A-19-502 is enacted to read:63A-19-502. Data privacy complaint process.(1)An individual who makes a data privacy complaint shall first submit the complaint to the chief administrative officer of the governmental entity that is the subject of the complaint.(2)Upon receipt of a data privacy complaint under Subsection (1), the chief administrative officer shall attempt to resolve the complaint with the individual.(3)If the chief administrative officer is unable to resolve a data privacy complaint with the individual under Subsection (2), the individual or the governmental entity may request mediation with the ombudsperson in accordance with Section 63A-19-501.(4)If an individual submits a data privacy complaint directly to the ombudsperson, the ombudsperson shall:(a)notify the individual and the governmental entity that the complaint will be referred to the chief administrative officer of the governmental entity; and(b)refer the complaint to the chief administrative officer.(5)This section does not apply to a complaint about data privacy that is within the authority of:(a)the Government Records Office created in Section 63A-12-202; or(b)the government records ombudsman established in Section 63A-12-204.

Section 22. Section 63G-2-201 is amended to read:63G-2-201. Provisions relating to records -- Public records -- Private, controlled, protected, and other restricted records -- Disclosure and nondisclosure of records -- Certified copy of record -- Limits on obligation to respond to record request.(1)(a)Except as provided in Subsection (1)(b), a person has the right to inspect a public record free of charge, and the right to take a copy of a public record during normal working hours, subject to Sections 63G-2-203 and 63G-2-204.(b)A right under Subsection (1)(a) does not apply with respect to a record:(i)a copy of which the governmental entity has already provided to the person;(ii)that is the subject of a records request that the governmental entity is not required to fill under Subsection (7)(a)(v); or(iii)(A)that is accessible only by a computer or other electronic device owned or controlled by the governmental entity;(B)that is part of an electronic file that also contains a record that is private, controlled, or protected; and(C)that the governmental entity cannot readily segregate from the part of the electronic file that contains a private, controlled, or protected record.(2)A record is public unless otherwise expressly provided by statute.(3)The following records are not public:(a)a record that is private, controlled, or protected under Sections 63G-2-302, 63G-2-30363A-19-408, 63G-2-304, and 63G-2-305; and(b)a record to which access is restricted pursuant to court rule, another state statute, federal statute, or federal regulation, including records for which access is governed or restricted as a condition of participation in a state or federal program or for receiving state or federal funds.(4)Only a record specified in Section 63G-2-302, 63G-2-30363A-19-408, 63G-2-304, or 63G-2-305 may be classified private, controlled, or protected.(5)(a)A governmental entity may not disclose a record that is private, controlled, or protected to any person except as provided in Subsection (5)(b), Subsection (5)(c), Section 63G-2-202, 63G-2-206, or 63G-2-30363A-19-408.(b)A governmental entity may disclose a record that is private under Subsection 63G-2-302(2) or protected under Section 63G-2-305 to persons other than those specified in Section 63G-2-202 or 63G-2-206 if the head of a governmental entity, or a designee, determines that:(i)there is no interest in restricting access to the record; or(ii)the interests favoring access are greater than or equal to the interest favoring restriction of access.(c)In addition to the disclosure under Subsection (5)(b), a governmental entity may disclose a record that is protected under Subsection 63G-2-305(51) if:(i)the head of the governmental entity, or a designee, determines that the disclosure:(A)is mutually beneficial to:(I)the subject of the record;(II)the governmental entity; and(III)the public; and(B)serves a public purpose related to:(I)public safety; or(II)consumer protection; and(ii)the person who receives the record from the governmental entity agrees not to use or allow the use of the record for advertising or solicitation purposes.(6)A governmental entity shall provide a person with a certified copy of a record if:(a)the person requesting the record has a right to inspect it;(b)the person identifies the record with reasonable specificity; and(c)the person pays the lawful fees.