First Substitute H.B. 141

Representative Douglas C. Aagard proposes the following substitute bill:

1 IDENTITY THEFT REPORTING
2 INFORMATION SYSTEM AMENDMENTS
3 2008 GENERAL SESSION
4 STATE OF UTAH
5 Chief Sponsor: Douglas C. Aagard
6 Senate Sponsor: Gregory S. Bell
7
8 LONG TITLE
9 General Description:
10 This bill amends provisions and establishes an identify theft program and database in
11 the Office of the Attorney General.
12 Highlighted Provisions:
13 This bill:
14 . amends provisions in the Government Records Access and Management Act to
15 provide protected status to all information collected in relation to the Identity Theft
16 Reporting Information System established in the Office of the Attorney General;
17 . establishes the Identity Theft Reporting Information System (IRIS) program in the
18 Office of the Attorney General;
19 . states the purposes of the IRIS program;
20 . establishes a database to store information related to the reporting, investigation,
21 and resolution of identity theft reports filed under the IRIS program;
22 . provides requirements for the format, contents, and administration of the IRIS
23 database;
24 . provides that the Department of Technology Services shall maintain, administer,
25 and make rules in relation to use of the database, with the approval of the Office of

26 the Attorney General;
27 . provides criminal penalties for unlawful access or misuse of information in the IRIS
28 database; and
29 . makes technical amendments.
30 Monies Appropriated in this Bill:
31 None
32 Other Special Clauses:
33 This bill coordinates with H.B. 63, Recodification of Title 63 State Affairs in General,
34 by providing technical renumbering.
35 Utah Code Sections Affected:
36 AMENDS:
37 63-2-304, as last amended by Laws of Utah 2008, Chapter 3
38 67-5-22, as enacted by Laws of Utah 2007, Chapter 311
39
40 Be it enacted by the Legislature of the state of Utah:
41 Section 1. Section 63-2-304 is amended to read:
42 63-2-304. Protected records.
43 The following records are protected if properly classified by a governmental entity:
44 (1) trade secrets as defined in Section 13-24-2 if the person submitting the trade secret
45 has provided the governmental entity with the information specified in Section 63-2-308 ;
46 (2) commercial information or nonindividual financial information obtained from a
47 person if:
48 (a) disclosure of the information could reasonably be expected to result in unfair
49 competitive injury to the person submitting the information or would impair the ability of the
50 governmental entity to obtain necessary information in the future;
51 (b) the person submitting the information has a greater interest in prohibiting access
52 than the public in obtaining access; and
53 (c) the person submitting the information has provided the governmental entity with
54 the information specified in Section 63-2-308 ;
55 (3) commercial or financial information acquired or prepared by a governmental entity
56 to the extent that disclosure would lead to financial speculations in currencies, securities, or

57 commodities that will interfere with a planned transaction by the governmental entity or cause
58 substantial financial injury to the governmental entity or state economy;
59 (4) records the disclosure of which could cause commercial injury to, or confer a
60 competitive advantage upon a potential or actual competitor of, a commercial project entity as
61 defined in Subsection 11-13-103 (4);
62 (5) test questions and answers to be used in future license, certification, registration,
63 employment, or academic examinations;
64 (6) records the disclosure of which would impair governmental procurement
65 proceedings or give an unfair advantage to any person proposing to enter into a contract or
66 agreement with a governmental entity, except that this Subsection (6) does not restrict the right
67 of a person to see bids submitted to or by a governmental entity after bidding has closed;
68 (7) records that would identify real property or the appraisal or estimated value of real
69 or personal property, including intellectual property, under consideration for public acquisition
70 before any rights to the property are acquired unless:
71 (a) public interest in obtaining access to the information outweighs the governmental
72 entity's need to acquire the property on the best terms possible;
73 (b) the information has already been disclosed to persons not employed by or under a
74 duty of confidentiality to the entity;
75 (c) in the case of records that would identify property, potential sellers of the described
76 property have already learned of the governmental entity's plans to acquire the property;
77 (d) in the case of records that would identify the appraisal or estimated value of
78 property, the potential sellers have already learned of the governmental entity's estimated value
79 of the property; or
80 (e) the property under consideration for public acquisition is a single family residence
81 and the governmental entity seeking to acquire the property has initiated negotiations to acquire
82 the property as required under Section 78B-6-505 ;
83 (8) records prepared in contemplation of sale, exchange, lease, rental, or other
84 compensated transaction of real or personal property including intellectual property, which, if
85 disclosed prior to completion of the transaction, would reveal the appraisal or estimated value
86 of the subject property, unless:
87 (a) the public interest in access outweighs the interests in restricting access, including

