Download Zipped Amended WP 9 HB0040S1.ZIP
[Introduced][Status][Bill Documents][Fiscal Note][Bills Directory]

First Substitute H.B. 40

This document includes Senate Committee Amendments incorporated into the bill on Mon, Feb 17, 2003 at 11:18 AM by rday. --> This document includes Senate 3rd Reading Floor Amendments incorporated into the bill on Fri, Feb 21, 2003 at 11:44 AM by rday. -->

Representative Douglas C. Aagard proposes the following substitute bill:


             1     
NOTICE OF INTENT TO SELL NONPUBLIC

             2     
PERSONAL INFORMATION

             3     
2003 GENERAL SESSION

             4     
STATE OF UTAH

             5     
Sponsor: Douglas C. Aagard

             6      This act modifies the Commerce and Trade title to enact the Notice of Intent to Sell
             7      Nonpublic Personal Information Act. This act defines terms, requires a notice be given
             8      by a commercial entity under certain circumstances, and establishes the liability of a
             9      commercial entity for violating the act. h THIS ACT TAKES EFFECT ON JANUARY 1, 2004. h
             10      This act affects sections of Utah Code Annotated 1953 as follows:
             11      ENACTS:
             12          13-37-101, Utah Code Annotated 1953
             13          13-37-102, Utah Code Annotated 1953
             14          13-37-201, Utah Code Annotated 1953
             15          13-37-202, Utah Code Annotated 1953
             16          13-37-203, Utah Code Annotated 1953
             17      Be it enacted by the Legislature of the state of Utah:
             18          Section 1. Section 13-37-101 is enacted to read:
             19     
CHAPTER 37. NOTICE OF INTENT TO SELL NONPUBLIC

             20     
PERSONAL INFORMATION ACT

             21     
Part 1. General Provisions

             22          13-37-101. Title.
             23          This chapter is known as the "Notice of Intent to Sell Nonpublic Personal Information
             24      Act."
             25          Section 2. Section 13-37-102 is enacted to read:



             26          13-37-102. Definitions.
             27          As used in this chapter:
             28          (1) "Affiliate" means a person that controls, is controlled by, or is under common
             29      control with:
             30          (a) a commercial entity; and
             31          (b) (i) directly; or
             32          (ii) indirectly through one or more intermediaries.
             33          (2) (a) Subject to Subsection (2)(b), "commercial entity" means a person that h :
             33a          (i) HAS AN OFFICE OR OTHER PLACE OF BUSINESS LOCATED IN THE STATE; AND
             33b          (ii) h in the
             34      ordinary course of business transacts a consumer transaction in this state.
             35          (b) "Commercial entity" does not include:
             36          (i) a governmental entity; or
             37          (ii) an entity providing services on behalf of a governmental entity.
             38          (3) "Compensation" means anything of economic value that is paid or transferred to a
             39      commercial entity for or in direct consideration of the disclosure of nonpublic personal
             40      information.
             41          (4) (a) "Consumer transaction" means:
             42          (i) a sale, lease, assignment, award by chance, or other written or oral transfer or
             43      disposition:
             44          (A) that is initiated or completed in this state; and
             45          (B) of:
             46          (I) goods;
             47          (II) services; or
             48          (III) other tangible or intangible property, except securities and insurance S OR SERVICES
             48a      RELATED THERETO s ; or
             49          (ii) a transaction:
             50          (A) that is initiated or completed in this state; and
             51          (B) h THAT h constitutes credit offered or extended by a commercial entity to a person
             51a      primarily
             52      for personal, family, or household purposes.
             53          (b) "Consumer transaction" includes:
             54          (i) the use of nonpublic personal information in relation to a transaction with a person
             55      if the transaction is for primarily personal, family, or household purposes; and


             56          (ii) with respect to any transaction described in Subsection (4)(a):


             57          (A) an offer or solicitation;
             58          (B) an agreement;
             59          (C) the performance of an agreement; or
             60          (D) a charitable solicitation as defined in Section 13-11-3 .
             61          (c) "Consumer transaction" does not include a transaction related to real property.
             62          (5) (a) "Nonpublic personal information" means information that:
             63          (i) is not public information; and
             64          (ii) either alone or in conjunction with public information, identifies a person in
             65      distinction from other persons.
             66          (b) "Nonpublic personal information" includes:
             67          (i) a person's Social Security number;
             68          (ii) information used to determine a person's credit worthiness including a person's:
             69          (A) income; or
             70          (B) employment history;
             71          (iii) the purchasing patterns of a person; or
             72          (iv) the personal preferences of a person.
             73          (6) "Public information" means a person's:
             74          (a) name;
             75          (b) telephone number; or
             76          (c) street address.
             77          (7) (a) Subject to Subsection (7)(b), "third party" means a person other than the
             78      commercial entity that obtains nonpublic personal information.
             79          (b) "Third party" does not include an affiliate S OR AGENT s of the commercial entity that
             79a      obtains
             80      nonpublic personal information.
             81          Section 3. Section 13-37-201 is enacted to read:
             82     
Part 2. Notice of Disclosure

             83          13-37-201. Required notice.
             84          (1) (a) In accordance with this section, a commercial entity shall provide the notice
             85      described in this section to a person if:
             86          (i) the commercial entity enters into a consumer transaction with that person;
             87          (ii) as a result of the consumer transaction described in this Subsection (1)(a), the