(7)(a)In response to a request, a governmental entity is not required to:(i)create a record;(ii)compile, format, manipulate, package, summarize, or tailor information;(iii)provide a record in a particular format, medium, or program not currently maintained by the governmental entity;(iv)fulfill a person's records request if the request unreasonably duplicates prior records requests from that person;(v)fill a person's records request if:(A)the record requested is:(I)publicly accessible online; or(II)included in a public publication or product produced by the governmental entity receiving the request; and(B)the governmental entity:(I)specifies to the person requesting the record where the record is accessible online; or(II)provides the person requesting the record with the public publication or product and specifies where the record can be found in the public publication or product; or(vi)fulfill a person's records request if:(A)the person has been determined under Section 63G-2-209 to be a vexatious requester;(B)the order of the director of the Government Records Office determining the person to be a vexatious requester provides that the governmental entity is not required to fulfill a request from the person for a period of time; and(C)the period of time described in Subsection (7)(a)(vi)(B) has not expired.(b)A governmental entity shall conduct a reasonable search for a requested record.(8)(a)Although not required to do so, a governmental entity may, upon request from the person who submitted the records request, compile, format, manipulate, package, summarize, or tailor information or provide a record in a format, medium, or program not currently maintained by the governmental entity.(b)In determining whether to fulfill a request described in Subsection (8)(a), a governmental entity may consider whether the governmental entity is able to fulfill the request without unreasonably interfering with the governmental entity's duties and responsibilities.(c)A governmental entity may require a person who makes a request under Subsection (8)(a) to pay the governmental entity, in accordance with Section 63G-2-203, for providing the information or record as requested.(9)(a)Notwithstanding any other provision of this chapter, and subject to Subsection (9)(b), a governmental entity is not required to respond to, or provide a record in response to, a record request if the request is submitted by or in behalf of an individual who is on parole or confined in a jail or other correctional facility following the individual's conviction.(b)Subsection (9)(a) does not apply to:(i)the first five record requests submitted to the governmental entity by or in behalf of an individual described in Subsection (9)(a) during any calendar year requesting only a record that contains a specific reference to the individual; or(ii)a record request that is submitted by an attorney of an individual described in Subsection (9)(a).(10)(a)A governmental entity may allow a person requesting more than 50 pages of records to copy the records if:(i)the records are contained in files that do not contain records that are exempt from disclosure, or the records may be segregated to remove private, protected, or controlled information from disclosure; and(ii)the governmental entity provides reasonable safeguards to protect the public from the potential for loss of a public record.(b)If the requirements of Subsection (10)(a) are met, the governmental entity may:(i)provide the requester with the facilities for copying the requested records and require that the requester make the copies; or(ii)allow the requester to provide the requester's own copying facilities and personnel to make the copies at the governmental entity's offices and waive the fees for copying the records.(11)(a)A governmental entity that owns an intellectual property right and that offers the intellectual property right for sale or license may control by ordinance or policy the duplication and distribution of the material based on terms the governmental entity considers to be in the public interest.(b)Nothing in this chapter shall be construed to limit or impair the rights or protections granted to the governmental entity under federal copyright or patent law as a result of its ownership of the intellectual property right.(12)A governmental entity may not use the physical form, electronic or otherwise, in which a record is stored to deny, or unreasonably hinder the rights of a person to inspect and receive a copy of a record under this chapter.(13)Subject to the requirements of Subsection (7), a governmental entity shall provide access to an electronic copy of a record in lieu of providing access to its paper equivalent if:(a)the person making the request requests or states a preference for an electronic copy;(b)the governmental entity currently maintains the record in an electronic format that is reproducible and may be provided without reformatting or conversion; and(c)the electronic copy of the record:(i)does not disclose other records that are exempt from disclosure; or(ii)may be segregated to protect private, protected, or controlled information from disclosure without the undue expenditure of public resources or funds.(14)In determining whether a record is properly classified as private under Subsection 63G-2-302(2)(d), the governmental entity, the director of the Government Records Office, local appeals board, or court shall consider and weigh:(a)any personal privacy interests, including those in images, that would be affected by disclosure of the records in question; and(b)any public interests served by disclosure.