88 the governmental entity's interest in maximizing the financial benefit of the transaction; or
89 (b) when prepared by or on behalf of a governmental entity, appraisals or estimates of
90 the value of the subject property have already been disclosed to persons not employed by or
91 under a duty of confidentiality to the entity;
92 (9) records created or maintained for civil, criminal, or administrative enforcement
93 purposes or audit purposes, or for discipline, licensing, certification, or registration purposes, if
94 release of the records:
95 (a) reasonably could be expected to interfere with investigations undertaken for
96 enforcement, discipline, licensing, certification, or registration purposes;
97 (b) reasonably could be expected to interfere with audits, disciplinary, or enforcement
98 proceedings;
99 (c) would create a danger of depriving a person of a right to a fair trial or impartial
100 hearing;
101 (d) reasonably could be expected to disclose the identity of a source who is not
102 generally known outside of government and, in the case of a record compiled in the course of
103 an investigation, disclose information furnished by a source not generally known outside of
104 government if disclosure would compromise the source; or
105 (e) reasonably could be expected to disclose investigative or audit techniques,
106 procedures, policies, or orders not generally known outside of government if disclosure would
107 interfere with enforcement or audit efforts;
108 (10) records the disclosure of which would jeopardize the life or safety of an
109 individual;
110 (11) records the disclosure of which would jeopardize the security of governmental
111 property, governmental programs, or governmental recordkeeping systems from damage, theft,
112 or other appropriation or use contrary to law or public policy;
113 (12) records that, if disclosed, would jeopardize the security or safety of a correctional
114 facility, or records relating to incarceration, treatment, probation, or parole, that would interfere
115 with the control and supervision of an offender's incarceration, treatment, probation, or parole;
116 (13) records that, if disclosed, would reveal recommendations made to the Board of
117 Pardons and Parole by an employee of or contractor for the Department of Corrections, the
118 Board of Pardons and Parole, or the Department of Human Services that are based on the

119 employee's or contractor's supervision, diagnosis, or treatment of any person within the board's
120 jurisdiction;
121 (14) records and audit workpapers that identify audit, collection, and operational
122 procedures and methods used by the State Tax Commission, if disclosure would interfere with
123 audits or collections;
124 (15) records of a governmental audit agency relating to an ongoing or planned audit
125 until the final audit is released;
126 (16) records prepared by or on behalf of a governmental entity solely in anticipation of
127 litigation that are not available under the rules of discovery;
128 (17) records disclosing an attorney's work product, including the mental impressions or
129 legal theories of an attorney or other representative of a governmental entity concerning
130 litigation;
131 (18) records of communications between a governmental entity and an attorney
132 representing, retained, or employed by the governmental entity if the communications would be
133 privileged as provided in Section 78B-1-137 ;
134 (19) (a) (i) personal files of a state legislator, including personal correspondence to or
135 from a member of the Legislature; and
136 (ii) notwithstanding Subsection (19)(a)(i), correspondence that gives notice of
137 legislative action or policy may not be classified as protected under this section; and
138 (b) (i) an internal communication that is part of the deliberative process in connection
139 with the preparation of legislation between:
140 (A) members of a legislative body;
141 (B) a member of a legislative body and a member of the legislative body's staff; or
142 (C) members of a legislative body's staff; and
143 (ii) notwithstanding Subsection (19)(b)(i), a communication that gives notice of
144 legislative action or policy may not be classified as protected under this section;
145 (20) (a) records in the custody or control of the Office of Legislative Research and
146 General Counsel, that, if disclosed, would reveal a particular legislator's contemplated
147 legislation or contemplated course of action before the legislator has elected to support the
148 legislation or course of action, or made the legislation or course of action public; and
149 (b) notwithstanding Subsection (20)(a), the form to request legislation submitted to the

