Representative Craig Hall proposes the following substitute bill:


1     
ELECTRONIC INFORMATION OR DATA PRIVACY

2     
2019 GENERAL SESSION

3     
STATE OF UTAH

4     
Chief Sponsor: Craig Hall

5     
Senate Sponsor: Todd Weiler

6     

7     LONG TITLE
8     General Description:
9          This bill modifies provisions related to privacy of electronic information or data.
10     Highlighted Provisions:
11          This bill:
12          ▸     defines terms;
13          ▸     requires issuance of a search warrant to obtain certain electronic information or
14     data;
15          ▸     addresses notification that electronic information or data was obtained;
16          ▸     provides for transmission of electronic information or data to a remote computing
17     service, including restrictions on government entities;
18          ▸     provides that the individual who transmits electronic information or data is the
19     presumed owner of the electronic information or data;
20          ▸     provides for the exclusion of electronic information or data obtained without a
21     warrant; and
22          ▸     makes technical and conforming changes.
23     Money Appropriated in this Bill:
24          None
25     Other Special Clauses:
26          None
27     Utah Code Sections Affected:
28     AMENDS:
29          77-23c-102, as last amended by Laws of Utah 2016, Chapter 161
30          77-23c-103, as enacted by Laws of Utah 2014, Chapter 223
31     ENACTS:
32          77-23c-101.1, Utah Code Annotated 1953
33          77-23c-104, Utah Code Annotated 1953
34          77-23c-105, Utah Code Annotated 1953
35     RENUMBERS AND AMENDS:
36          77-23c-101.2, (Renumbered from 77-23c-101, as enacted by Laws of Utah 2014,
37     Chapter 223)
38     

39     Be it enacted by the Legislature of the state of Utah:
40          Section 1. Section 77-23c-101.1 is enacted to read:
41     
CHAPTER 23c. ELECTRONIC INFORMATION OR DATA PRIVACY ACT