Section 23. Section 63G-2-301 is amended to read:63G-2-301. Public records.(1)As used in this section:(a)"Business address" means a single address of a governmental agency designated for the public to contact an employee or officer of the governmental agency.(b)"Business email address" means a single email address of a governmental agency designated for the public to contact an employee or officer of the governmental agency.(c)"Business telephone number" means a single telephone number of a governmental agency designated for the public to contact an employee or officer of the governmental agency.(d)"Correctional facility" means the same as that term is defined in Section 77-16b-102.(2)The following records are public except to the extent they contain information expressly permitted to be treated confidentially under the provisions of Subsections 63G-2-201(3)(b) and (6)(a):(a)laws;(b)the name, gender, gross compensation, job title, job description, business address, business email address, business telephone number, number of hours worked per pay period, dates of employment, and relevant education, previous employment, and similar job qualifications of a current or former employee or officer of the governmental entity, excluding:(i)undercover law enforcement personnel; and(ii)investigative personnel if disclosure could reasonably be expected to impair the effectiveness of investigations or endanger any individual's safety;(c)final opinions, including concurring and dissenting opinions, and orders that are made by a governmental entity in an administrative, adjudicative, or judicial proceeding except that if the proceedings were properly closed to the public, the opinion and order may be withheld to the extent that they contain information that is private, controlled, or protected;(d)final interpretations of statutes or rules by a governmental entity unless classified as protected as provided in Subsection 63G-2-305(17) or (18);(e)information contained in or compiled from a transcript, minutes, or report of the open portions of a meeting of a governmental entity as provided by Title 52, Chapter 4, Open and Public Meetings Act, including the records of all votes of each member of the governmental entity;(f)judicial records unless a court orders the records to be restricted under the rules of civil or criminal procedure or unless the records are private under this chapter;(g)unless otherwise classified as private under Section 63G-2-30363A-19-408, records or parts of records filed with or maintained by county recorders, clerks, treasurers, surveyors, zoning commissions, the Division of Forestry, Fire, and State Lands, the School and Institutional Trust Lands Administration, the Division of Oil, Gas, and Mining, the Division of Water Rights, or other governmental entities that give public notice of:(i)titles or encumbrances to real property;(ii)restrictions on the use of real property;(iii)the capacity of persons to take or convey title to real property; or(iv)tax status for real and personal property;(h)records of the Department of Commerce that evidence incorporations, mergers, name changes, and uniform commercial code filings;(i)data on individuals that would otherwise be private under this chapter if the individual who is the subject of the record has given the governmental entity written permission to make the records available to the public;(j)documentation of the compensation that a governmental entity pays to a contractor or private provider;(k)summary data;(l)voter registration records, including an individual's voting history, except for a voter registration record or those parts of a voter registration record that are classified as private under Subsections 63G-2-302(1)(j) through (n) or withheld under Subsection 20A-2-104(7);(m)for an elected official, as defined in Section 11-47-102, a telephone number, if available, and email address, if available, where that elected official may be reached as required in Title 11, Chapter 47, Access to Elected Officials;(n)for a school community council member, a telephone number, if available, and email address, if available, where that elected official may be reached directly as required in Section 53G-7-1203;(o)annual audited financial statements of the Utah Educational Savings Plan described in Section 53H-10-210; and(p)an initiative packet, as defined in Section 20A-7-101, and a referendum packet, as defined in Section 20A-7-101, after the packet is submitted to a county clerk.(3)The following records are normally public, but to the extent that a record is expressly exempt from disclosure, access may be restricted under Subsection 63G-2-201(3)(b), Section 63G-2-302, 63G-2-304, or 63G-2-305:(a)administrative staff manuals, instructions to staff, and statements of policy;(b)records documenting a contractor's or private provider's compliance with the terms of a contract with a governmental entity;(c)records documenting the services provided by a contractor or a private provider to the extent the records would be public if prepared by the governmental entity;(d)contracts entered into by a governmental entity;(e)any account, voucher, or contract that deals with the receipt or expenditure of funds by a governmental entity;(f)records relating to government assistance or incentives publicly disclosed, contracted for, or given by a governmental entity, encouraging a person to expand or relocate a business in Utah, except as provided in Subsection 63G-2-305(35);(g)chronological logs and initial contact reports;(h)correspondence by and with a governmental entity in which the governmental entity determines or states an opinion upon the rights of the state, a political subdivision, the public, or any person;(i)empirical data contained in drafts if:(i)the empirical data is not reasonably available to the requester elsewhere in similar form; and(ii)the governmental entity is given a reasonable opportunity to correct any errors or make nonsubstantive changes before release;(j)drafts that are circulated to anyone other than:(i)a governmental entity;(ii)a political subdivision;(iii)a federal agency if the governmental entity and the federal