150 Office of Legislative Research and General Counsel is a public document unless a legislator
151 asks that the records requesting the legislation be maintained as protected records until such
152 time as the legislator elects to make the legislation or course of action public;
153 (21) research requests from legislators to the Office of Legislative Research and
154 General Counsel or the Office of the Legislative Fiscal Analyst and research findings prepared
155 in response to these requests;
156 (22) drafts, unless otherwise classified as public;
157 (23) records concerning a governmental entity's strategy about collective bargaining or
158 pending litigation;
159 (24) records of investigations of loss occurrences and analyses of loss occurrences that
160 may be covered by the Risk Management Fund, the Employers' Reinsurance Fund, the
161 Uninsured Employers' Fund, or similar divisions in other governmental entities;
162 (25) records, other than personnel evaluations, that contain a personal recommendation
163 concerning an individual if disclosure would constitute a clearly unwarranted invasion of
164 personal privacy, or disclosure is not in the public interest;
165 (26) records that reveal the location of historic, prehistoric, paleontological, or
166 biological resources that if known would jeopardize the security of those resources or of
167 valuable historic, scientific, educational, or cultural information;
168 (27) records of independent state agencies if the disclosure of the records would
169 conflict with the fiduciary obligations of the agency;
170 (28) records of an institution within the state system of higher education defined in
171 Section 53B-1-102 regarding tenure evaluations, appointments, applications for admissions,
172 retention decisions, and promotions, which could be properly discussed in a meeting closed in
173 accordance with Title 52, Chapter 4, Open and Public Meetings Act, provided that records of
174 the final decisions about tenure, appointments, retention, promotions, or those students
175 admitted, may not be classified as protected under this section;
176 (29) records of the governor's office, including budget recommendations, legislative
177 proposals, and policy statements, that if disclosed would reveal the governor's contemplated
178 policies or contemplated courses of action before the governor has implemented or rejected
179 those policies or courses of action or made them public;
180 (30) records of the Office of the Legislative Fiscal Analyst relating to budget analysis,

181 revenue estimates, and fiscal notes of proposed legislation before issuance of the final
182 recommendations in these areas;
183 (31) records provided by the United States or by a government entity outside the state
184 that are given to the governmental entity with a requirement that they be managed as protected
185 records if the providing entity certifies that the record would not be subject to public disclosure
186 if retained by it;
187 (32) transcripts, minutes, or reports of the closed portion of a meeting of a public body
188 except as provided in Section 52-4-206 ;
189 (33) records that would reveal the contents of settlement negotiations but not including
190 final settlements or empirical data to the extent that they are not otherwise exempt from
191 disclosure;
192 (34) memoranda prepared by staff and used in the decision-making process by an
193 administrative law judge, a member of the Board of Pardons and Parole, or a member of any
194 other body charged by law with performing a quasi-judicial function;
195 (35) records that would reveal negotiations regarding assistance or incentives offered
196 by or requested from a governmental entity for the purpose of encouraging a person to expand
197 or locate a business in Utah, but only if disclosure would result in actual economic harm to the
198 person or place the governmental entity at a competitive disadvantage, but this section may not
199 be used to restrict access to a record evidencing a final contract;
200 (36) materials to which access must be limited for purposes of securing or maintaining
201 the governmental entity's proprietary protection of intellectual property rights including patents,
202 copyrights, and trade secrets;
203 (37) the name of a donor or a prospective donor to a governmental entity, including an
204 institution within the state system of higher education defined in Section 53B-1-102 , and other
205 information concerning the donation that could reasonably be expected to reveal the identity of
206 the donor, provided that:
207 (a) the donor requests anonymity in writing;
208 (b) any terms, conditions, restrictions, or privileges relating to the donation may not be
209 classified protected by the governmental entity under this Subsection (37); and
210 (c) except for an institution within the state system of higher education defined in
211 Section 53B-1-102 , the governmental unit to which the donation is made is primarily engaged