42          77-23c-101.1. Title.
43          This chapter is known as the "Electronic Information or Data Privacy Act."
44          Section 2. Section 77-23c-101.2, which is renumbered from Section 77-23c-101 is
45     renumbered and amended to read:
46          [77-23c-101].      77-23c-101.2. Definitions.
47          As used in this chapter:
48          (1) "Electronic communication service" means a service that provides to users of the
49     service the ability to send or receive wire or electronic communications.
50          (2) "Electronic device" means a device that enables access to or use of an electronic
51     communication service, remote computing service, or location information service.
52          [(3) "Government entity" means the state, a county, a municipality, a higher education
53     institution, a local district, a special service district, or any other political subdivision of the
54     state or an administrative subunit of any political subdivision, including a law enforcement
55     entity or any other investigative entity, agency, department, division, bureau, board, or
56     commission, or an individual acting or purporting to act for or on behalf of a state or local
57     agency.]
58          (3) (a) "Electronic information or data" means information or data including a sign,
59     signal, writing, image, sound, or intelligence of any nature transmitted or stored in whole or in
60     part by a wire, radio, electromagnetic, photoelectronic, or photooptical system.
61          (b) "Electronic information or data" includes the location information, stored data, or
62     transmitted data of an electronic device.
63          (c) "Electronic information or data" does not include:
64          (i) a wire or oral communication;
65          (ii) a communication made through a tone-only paging device; or
66          (iii) electronic funds transfer information stored by a financial institution in a
67     communications system used for the electronic storage and transfer of money.
68          (4) "Law enforcement agency" means an entity of the state or a political subdivision of
69     the state that exists to primarily prevent, detect, or prosecute crime and enforce criminal
70     statutes or ordinances.
71          [(4)] (5) "Location information" means information, obtained by means of a tracking
72     device, concerning the location of an electronic device that, in whole or in part, is generated or
73     derived from or obtained by the operation of an electronic device.
74          [(5)] (6) "Location information service" means the provision of a global positioning
75     service or other mapping, location, or directional information service.
76          (7) "Oral communication" means the same as that term is defined in Section 77-23a-3.
77          [(6)] (8) "Remote computing service" means the provision to the public of computer
78     storage or processing services by means of an electronic communications system.
79          (9) "Transmitted data" means electronic information or data that is transmitted
80     wirelessly:
81          (a) from an electronic device to another electronic device without the use of an
82     intermediate connection or relay; or
83          (b) from an electronic device to a nearby antenna.
84          (10) "Wire communication" means the same as that term is defined in Section
85     77-23a-3.
86          Section 3. Section 77-23c-102 is amended to read:
87          77-23c-102. Electronic information or data privacy -- Warrant required for
88     disclosure.
89          (1) (a) Except as provided in Subsection (2)[, a government entity], for a criminal
90     investigation or prosecution, a law enforcement agency may not obtain, without a search
91     warrant issued by a court upon probable cause:
92          (i) the location information, stored data, or transmitted data of an electronic device
93     [without a search warrant issued by a court upon probable cause.]; or
94          (ii) electronic information or data transmitted by the owner of the electronic
95     information or data to a remote computing service provider.
96          (b) Except as provided in Subsection (1)(c), a [government entity] law enforcement
97     agency may not use, copy, or disclose, for any purpose, the location information, stored data,
98     [or] transmitted data of an electronic device, or electronic information or data provided by a
99     remote computing service provider, that [is not the subject of the warrant that is collected as
100     part of an effort to obtain the location information, stored data, or transmitted data of the
101     electronic device that is the subject of the warrant in Subsection (1)(a).]:
102          (i) is not the subject of the warrant; and
103          (ii) is collected as part of an effort to obtain the location information, stored data,
104     transmitted data of an electronic device, or electronic information or data provided by a remote
105     computing service provider that is the subject of the warrant in Subsection (1)(a).
106          (c) A [government entity] law enforcement agency may use, copy, or disclose the
107     transmitted data of an electronic device used to communicate with the electronic device that is
108     the subject of the warrant if the [government entity] law enforcement agency reasonably
109     believes that the transmitted data is necessary to achieve the objective of the warrant.
110          (d) The electronic information or data described in Subsection (1)(b) shall be destroyed
111     in an unrecoverable manner by the [government entity] law enforcement agency as soon as
112     reasonably possible after the electronic information or data is collected.
113          (2) (a) A [government entity] law enforcement agency may obtain location information
114     without a warrant for an electronic device:
115          (i) in accordance with Section 53-10-104.5;
116          (ii) if the device is reported stolen by the owner;
117          (iii) with the informed, affirmative consent of the owner or user of the electronic
118     device;
119          (iv) in accordance with a judicially recognized [exceptions] exception to warrant
120     requirements; [or]
121          (v) if the owner has voluntarily and publicly disclosed the location information[.]; or
122          (vi) from the remote computing service provider if the remote computing service
123     provider voluntarily discloses the location information:
124          (A) under a belief that an emergency exists involving an imminent risk to an individual
125     of death, serious physical injury, sexual abuse, live-streamed sexual exploitation, kidnapping,
126     or human trafficking; or
127          (B) that is inadvertently discovered by the remote computing service provider and
128     appears to pertain to the commission of a felony, or of a misdemeanor involving physical
129     violence, sexual abuse, or dishonesty.
130          (b) A law enforcement agency may obtain stored or transmitted data from an electronic
131     device, or electronic information or data transmitted by the owner of the electronic information
132     or data to a remote computing service provider, without a warrant:
133          (i) with the informed consent of the owner of the electronic device or electronic
134     information or data;
135          (ii) in accordance with a judicially recognized exception to warrant requirements;
136          (iii) in connection with a report forwarded by the National Center for Missing and
137     Exploited Children under 18 U.S.C. Sec. 2258A; or
138          (iv) subject to Subsection 77-23c-102(2)(a)(vi)(B), from a remote computing service
139     provider if the remote computing service provider voluntarily discloses the stored or
140     transmitted data as otherwise permitted under 18 U.S.C. Sec. 2702.
141          [(b)] (c) A prosecutor may obtain a judicial order as [defined] described in Section
142     77-22-2.5 for the purposes enumerated in Section 77-22-2.5.
143          (3) An electronic communication service provider[, its] or remote computing service
144     provider, the provider's officers, employees, agents, or other specified persons may not be held
145     liable for providing information, facilities, or assistance in [accordance with] good faith
146     reliance on the terms of the warrant issued under this section or without a warrant [pursuant to]
147     in accordance with Subsection (2).
148          [(4) (a) Notwithstanding Subsections (1) through (3), a government entity may receive
149     and utilize electronic data containing the location information of an electronic device from a