             88      commercial entity obtains nonpublic personal information concerning that person; and
             89          (iii) the commercial entity intends to or wants the ability to disclose the nonpublic
             90      personal information:
             91          (A) to a third party; and
             92          (B) for compensation; and
             93          (iv) the compensation described in Subsection (1)(a)(iii)(B):
             94          (A) is the primary consideration for the commercial entity disclosing the nonpublic
             95      personal information;
             96          (B) is directly related to the commercial entity disclosing the nonpublic personal
             97      information; and
             98          (C) is not compensation received by the commercial entity in consideration of a
             99      transaction described in Subsection (5).
             100          (b) For purposes of this chapter, a commercial entity is considered to have obtained
             101      information as a result of a consumer transaction if:
             102          (i) the person provides the information to the commercial entity:
             103          (A) at any time during the consumer transaction; and
             104          (B) at the request of the commercial entity; or
             105          (ii) (A) the commercial entity otherwise obtains the information; and
             106          (B) but for the consumer transaction, the commercial entity would not obtain the
             107      information.
             108          (2) The notice required by Subsection (1) shall be given before the earlier of:
             109          (a) the point at which the person is requested to provide the nonpublic personal
             110      information; or
             111          (b) the commercial entity otherwise obtains the nonpublic personal information as a
             112      result of the consumer transaction described in Subsection (1)(a).
             113          (3) The notice required by Subsection (1):
             114          (a) shall read substantially as follows: "We may choose to disclose nonpublic personal
             115      information about you, the consumer, to a third party for compensation.";
             116          (b) may be made:
             117          (i) orally, if the consumer transaction itself is entirely conducted orally; or
             118          (ii) in writing, if the notice is written in dark bold; and


             119          (c) shall be sufficiently conspicuous so that a reasonable person would perceive the
             120      notice before providing the nonpublic personal information.
             121           h [ (4) This chapter does not apply if:
             122          (a) a commercial entity discloses nonpublic personal information to a third party;
             123          (b) the commercial entity is subject to a federal law or regulation that governs the
             124      disclosure of nonpublic information to a third party; and
             125          (c) the disclosure of nonpublic information to a third party complies with or is
             126      authorized by the federal law or regulation described in Subsection (4)(b).
]

             126a           (4) THIS CHAPTER DOES NOT APPLY TO S : (a) s A COMMERCIAL ENTITY THAT IS SUBJECT TO A
             126b      FEDERAL LAW OR REGULATION THAT GOVERNS THE DISCLOSURE OF NONPUBLIC INFORMATION
             126c      TO A THIRD PARTY S ; OR (b) A COVERED ENTITY AS DEFINED IN 45 C.F.R. PARTS 160 AND 164 s . h
             127          (5) Notwithstanding the other provisions of this section, a commercial entity is not
             128      required to provide notice under this section if:
             129          (a) the disclosure of the nonpublic personal information is related to the third party
             130      providing to the commercial entity:
             131          (i) services S , INCLUDING BUSINESS OUTSOURCE SERVICES s ;
             132          (ii) personal or real property; or
             133          (iii) other thing of value; and
             134          (b) compensation received by the commercial entity as part of the transaction is
             135      received by the commercial entity for or in consideration of the transaction described in
             136      Subsection (5)(a).
             137          Section 4. Section 13-37-202 is enacted to read:
             138          13-37-202. Disclosure of nonpublic personal information prohibited without
             139      notice.
             140           h (1) h A commercial entity may not disclose nonpublic personal information that the
             141      commercial entity obtained on or after h [ May 5, 2003, ] JANUARY 1, 2004, h as a result of a
             141a      consumer transaction if the
             142      commercial entity fails to comply with Section 13-37-201 .
             142a           h (2) THIS CHAPTER MAY NOT BE INTERPRETED AS AUTHORIZING A COMMERCIAL ENTITY
             142b      TO DISCLOSE NONPUBLIC PERSONAL INFORMATION TO A GREATER EXTENT THAN THE
             142c      COMMERCIAL ENTITY IS OTHERWISE PERMITTED TO DISCLOSE NONPUBLIC PERSONAL
             142d      INFORMATION. h
             143          Section 5. Section 13-37-203 is enacted to read:
             144          13-37-203. Liability.
             145          (1) A person may bring an action against a commercial entity in a court of competent


             146      jurisdiction in this state if:
             147          (a) the commercial entity enters into a consumer transaction with that person;
             148          (b) as a result of the consumer transaction described in Subsection (1)(a), the
             149      commercial entity obtains nonpublic personal information concerning that person; and


             150          (c) the commercial entity violates this chapter.
             151          (2) In an action brought under Subsection (1), a commercial entity that violates this
             152      chapter is liable to the person who brings the action for:
             153          (a) $500 for each h [ violation of this chapter that relates ] TIME THE COMMERCIAL ENTITY
             153a      FAILS TO PROVIDE THE NOTICE REQUIRED BY THIS SECTION IN RELATION h to the nonpublic
             153b      personal
             154      information of the person who brings the action; and
             155          (b) court costs.
             156          (3) A person may not bring a class action under this chapter.
             156a           h Section 5. Effective date.
             156b          THIS ACT TAKES EFFECT ON JANUARY 1, 2004. h
    


[Bill Documents][Bills Directory]