212 in educational, charitable, or artistic endeavors, and has no regulatory or legislative authority
213 over the donor, a member of the donor's immediate family, or any entity owned or controlled
214 by the donor or the donor's immediate family;
215 (38) accident reports, except as provided in Sections 41-6a-404 , 41-12a-202 , and
216 73-18-13 ;
217 (39) a notification of workers' compensation insurance coverage described in Section
218 34A-2-205 ;
219 (40) (a) the following records of an institution within the state system of higher
220 education defined in Section 53B-1-102 , which have been developed, discovered, disclosed to,
221 or received by or on behalf of faculty, staff, employees, or students of the institution:
222 (i) unpublished lecture notes;
223 (ii) unpublished notes, data, and information:
224 (A) relating to research; and
225 (B) of:
226 (I) the institution within the state system of higher education defined in Section
227 53B-1-102 ; or
228 (II) a sponsor of sponsored research;
229 (iii) unpublished manuscripts;
230 (iv) creative works in process;
231 (v) scholarly correspondence; and
232 (vi) confidential information contained in research proposals;
233 (b) Subsection (40)(a) may not be construed to prohibit disclosure of public
234 information required pursuant to Subsection 53B-16-302 (2)(a) or (b); and
235 (c) Subsection (40)(a) may not be construed to affect the ownership of a record;
236 (41) (a) records in the custody or control of the Office of Legislative Auditor General
237 that would reveal the name of a particular legislator who requests a legislative audit prior to the
238 date that audit is completed and made public; and
239 (b) notwithstanding Subsection (41)(a), a request for a legislative audit submitted to the
240 Office of the Legislative Auditor General is a public document unless the legislator asks that
241 the records in the custody or control of the Office of Legislative Auditor General that would
242 reveal the name of a particular legislator who requests a legislative audit be maintained as

243 protected records until the audit is completed and made public;
244 (42) records that provide detail as to the location of an explosive, including a map or
245 other document that indicates the location of:
246 (a) a production facility; or
247 (b) a magazine;
248 (43) information [contained in the database described in Section 62A-3-311.1 ;]:
249 (a) contained in the statewide database of the Division of Aging and Adult Services
250 created by Section 62A-3-311.1 ; or
251 (b) received or maintained in relation to the Identity Theft Reporting Information
252 System (IRIS) established under Section 67-5-22 ;
253 (44) information contained in the Management Information System and Licensing
254 Information System described in Title 62A, Chapter 4a, Child and Family Services;
255 (45) information regarding National Guard operations or activities in support of the
256 National Guard's federal mission;
257 (46) records provided by any pawn or secondhand business to a law enforcement
258 agency or to the central database in compliance with Title 13, Chapter 32a, Pawnshop and
259 Secondhand Merchandise Transaction Information Act;
260 (47) information regarding food security, risk, and vulnerability assessments performed
261 by the Department of Agriculture and Food;
262 (48) except to the extent that the record is exempt from this chapter pursuant to Section
263 63-2-106 , records related to an emergency plan or program prepared or maintained by the
264 Division of Homeland Security the disclosure of which would jeopardize:
265 (a) the safety of the general public; or
266 (b) the security of:
267 (i) governmental property;
268 (ii) governmental programs; or
269 (iii) the property of a private person who provides the Division of Homeland Security
270 information;
271 (49) records of the Department of Agriculture and Food relating to the National
272 Animal Identification System or any other program that provides for the identification, tracing,
273 or control of livestock diseases, including any program established under Title 4, Chapter 24,

274 Utah Livestock Brand and Anti-theft Act or Title 4, Chapter 31, Livestock Inspection and
275 Quarantine;
276 (50) as provided in Section 26-39-109 :
277 (a) information or records held by the Department of Health related to a complaint
278 regarding a child care program or residential child care which the department is unable to
279 substantiate; and
280 (b) information or records related to a complaint received by the Department of Health
281 from an anonymous complainant regarding a child care program or residential child care; and
282 (51) unless otherwise classified as public under Section 63-2-301 and except as
283 provided under Section 41-1a-116 , an individual's home address, home telephone number, or
284 personal mobile phone number, if:
285 (a) the individual is required to provide the information in order to comply with a law,
286 ordinance, rule, or order of a government entity; and
287 (b) the subject of the record has a reasonable expectation that this information will be
288 kept confidential due to:
289 (i) the nature of the law, ordinance, rule, or order; and
290 (ii) the individual complying with the law, ordinance, rule, or order.
291 Section 2. Section 67-5-22 is amended to read:
292 67-5-22. Identity theft reporting information system -- Internet website and
293 database -- Access -- Maintenance and rulemaking -- Criminal provisions.
294 [(1) The attorney general shall maintain an Internet website available to]
295 (1) There is created within the Office of the Attorney General the Identity Theft
296 Reporting Information System (IRIS) Program to establish a database and Internet website to:
297 (a) allow persons in the state to submit reports of identity theft;
298 (b) assist the Office of the Attorney General in notifying state and local law
299 enforcement agencies of reports of identity theft;
300 (c) provide assistance and resources to victims of identity theft;
301 (d) provide a centralized location where information related to incidents of identity
302 theft may be securely stored and accessed for the benefit of victims of identity theft; and
303 (e) provide public education and information relating to identity theft.
304 (2) (a) The Internet website shall be maintained by the Office of the Attorney General