agency are jointly responsible for implementation of a program or project that has been legislatively approved;(iv)a government-managed corporation; or(v)a contractor or private provider;(k)drafts that have never been finalized but were relied upon by the governmental entity in carrying out action or policy;(l)original data in a computer program if the governmental entity chooses not to disclose the program;(m)arrest warrants after issuance, except that, for good cause, a court may order restricted access to arrest warrants prior to service;(n)search warrants after execution and filing of the return, except that a court, for good cause, may order restricted access to search warrants prior to trial;(o)records that would disclose information relating to formal charges or disciplinary actions against a past or present governmental entity employee if:(i)the disciplinary action has been completed and all time periods for administrative appeal have expired; and(ii)the charges on which the disciplinary action was based were sustained;(p)records maintained by the Division of Forestry, Fire, and State Lands, the School and Institutional Trust Lands Administration, or the Division of Oil, Gas, and Mining that evidence mineral production on government lands;(q)final audit reports;(r)occupational and professional licenses;(s)business licenses;(t)a notice of violation, a notice of agency action under Section 63G-4-201, or similar records used to initiate proceedings for discipline or sanctions against persons regulated by a governmental entity, but not including records that initiate employee discipline; and(u)(i)records that disclose a standard, regulation, policy, guideline, or rule regarding the operation of a correctional facility or the care and control of inmates committed to the custody of a correctional facility; and(ii)records that disclose the results of an audit or other inspection assessing a correctional facility's compliance with a standard, regulation, policy, guideline, or rule described in Subsection (3)(u)(i).(4)The list of public records in this section is not exhaustive and should not be used to limit access to records.

Section 24. Section 63G-2-302 is amended to read:63G-2-302. Private records.(1)The following records are private:(a)records concerning an individual's eligibility for unemployment insurance benefits, social services, welfare benefits, or the determination of benefit levels;(b)records containing data on individuals describing medical history, diagnosis, condition, treatment, evaluation, or similar medical data;(c)records of publicly funded libraries that when examined alone or with other records identify a patron;(d)records received by or generated by or for:(i)the Independent Legislative Ethics Commission, except for:(A)the commission's summary data report that is required under legislative rule; and(B)any other document that is classified as public under legislative rule; or(ii)a Senate or House Ethics Committee in relation to the review of ethics complaints, unless the record is classified as public under legislative rule;(e)records received by, or generated by or for, the Independent Executive Branch Ethics Commission, except as otherwise expressly provided in Title 63A, Chapter 14, Review of Executive Branch Ethics Complaints;(f)records received or generated for a Senate confirmation committee concerning character, professional competence, or physical or mental health of an individual:(i)if, prior to the meeting, the chair of the committee determines release of the records:(A)reasonably could be expected to interfere with the investigation undertaken by the committee; or(B)would create a danger of depriving a person of a right to a fair proceeding or impartial hearing; and(ii)after the meeting, if the meeting was closed to the public;(g)employment records concerning a current or former employee of, or applicant for employment with, a governmental entity that would disclose that individual's home address, home telephone number, social security number, insurance coverage, marital status, or payroll deductions;(h)records or parts of records under Section 63G-2-30363A-19-408 that a current or former employee identifies as private according to the requirements of that section;(i)that part of a record indicating a person's social security number or federal employer identification number if provided under Section 31A-23a-104, 31A-25-202, 31A-26-202, 58-1-301, 58-55-302, 61-1-4, or 61-2f-203;(j)that part of a voter registration record identifying a voter's:(i)driver license or identification card number;(ii)social security number, or last four digits of the social security number;(iii)email address;(iv)date of birth; or(v)phone number;(k)a voter registration record that is classified as a private record by the lieutenant governor or a county clerk under Subsection 20A-2-101.1(5)(a), 20A-2-104(4)(h), or 20A-2-204(4)(b);(l)a voter registration record that is withheld under Subsection 20A-2-104(7);(m)a withholding request form described in Subsections 20A-2-104(7) and (8) and any verification submitted in support of the form;(n)a record or information regarding whether a voter returned a ballot with postage attached;(o)a record that:(i)contains information about an individual;(ii)is voluntarily provided by the individual; and(iii)goes into an electronic database that:(A)is designated by and administered under the authority of the Chief Information Officerchief information officer; and(B)acts as a repository of information about the individual that can be electronically retrieved and used to facilitate the individual's online interaction with a state agency;(p)information provided to the Commissioner of Insurancecommissioner of insurance under:(i)Subsection 31A-23a-115(3)(a);(ii)Subsection 31A-23a-302(4); or(iii)Subsection 31A-26-210(4);(q)information obtained through a criminal background check under Title 11, Chapter 40, Criminal Background Checks by Political Subdivisions Operating Water Systems;(r)information provided by an offender that is:(i)required by the registration requirements of Title 53, Chapter 29, Sex, Kidnap, and Child Abuse Offender