Download Zipped Enrolled WP 9 HB0040.ZIP
[Introduced][Amended][Status][Bill Documents][Fiscal Note][Bills Directory]
H.B. 40 Enrolled
Eric K. Hutchings This act modifies the Commerce and Trade title to enact the Notice of Intent to Sell
Nonpublic Personal Information Act. This act defines terms, requires a notice be given
by a commercial entity under certain circumstances, and establishes the liability of a
commercial entity for violating the act. This act takes effect on January 1, 2004.
This act affects sections of Utah Code Annotated 1953 as follows:
ENACTS:
13-37-101, Utah Code Annotated 1953
13-37-102, Utah Code Annotated 1953
13-37-201, Utah Code Annotated 1953
13-37-202, Utah Code Annotated 1953
13-37-203, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 13-37-101 is enacted to read:
13-37-101. Title.
This chapter is known as the "Notice of Intent to Sell Nonpublic Personal Information
Act."
Section 2. Section 13-37-102 is enacted to read:
13-37-102. Definitions.
As used in this chapter:
(1) "Affiliate" means a person that controls, is controlled by, or is under common
control with:
(a) a commercial entity; and
(b) (i) directly; or
(ii) indirectly through one or more intermediaries.
(2) (a) Subject to Subsection (2)(b), "commercial entity" means a person that:
(i) has an office or other place of business located in the state; and
(ii) in the ordinary course of business transacts a consumer transaction in this state.
(b) "Commercial entity" does not include:
(i) a governmental entity; or
(ii) an entity providing services on behalf of a governmental entity.
(3) "Compensation" means anything of economic value that is paid or transferred to a
commercial entity for or in direct consideration of the disclosure of nonpublic personal
information.
(4) (a) "Consumer transaction" means:
(i) a sale, lease, assignment, award by chance, or other written or oral transfer or
disposition:
(A) that is initiated or completed in this state; and
(B) of:
(I) goods;
(II) services; or
(III) other tangible or intangible property, except securities and insurance or services
related thereto; or
(ii) a transaction:
(A) that is initiated or completed in this state; and
(B) that constitutes credit offered or extended by a commercial entity to a person
primarily for personal, family, or household purposes.
(b) "Consumer transaction" includes:
(i) the use of nonpublic personal information in relation to a transaction with a person if
the transaction is for primarily personal, family, or household purposes; and
(ii) with respect to any transaction described in Subsection (4)(a):
(A) an offer or solicitation;
(B) an agreement;
(C) the performance of an agreement; or
(D) a charitable solicitation as defined in Section 13-11-3 .
(c) "Consumer transaction" does not include a transaction related to real property.
(5) (a) "Nonpublic personal information" means information that:
(i) is not public information; and
(ii) either alone or in conjunction with public information, identifies a person in
distinction from other persons.
(b) "Nonpublic personal information" includes:
(i) a person's Social Security number;
(ii) information used to determine a person's credit worthiness including a person's:
(A) income; or
(B) employment history;
(iii) the purchasing patterns of a person; or
(iv) the personal preferences of a person.
(6) "Public information" means a person's:
(a) name;
(b) telephone number; or
(c) street address.
(7) (a) Subject to Subsection (7)(b), "third party" means a person other than the
commercial entity that obtains nonpublic personal information.
(b) "Third party" does not include an affiliate or agent of the commercial entity that
obtains nonpublic personal information.
Section 3. Section 13-37-201 is enacted to read:
13-37-201. Required notice.
(1) (a) In accordance with this section, a commercial entity shall provide the notice
described in this section to a person if:
(i) the commercial entity enters into a consumer transaction with that person;
(ii) as a result of the consumer transaction described in this Subsection (1)(a), the
commercial entity obtains nonpublic personal information concerning that person; and
(iii) the commercial entity intends to or wants the ability to disclose the nonpublic
personal information:
(A) to a third party; and
(B) for compensation; and
(iv) the compensation described in Subsection (1)(a)(iii)(B):
(A) is the primary consideration for the commercial entity disclosing the nonpublic
personal information;
(B) is directly related to the commercial entity disclosing the nonpublic personal
information; and
(C) is not compensation received by the commercial entity in consideration of a
transaction described in Subsection (5).
(b) For purposes of this chapter, a commercial entity is considered to have obtained
information as a result of a consumer transaction if:
(i) the person provides the information to the commercial entity:
(A) at any time during the consumer transaction; and
(B) at the request of the commercial entity; or
(ii) (A) the commercial entity otherwise obtains the information; and
(B) but for the consumer transaction, the commercial entity would not obtain the
information.
(2) The notice required by Subsection (1) shall be given before the earlier of:
(a) the point at which the person is requested to provide the nonpublic personal
information; or
(b) the commercial entity otherwise obtains the nonpublic personal information as a
result of the consumer transaction described in Subsection (1)(a).
(3) The notice required by Subsection (1):
(a) shall read substantially as follows: "We may choose to disclose nonpublic personal
information about you, the consumer, to a third party for compensation.";
(b) may be made:
(i) orally, if the consumer transaction itself is entirely conducted orally; or
(ii) in writing, if the notice is written in dark bold; and
(c) shall be sufficiently conspicuous so that a reasonable person would perceive the
notice before providing the nonpublic personal information.
(4) This chapter does not apply to:
(a) a commercial entity that is subject to a federal law or regulation that governs the
disclosure of nonpublic information to a third party; or
(b) a covered entity as defined in 45 C.F.R. Parts 160 and 164.
(5) Notwithstanding the other provisions of this section, a commercial entity is not
required to provide notice under this section if:
(a) the disclosure of the nonpublic personal information is related to the third party
providing to the commercial entity:
(i) services, including business outsource services;
(ii) personal or real property; or
(iii) other thing of value; and
(b) compensation received by the commercial entity as part of the transaction is received
by the commercial entity for or in consideration of the transaction described in Subsection (5)(a).
Section 4. Section 13-37-202 is enacted to read:
13-37-202. Disclosure of nonpublic personal information prohibited without notice.
(1) A commercial entity may not disclose nonpublic personal information that the
commercial entity obtained on or after January 1, 2004, as a result of a consumer transaction if
the commercial entity fails to comply with Section 13-37-201 .
(2) This chapter may not be interpreted as authorizing a commercial entity to disclose
nonpublic personal information to a greater extent than the commercial entity is otherwise
permitted to disclose nonpublic personal information.
Section 5. Section 13-37-203 is enacted to read:
13-37-203. Liability.
(1) A person may bring an action against a commercial entity in a court of competent
jurisdiction in this state if:
(a) the commercial entity enters into a consumer transaction with that person;
(b) as a result of the consumer transaction described in Subsection (1)(a), the commercial
entity obtains nonpublic personal information concerning that person; and
(c) the commercial entity violates this chapter.
(2) In an action brought under Subsection (1), a commercial entity that violates this
chapter is liable to the person who brings the action for:
(a) $500 for each time the commercial entity fails to provide the notice required by this
section in relation to the nonpublic personal information of the person who brings the action; and
(b) court costs.
(3) A person may not bring a class action under this chapter.
Section 6. Effective date.
This act takes effect on January 1, 2004.
[Bill Documents][Bills Directory]