305 and shall be made available to the public and to victims of identity-related crimes.
306 [(2)] (b) The Internet website [created under Subsection (1)] shall:
307 (i) allow a victim of an identity-related crime to report the crime on the website and
308 have the victim's report routed to the appropriate law enforcement agency for the jurisdiction in
309 which the crime occurred[.]; and
310 (ii) provide public education and information relating to identity theft.
311 [(3)] (c) The [attorney general may expand the] Internet website [maintained under
312 Subsection (1)] may be expanded to provide other identity-related services to victims[.]
313 according to the procedures of Subsection (4).
314 (3) (a) The Department of Technology Services shall administer and maintain the
315 database established under this section in an electronic file or other format as established by the
316 department.
317 (b) (i) The database shall be maintained for the purpose of identifying victims of
318 identity theft who have filed a report with the program established under this section, and may
319 contain the personally identifiable information for each victim, which may include the
320 following information related to an incident of identify theft:
321 (A) the victim's name, address, email addresses, and telephone numbers;
322 (B) the victim's Social Security number and other identifying information;
323 (C) the victim's financial institution information, account numbers, and transaction
324 information;
325 (D) the victim's benefit information;
326 (E) the victim's credit account information;
327 (F) the victim's loan information;
328 (G) the victim's employment information;
329 (H) the victim's Internal Revenue Service or tax information;
330 (I) the victim's utility service information;
331 (J) information concerning legal matters or collections related to the incident;
332 (K) information concerning unauthorized or illegal transactions, denied credit, stolen
333 identification, and all other unauthorized actions related to the identity theft; and
334 (L) any other information related to the incident of identity theft that the victim or the
335 Office of the Attorney General elects to include in the database.

336 (ii) The database shall record and maintain:
337 (A) identification information for each person who requests or receives information
338 from the database;
339 (B) a record of the information that is requested or received by each person who
340 requests or receives information from the database; and
341 (C) a record of the date and time that any information is requested or provided from the
342 database.
343 (c) Information in the database is considered to be the property of the Office of the
344 Attorney General, and retains any classification given it under Title 63, Chapter 2, Government
345 Records Access and Management Act.
346 (4) The Department of Technology Services, with the approval of the Office of the
347 Attorney General, may make rules to:
348 (a) permit the following persons to have access to the database:
349 (i) federal, state, and local law enforcement authorities, provided that the authority is
350 acting within a specified duty of the authority's employment in enforcing laws;
351 (ii) participating merchants and financial institutions, provided that the merchant or
352 institution has entered into an access agreement with the Office of the Attorney General; and
353 (iii) other persons, to be established by rule, provided that the person's access to the
354 information is necessary and reasonable to accomplish the purposes of the program as provided
355 in Subsection (1);
356 (b) define and enforce limitations on access to information via the Internet website or
357 in the database; and
358 (c) establish standards and procedures to ensure accurate identification of individuals
359 that are requesting or receiving information from the Internet website or the database.
360 (5) (a) In addition to the penalties provided under Title 63, Chapter 2, Government
361 Records Access and Management Act, a person may not knowingly and intentionally release or
362 disclose information from the database in violation of the limitations provided under
363 Subsection (4)(a).
364 (b) A violation of Subsection (5)(a) is a third degree felony.
365 (6) (a) A person may not obtain or attempt to obtain information from the database by
366 misrepresentation or fraud.

367 (b) A violation of Subsection (6)(a) is a third degree felony.
368 (7) (a) A person may not knowingly and intentionally use, release, publish, or
369 otherwise make available to any other person or entity any information obtained from the
370 database for any purpose other than those specified under Subsection (4)(a).
371 (b) Each separate violation of Subsection (7)(a) is a third degree felony.
372 Section 3. Coordinating H.B. 141 with H.B. 63 -- Technical renumbering.
373 If this H.B. 141 and H.B. 63, Recodification of Title 63 State Affairs in General, both
374 pass, it is the intent of the Legislature that the Office of Legislative Research and General
375 Counsel, in preparing the Utah Code database for publication:
376 (1) renumber Section 63-2-304 to 63G-2-305 ; and
377 (2) change all internal references to Title 63, Chapter 2 to Title 63G, Chapter 2.