Registry; and(ii)not required to be made available to the public under Subsection 53-29-404(3)(a);(s)a statement and any supporting documentation filed with the attorney general in accordance with Section 34-45-107, if the federal law or action supporting the filing involves homeland security;(t)electronic toll collection customer account information received or collected under Section 72-6-118 and customer information described in Section 17B-2a-815 received or collected by a public transit district, including contact and payment information and customer travel data;(u)an email address provided by a military or overseas voter under Section 20A-16-501;(v)a completed military-overseas ballot that is electronically transmitted under Title 20A, Chapter 16, Uniform Military and Overseas Voters Act;(w)records received by or generated by or for the Political Subdivisions Ethics Review Commission established in Section 63A-15-201, except for:(i)the commission's summary data report that is required in Section 63A-15-202; and(ii)any other document that is classified as public in accordance with Title 63A, Chapter 15, Political Subdivisions Ethics Review Commission;(x)a record described in Section 53G-9-604 that verifies that a parent was notified of an incident or threat;(y)a criminal background check or credit history report conducted in accordance with Section 63A-3-201;(z)a record described in Subsection 53-5a-104(7);(aa)on a record maintained by a county for the purpose of administering property taxes, an individual's:(i)email address;(ii)phone number; or(iii)personal financial information related to a person's payment method;(bb)a record submitted by a taxpayer to establish the taxpayer's eligibility for an exemption, deferral, abatement, or relief under:(i)Title 59, Chapter 2, Part 11, Exemptions; or(ii)Title 59, Chapter 2a, Tax Relief Through Property Tax;(cc)a record provided by the State Tax Commission in response to a request under Subsection 59-1-403(4)(y)(iii);(dd)a record of the Child Welfare Legislative Oversight Panel regarding an individual child welfare case, as described in Subsection 36-33-103(3);(ee)a record relating to drug or alcohol testing of a state employee under Section 63A-17-1004;(ff)a record relating to a request by a state elected official or state employee who has been threatened to the Division of Technology Services to remove personal identifying information from the open web under Section 63A-16-109;(gg)a record including confidential information as that term is defined in Section 67-27-106; and(hh)a record or notice received or generated under Title 53, Chapter 30, Security Improvements Act, relating to:(i)an application for certification described in Section 53-30-201; or(ii)a security improvement, including a building permit application or building permit for a security improvement described in Section 53-30-301.(2)The following records are private if properly classified by a governmental entity:(a)records concerning a current or former employee of, or applicant for employment with a governmental entity, including performance evaluations and personal status information such as race, religion, or disabilities, but not including records that are public under Subsection 63G-2-301(2)(b) or 63G-2-301(3)(o) or private under Subsection (1)(b);(b)records describing an individual's finances, except that the following are public:(i)records described in Subsection 63G-2-301(2);(ii)information provided to the governmental entity for the purpose of complying with a financial assurance requirement; or(iii)records that must be disclosed in accordance with another statute;(c)records of independent state agencies if the disclosure of those records would conflict with the fiduciary obligations of the agency;(d)other records containing data on individuals the disclosure of which constitutes a clearly unwarranted invasion of personal privacy;(e)records provided by the United States or by a government entity outside the state that are given with the requirement that the records be managed as private records, if the providing entity states in writing that the record would not be subject to public disclosure if retained by it;(f)any portion of a record in the custody of the Division of Aging and Adult Services, created in Section 26B-6-102, that may disclose, or lead to the discovery of, the identity of a person who made a report of alleged abuse, neglect, or exploitation of a vulnerable adult; and(g)audio and video recordings created by a body-worn camera, as defined in Section 77-7a-103, that record sound or images inside a home or residence except for recordings that:(i)depict the commission of an alleged crime;(ii)record any encounter between a law enforcement officer and a person that results in death or bodily injury, or includes an instance when an officer fires a weapon;(iii)record any encounter that is the subject of a complaint or a legal proceeding against a law enforcement officer or law enforcement agency;(iv)contain an officer-involved critical incident as defined in Subsection 76-2-408(1)(f); or(v)have been requested for reclassification as a public record by a subject or authorized agent of a subject featured in the recording.(3)(a)As used in this Subsection (3), "medical records" means medical reports, records, statements, history, diagnosis, condition, treatment, and evaluation.(b)Medical records in the possession of the University of Utah Hospital, its clinics, doctors, or affiliated entities are not private records or controlled records under Section 63G-2-304 when the records are sought:(i)in connection with any legal or administrative proceeding in which the patient's physical, mental, or emotional condition is an element of any claim or defense; or(ii)after a patient's death, in any legal or administrative proceeding in which any party relies upon the condition as an element of the claim or defense.(c)Medical records are subject to production in a legal or administrative proceeding according to state or federal statutes or rules of procedure and evidence as if the medical records were in the possession of a nongovernmental medical care provider.

