First Substitute H.B. 40

Representative Douglas C. Aagard proposes the following substitute bill:

1 NOTICE OF INTENT TO SELL NONPUBLIC
2 PERSONAL INFORMATION
3 2003 GENERAL SESSION
4 STATE OF UTAH
5 Sponsor: Douglas C. Aagard
6 This act modifies the Commerce and Trade title to enact the Notice of Intent to Sell
7 Nonpublic Personal Information Act. This act defines terms, requires a notice be given
8 by a commercial entity under certain circumstances, and establishes the liability of a
9 commercial entity for violating the act.
10 This act affects sections of Utah Code Annotated 1953 as follows:
11 ENACTS:
12 13-37-101, Utah Code Annotated 1953
13 13-37-102, Utah Code Annotated 1953
14 13-37-201, Utah Code Annotated 1953
15 13-37-202, Utah Code Annotated 1953
16 13-37-203, Utah Code Annotated 1953
17 Be it enacted by the Legislature of the state of Utah:
18 Section 1. Section 13-37-101 is enacted to read:
19 CHAPTER 37. NOTICE OF INTENT TO SELL NONPUBLIC
20 PERSONAL INFORMATION ACT
21 Part 1. General Provisions
22 13-37-101. Title.
23 This chapter is known as the "Notice of Intent to Sell Nonpublic Personal Information
24 Act."
25 Section 2. Section 13-37-102 is enacted to read:

26 13-37-102. Definitions.
27 As used in this chapter:
28 (1) "Affiliate" means a person that controls, is controlled by, or is under common
29 control with:
30 (a) a commercial entity; and
31 (b) (i) directly; or
32 (ii) indirectly through one or more intermediaries.
33 (2) (a) Subject to Subsection (2)(b), "commercial entity" means a person that in the
34 ordinary course of business transacts a consumer transaction in this state.
35 (b) "Commercial entity" does not include:
36 (i) a governmental entity; or
37 (ii) an entity providing services on behalf of a governmental entity.
38 (3) "Compensation" means anything of economic value that is paid or transferred to a
39 commercial entity for or in direct consideration of the disclosure of nonpublic personal
40 information.
41 (4) (a) "Consumer transaction" means:
42 (i) a sale, lease, assignment, award by chance, or other written or oral transfer or
43 disposition:
44 (A) that is initiated or completed in this state; and
45 (B) of:
46 (I) goods;
47 (II) services; or
48 (III) other tangible or intangible property, except securities and insurance; or
49 (ii) a transaction:
50 (A) that is initiated or completed in this state; and
51 (B) constitutes credit offered or extended by a commercial entity to a person primarily
52 for personal, family, or household purposes.
53 (b) "Consumer transaction" includes:
54 (i) the use of nonpublic personal information in relation to a transaction with a person
55 if the transaction is for primarily personal, family, or household purposes; and
56 (ii) with respect to any transaction described in Subsection (4)(a):

57 (A) an offer or solicitation;
58 (B) an agreement;
59 (C) the performance of an agreement; or
60 (D) a charitable solicitation as defined in Section 13-11-3 .
61 (c) "Consumer transaction" does not include a transaction related to real property.
62 (5) (a) "Nonpublic personal information" means information that:
63 (i) is not public information; and
64 (ii) either alone or in conjunction with public information, identifies a person in
65 distinction from other persons.
66 (b) "Nonpublic personal information" includes:
67 (i) a person's Social Security number;
68 (ii) information used to determine a person's credit worthiness including a person's:
69 (A) income; or
70 (B) employment history;
71 (iii) the purchasing patterns of a person; or
72 (iv) the personal preferences of a person.
73 (6) "Public information" means a person's:
74 (a) name;
75 (b) telephone number; or
76 (c) street address.
77 (7) (a) Subject to Subsection (7)(b), "third party" means a person other than the
78 commercial entity that obtains nonpublic personal information.
79 (b) "Third party" does not include an affiliate of the commercial entity that obtains
80 nonpublic personal information.
81 Section 3. Section 13-37-201 is enacted to read:
82 Part 2. Notice of Disclosure
83 13-37-201. Required notice.
84 (1) (a) In accordance with this section, a commercial entity shall provide the notice
85 described in this section to a person if:
86 (i) the commercial entity enters into a consumer transaction with that person;
87 (ii) as a result of the consumer transaction described in this Subsection (1)(a), the