150     non-government entity as long as the electronic data contains no information that includes, or
151     may reveal, the identity of an individual.]
152          [(b) Electronic data collected in accordance with this subsection may not be used for
153     investigative purposes by a law enforcement agency.]
154          (4) Nothing in this chapter limits or affects the disclosure of public records under Title
155     63G, Chapter 2, Government Records Access and Management Act.
156          (5) Nothing in this chapter affects the rights of an employer under Subsection
157     34-48-202(1)(e) or an administrative rule adopted under Section 63F-1-206.
158          Section 4. Section 77-23c-103 is amended to read:
159          77-23c-103. Notification required -- Delayed notification.
160          (1) (a) Except as provided in Subsection (2), a [government entity] law enforcement
161     agency that executes a warrant pursuant to Subsection 77-23c-102(1)(a) or 77-23c-104(3) shall,
162     within 14 days after the day on which the [operation concludes] electronic information or data
163     that is the subject of the warrant is obtained by the law enforcement agency, issue a notification
164     to the owner of the electronic device or electronic information or data specified in the warrant
165     that states:
166          [(a)] (i) that a warrant was applied for and granted;
167          [(b)] (ii) the kind of warrant issued;
168          [(c)] (iii) the period of time during which the collection of the electronic information or
169     data [from the electronic device] was authorized;
170          [(d)] (iv) the offense specified in the application for the warrant;
171          [(e)] (v) the identity of the [government entity] law enforcement agency that filed the
172     application; and
173          [(f)] (vi) the identity of the judge who issued the warrant.
174          (b) The notification requirement under Subsection (1)(a) is not triggered until the
175     owner of the electronic device or electronic information or data specified in the warrant is
176     known, or could be reasonably identified, by the law enforcement agency.
177          (2) A [government entity] law enforcement agency seeking a warrant pursuant to
178     Subsection 77-23c-102(1)(a) or 77-23c-104(3) may submit a request, and the court may grant
179     permission, to delay the notification required by Subsection (1) for a period not to exceed 30
180     days, if the court determines that there is [probable] reasonable cause to believe that the
181     notification may:
182          (a) endanger the life or physical safety of an individual;
183          (b) cause a person to flee from prosecution;
184          (c) lead to the destruction of or tampering with evidence;
185          (d) intimidate a potential witness; or
186          (e) otherwise seriously jeopardize an investigation or unduly delay a trial.
187          (3) (a) When a delay of notification is granted under Subsection (2) and upon
188     application by the [government entity] law enforcement agency, the court may grant additional
189     extensions of up to 30 days each.
190          (b) Notwithstanding Subsection (3)(a), when a delay of notification is granted under
191     Subsection (2), and upon application by a law enforcement agency, the court may grant an
192     additional extension of up to 60 days if the court determines that a delayed notification is
193     justified because the investigation involving the warrant:
194          (i) is interstate in nature and sufficiently complex; or
195          (ii) is likely to extend up to or beyond an additional 60 days.
196          (4) Upon expiration of the period of delayed notification granted under Subsection (2)
197     or (3), the [government entity] law enforcement agency shall serve upon or deliver by
198     first-class mail, or by other means if delivery is impracticable, to the owner of the electronic
199     device or electronic information or data a copy of the warrant together with notice that:
200          (a) states with reasonable specificity the nature of the law enforcement inquiry; and
201          (b) contains:
202          (i) the information described in Subsections (1)(a)(i) through [(f)] (vi);
203          (ii) a statement that notification of the search was delayed;
204          (iii) the name of the court that authorized the delay of notification; and
205          (iv) a reference to the provision of this chapter that allowed the delay of notification.
206          (5) A [government entity] law enforcement agency is not required to notify the owner
207     of the electronic device or electronic information or data if the owner is located outside of the
208     United States.
209          Section 5. Section 77-23c-104 is enacted to read:
210          77-23c-104. Third party electronic information or data.
211          (1) As used in this section, "subscriber record" means a record or information of a
212     provider of an electronic communication service or remote computing service that reveals the
213     subscriber's or customer's:
214          (a) name;
215          (b) address;
216          (c) local and long distance telephone connection record, or record of session time and
217     duration;
218          (d) length of service, including the start date;
219          (e) type of service used;
220          (f) telephone number, instrument number, or other subscriber or customer number or
221     identification, including a temporarily assigned network address; and
222          (g) means and source of payment for the service, including a credit card or bank
223     account number.
224          (2) Except as provided in Chapter 22, Subpoena Powers for Aid of Criminal
225     Investigation and Grants of Immunity, a law enforcement agency may not obtain, use, copy, or
226     disclose a subscriber record.
227          (3) A law enforcement agency may not obtain, use, copy, or disclose, for a criminal
228     investigation or prosecution, any record or information, other than a subscriber record, of a
229     provider of an electronic communication service or remote computing service related to a
230     subscriber or customer without a warrant.
231          (4) Notwithstanding Subsections (2) and (3), a law enforcement agency may obtain,
232     use, copy, or disclose a subscriber record, or other record or information related to a subscriber
233     or customer, without a warrant:
234          (a) with the informed, affirmed consent of the subscriber or customer;
235          (b) in accordance with a judicially recognized exception to warrant requirements;
236          (c) if the subscriber or customer voluntarily discloses the record in a manner that is
237     publicly accessible; or
238          (d) if the provider of an electronic communication service or remote computing service
239     voluntarily discloses the record:
240          (i) under a belief that an emergency exists involving the imminent risk to an individual
241     of:
242          (A) death;
243          (B) serious physical injury;
244          (C) sexual abuse;
245          (D) live-streamed sexual exploitation;
246          (E) kidnapping; or
247          (F) human trafficking;
248          (ii) that is inadvertently discovered by the provider, if the record appears to pertain to
249     the commission of:
250          (A) a felony; or
251          (B) a misdemeanor involving physical violence, sexual abuse, or dishonesty; or
252          (iii) subject to Subsection 77-23c-104(4)(d)(ii), as otherwise permitted under 18 U.S.C.
253     Sec. 2702.
254          (5) A provider of an electronic communication service or remote computing service, or
255     the provider's officers, employees, agents, or other specified persons may not be held liable for
256     providing information, facilities, or assistance in good faith reliance on the terms of a warrant
257     issued under this section, or without a warrant in accordance with Subsection (3).
258          Section 6. Section 77-23c-105 is enacted to read:
259          77-23c-105. Exclusion of records.
260          All electronic information or data and records of a provider of an electronic
261     communications service or remote computing service pertaining to a subscriber or customer
262     that are obtained in violation of the provisions of this chapter shall be subject to the rules
263     governing exclusion as if the records were obtained in violation of the Fourth Amendment to
264     the United States Constitution and Utah Constitution, Article I, Section 14.