Section 25. Section 63G-2-601 is amended to read:63G-2-601. Rights of individuals on whom data is maintained -- Classification statement filed with state archivist -- Notice to provider of information.(1)(a)Each governmental entity shall file with the state archivist a statement explaining, for each record series collected, maintained, or used by the governmental entity, the purposes for which each private or controlled record in the record series is collected, maintained, or used by that governmental entity.(b)The statement filed under Subsection (1)(a):(i)shall identify the authority under which the governmental entity collects the records or information included in the statement described in Subsection (1)(a); and(ii)is a public record.(2)A governmental entity may only use the information contained in a controlled or private record for:(a)the purposes described in the statement provided under Subsection (1); or(b)the purposes for which another governmental entity may use the record under Section 63G-2-206.(2)(a)A governmental entity shall provide the notice described in this Subsection (2) to a person that is asked to furnish information that could be classified as a private or controlled record.(b)The notice required under Subsection (2)(a) shall:(i)identify the record series that includes the information described in Subsection (2)(a);(ii)state the reasons the person is asked to furnish the information;(iii)state the intended uses of the information;(iv)state the consequences for refusing to provide the information; and(v)disclose the classes of persons and the governmental entities that currently:(A)share the information with the governmental entity; or(B)receive the information from the governmental entity on a regular or contractual basis.(c)The governmental entity shall:(i)post the notice required under this Subsection (2) in a prominent place at all locations where the governmental entity collects the information; or(ii)include the notice required under this Subsection (2) as part of the documents or forms that are used by the governmental entity to collect the information.(3)Upon request, each governmental entity shall, in relation to the information described in Subsection (2)(a), as applicable, explain to a person:(a)the reasons the person is asked to furnish information;(b)the intended uses of the information;(c)the consequences for refusing to provide the information; and(d)the reasons and circumstances under which the information may be shared with, or provided to, other persons or governmental entities.(4)A governmental entity may use the information that the governmental entity is required to disclose under Subsection (2)(a) only for those purposes:(a)given in the statement filed with the state archivist under Subsection (1); or(b)for which another governmental entity may use the record under Section 63G-2-206.

Section 26. Section 63G-2-803 is amended to read:63G-2-803. No individual liability for certain decisions of a governmental entity.(1)Neither the governmental entity, nor any officer or employee of the governmental entity, is liable for damages resulting from the release of a record where the person or government requesting the record presented evidence of authority to obtain the record even if it is subsequently determined that the requester had no authority.(2)Neither the governmental entity, nor any officer or employee of the governmental entity, is liable for damages arising from the negligent disclosure of records classified as private under Subsection 63G-2-302(1)(g) unless:(a)the disclosure was of employment records maintained by the governmental entity; or(b)the current or former government employee had previously filed the notice required by Section 63G-2-30363A-19-408 and:(i)the government entity did not take reasonable steps to preclude access or distribution of the record; or(ii)the release of the record was otherwise willfully or grossly negligent.(3)A mailing from a government agency to an individual who has filed an application under Section 63G-2-30363A-19-408 is not a wrongful disclosure under this chapter or under Title 63A, Chapter 12, Division of Archives and Records Service and Management of Government Records.