88 commercial entity obtains nonpublic personal information concerning that person; and
89 (iii) the commercial entity intends to or wants the ability to disclose the nonpublic
90 personal information:
91 (A) to a third party; and
92 (B) for compensation; and
93 (iv) the compensation described in Subsection (1)(a)(iii)(B):
94 (A) is the primary consideration for the commercial entity disclosing the nonpublic
95 personal information;
96 (B) is directly related to the commercial entity disclosing the nonpublic personal
97 information; and
98 (C) is not compensation received by the commercial entity in consideration of a
99 transaction described in Subsection (5).
100 (b) For purposes of this chapter, a commercial entity is considered to have obtained
101 information as a result of a consumer transaction if:
102 (i) the person provides the information to the commercial entity:
103 (A) at any time during the consumer transaction; and
104 (B) at the request of the commercial entity; or
105 (ii) (A) the commercial entity otherwise obtains the information; and
106 (B) but for the consumer transaction, the commercial entity would not obtain the
107 information.
108 (2) The notice required by Subsection (1) shall be given before the earlier of:
109 (a) the point at which the person is requested to provide the nonpublic personal
110 information; or
111 (b) the commercial entity otherwise obtains the nonpublic personal information as a
112 result of the consumer transaction described in Subsection (1)(a).
113 (3) The notice required by Subsection (1):
114 (a) shall read substantially as follows: "We may choose to disclose nonpublic personal
115 information about you, the consumer, to a third party for compensation.";
116 (b) may be made:
117 (i) orally, if the consumer transaction itself is entirely conducted orally; or
118 (ii) in writing, if the notice is written in dark bold; and

119 (c) shall be sufficiently conspicuous so that a reasonable person would perceive the
120 notice before providing the nonpublic personal information.
121 (4) This chapter does not apply if:
122 (a) a commercial entity discloses nonpublic personal information to a third party;
123 (b) the commercial entity is subject to a federal law or regulation that governs the
124 disclosure of nonpublic information to a third party; and
125 (c) the disclosure of nonpublic information to a third party complies with or is
126 authorized by the federal law or regulation described in Subsection (4)(b).
127 (5) Notwithstanding the other provisions of this section, a commercial entity is not
128 required to provide notice under this section if:
129 (a) the disclosure of the nonpublic personal information is related to the third party
130 providing to the commercial entity:
131 (i) services;
132 (ii) personal or real property; or
133 (iii) other thing of value; and
134 (b) compensation received by the commercial entity as part of the transaction is
135 received by the commercial entity for or in consideration of the transaction described in
136 Subsection (5)(a).
137 Section 4. Section 13-37-202 is enacted to read:
138 13-37-202. Disclosure of nonpublic personal information prohibited without
139 notice.
140 A commercial entity may not disclose nonpublic personal information that the
141 commercial entity obtained on or after May 5, 2003, as a result of a consumer transaction if the
142 commercial entity fails to comply with Section 13-37-201 .
143 Section 5. Section 13-37-203 is enacted to read:
144 13-37-203. Liability.
145 (1) A person may bring an action against a commercial entity in a court of competent
146 jurisdiction in this state if:
147 (a) the commercial entity enters into a consumer transaction with that person;
148 (b) as a result of the consumer transaction described in Subsection (1)(a), the
149 commercial entity obtains nonpublic personal information concerning that person; and

150 (c) the commercial entity violates this chapter.
151 (2) In an action brought under Subsection (1), a commercial entity that violates this
152 chapter is liable to the person who brings the action for:
153 (a) $500 for each violation of this chapter that relates to the nonpublic personal
154 information of the person who brings the action; and
155 (b) court costs.
156 (3) A person may not bring a class action under this chapter.