Section 27. Section 67-1a-15 is amended to read:67-1a-15. Local government and limited purpose entity registry.(1)As used in this section:(a)"Entity" means a limited purpose entity or a local government entity.(b)(i)"Limited purpose entity" means a legal entity that:(A)performs a single governmental function or limited governmental functions; and(B)is not a state executive branch agency, a state legislative office, or within the judicial branch.(ii)"Limited purpose entity" includes:(A)area agencies, area agencies on aging, and area agencies on high risk adults, as those terms are defined in Section 26B-6-101;(B)charter schools created under Title 53G, Chapter 5, Charter Schools;(C)community reinvestment agencies, as that term is defined in Section 17C-1-102;(D)conservation districts, as that term is defined in Section 17D-3-102;(E)governmental nonprofit corporations, as that term is defined in Section 11-13a-102;(F)housing authorities, as that term is defined in Section 35A-8-401;(G)independent entities and independent state agencies, as those terms are defined in Section 63E-1-102;(H)interlocal entities, as that term is defined in Section 11-13-103;(I)local building authorities, as that term is defined in Section 17D-2-102;(J)special districts, as that term is defined in Section 17B-1-102;(K)local health departments, as that term is defined in Section 26A-1-102;(L)local mental health authorities, as that term is defined in Section 62A-15-102;(M)nonprofit corporations that receive an amount of money requiring an accounting report under Section 51-2a-201.5;(N)school districts under Title 53G, Chapter 3, School District Creation and Change;(O)special service districts, as that term is defined in Section 17D-1-102; and(P)substance abuse authorities, as that term is defined in Section 62A-15-102.(c)"Local government and limited purpose entity registry" or "registry" means the registry of local government entities and limited purpose entities created under this section.(d)"Local government entity" means:(i)a county, as that term is defined in Section 17-60-101; and(ii)a municipality, as that term is defined in Section 10-1-104.(e)"Notice of failure to register" means the notice the lieutenant governor sends, in accordance with Subsection (7)(a), to an entity that does not register.(f)"Notice of failure to renew" means the notice the lieutenant governor sends to a registered entity, in accordance with Subsection (7)(b).(g)"Notice of noncompliance" means the notice the lieutenant governor sends to a registered entity, in accordance with Subsection (6)(c).(h)"Notice of non-registration" means the notice the lieutenant governor sends to an entity and the state auditor, in accordance with Subsection (9).(i)"Notice of registration or renewal" means the notice the lieutenant governor sends, in accordance with Subsection (6)(b)(i).(j)"Registered entity" means an entity with a valid registration as described in Subsection (8).(2)The lieutenant governor shall:(a)create a registry of each local government entity and limited purpose entity within the state that:(i)contains the information described in Subsection (4); and(ii)is accessible on the lieutenant governor's website or otherwise publicly available; and(b)establish fees for registration and renewal, in accordance with Section 63J-1-504, based on and to directly offset the cost of creating, administering, and maintaining the registry.(3)Each local government entity and limited purpose entity shall:(a)on or before July 1, 2019, register with the lieutenant governor as described in Subsection (4);(b)on or before one year after the day on which the lieutenant governor issues the notice of registration or renewal, annually renew the entity's registration in accordance with Subsection (5); and(c)on or before 30 days after the day on which any of the information described in Subsection (4) changes, send notice of the changes to the lieutenant governor.(4)Each entity shall include the following information in the entity's registration submission:(a)the resolution or other legal or formal document creating the entity or, if the resolution or other legal or formal document creating the entity cannot be located, conclusive proof of the entity's lawful creation;(b)if the entity has geographic boundaries, a map or plat identifying the current geographic boundaries of the entity, or if it is impossible or unreasonably expensive to create a map or plat, a metes and bounds description, or another legal description that identifies the current boundaries of the entity;(c)the entity's name;(d)the entity's type of local government entity or limited purpose entity;(e)the entity's governmental function;(f)the entity's website, physical address, and phone number, including the name and contact information of an individual whom the entity designates as the primary contact for the entity;(g)(i)names, email addresses, and phone numbers of the members of the entity's governing board or commission, managing officers, or other similar managers and the method by which the members or officers are appointed, elected, or otherwise designated;(ii)the date of the most recent appointment or election of each entity governing board or commission member; and(iii)the date of the anticipated end of each entity governing board or commission member's term;(h)the entity's sources of revenue; and(i)if the entity has created an assessment area, as that term is defined in Section 11-42-102, information regarding the creation, purpose, and boundaries of the assessment area.(5)Each entity shall include the following information in the entity's renewal submission:(a)identify and update any incorrect or outdated information the entity previously submitted during registration under Subsection (4); or(b)certify that the information the entity previously submitted during registration under Subsection (4) is correct without change.(6)Within 30 days of receiving an entity's registration or renewal submission, the lieutenant governor shall:(a)review the submission to determine compliance with Subsection (4) or (5);(b)if the lieutenant governor determines that the entity's submission complies with Subsection (4) or (5):(i)send a notice of registration or renewal that includes the information that the entity submitted under Subsection (4) or (5) to:(A)the registering or renewing entity;(B)each county in which the entity operates, either in whole or in part, or where the entity's geographic boundaries overlap or are contained within the boundaries of the county;(C)the Division of Archives and Records Service; and(D)the Office of the Utah State Auditor; and(ii)publish the information from the submission on the registry, except any email address or phone number that is personal information as defined in Section 63G-2-30363A-19-408; and(c)if the lieutenant governor determines that the entity's submission does not comply with Subsection (4) or (5) or is otherwise inaccurate or deficient, send a notice of noncompliance to the registering or renewing entity that:(i)identifies each deficiency in the entity's submission with the corresponding statutory requirement;(ii)establishes a deadline to cure the entity's noncompliance that is the first business day that is at least 30 calendar days after the day on which the lieutenant governor sends the notice of noncompliance; and(iii)states that failure to comply by the deadline the lieutenant governor establishes under Subsection (6)(c)(ii) will result in the lieutenant governor sending a notice of non-registration to the Office of the Utah State Auditor, in accordance with Subsection (9).(7)(a)If the lieutenant governor identifies an entity that does not make a registration submission in accordance with Subsection (4) by the deadline described in Subsection (3), the lieutenant governor shall send a notice of failure to register to the registered entity that:(i)identifies the statutorily required registration deadline described in Subsection (3) that the entity did not meet;(ii)establishes a deadline to cure the entity's failure to register that is the first business day that is at least 10 calendar days after the day on which the lieutenant governor sends the notice of failure to register; and(iii)states that failure to comply by the deadline the lieutenant governor establishes under Subsection (7)(a)(ii) will result in the lieutenant governor sending a notice of non-registration to the Office of the Utah State Auditor, in accordance with Subsection (9).(b)If a registered entity does not make a renewal submission in accordance with Subsection (5) by the deadline described in Subsection (3), the lieutenant governor shall send a notice of failure to renew to the registered entity that:(i)identifies the renewal deadline described in Subsection (3) that the entity did not meet;(ii)establishes a deadline to cure the entity's failure to renew that is the first business day that is at least 30 calendar days after the day on which the lieutenant governor sends the notice of failure to renew; and(iii)states that failure to comply by the deadline the lieutenant governor establishes under Subsection (7)(b)(ii) will result in the lieutenant governor sending a notice of non-registration to the Office of the Utah State Auditor, in accordance with Subsection (9).(8)An entity's registration is valid:(a)if the entity makes a registration or renewal submission in accordance with the deadlines described in Subsection (3);(b)during the period the lieutenant governor establishes in the notice of noncompliance or notice of failure to renew during which the entity may cure the identified registration deficiencies; and(c)for one year beginning on the day the lieutenant governor issues the notice of registration or renewal.(9)(a)The lieutenant governor shall send a notice of non-registration to the Office of the Utah State Auditor if an entity fails to:(i)cure the entity's noncompliance by the deadline the lieutenant governor establishes in the notice of noncompliance;(ii)register by the deadline the lieutenant governor establishes in the notice of failure to register; or(iii)cure the entity's failure to renew by the deadline the lieutenant governor establishes in the notice of failure to renew.(b)The lieutenant governor shall ensure that the notice of non-registration:(i)includes a copy of the notice of noncompliance, the notice of failure to register, or the notice of failure to renew; and(ii)requests that the state auditor withhold state allocated funds or the disbursement of property taxes and prohibit the entity from accessing money held by the state or money held in an account of a financial institution, in accordance with Subsections 67-3-1(7)(i) and 67-3-1(10).(10)The lieutenant governor may extend a deadline under this section if an entity notifies the lieutenant governor, before the deadline to be extended, of the existence of an extenuating circumstance that is outside the control of the entity.(11)(a)An entity is not required to renew submission of a registration under this section if an entity provides a record of dissolution.(b)The lieutenant governor shall include in the registry an entity's record of dissolution and indicate on the registry that the entity is dissolved.

Section 28. Effective Date.This bill takes effect on May 6, 2026.

2-17-26 10:15 AM