2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill requires the Driver License Division to provide notification to each applicant
10 for a driver license or an identification card regarding the disclosure of certain
11 information.
12 Highlighted Provisions:
13 This bill:
14 ▸ requires the Driver License Division to provide on each application for a driver
15 license or an identification card information regarding the disclosure of personal
16 identifying information;
17 ▸ provides means for an individual to opt out of certain disclosures to the University
18 of Utah for data collection in relation to genetic and epidemiologic research;
19 ▸ provides means for an individual to remove certain personal identifying information
20 from the database controlled by the University of Utah;
21 ▸ requires reports to the Transportation Interim Committee;
22 ▸ requires auditing of the security of the University of Utah database; and
23 ▸ makes technical changes.
24 Money Appropriated in this Bill:
25 None
26 Other Special Clauses:
27 None
28 Utah Code Sections Affected:
29 AMENDS:
30 53-3-109, as last amended by Laws of Utah 2019, Chapter 380
31
32 Be it enacted by the Legislature of the state of Utah:
33 Section 1. Section 53-3-109 is amended to read:
34 53-3-109. Records -- Access -- Fees -- Rulemaking.
35 (1) (a) Except as provided in this section, all records of the division shall be classified
36 and disclosed in accordance with Title 63G, Chapter 2, Government Records Access and
37 Management Act.
38 (b) The division may disclose personal identifying information in accordance with 18
39 U.S.C. Chapter 123:
40 (i) to a licensed private investigator holding a valid agency license, with a legitimate
41 business need;
42 (ii) to an insurer, insurance support organization, or a self-insured entity, or its agents,
43 employees, or contractors that issues any motor vehicle insurance under Title 31A, Chapter 22,
44 Part 3, Motor Vehicle Insurance, for use in connection with claims investigation activities,
45 antifraud activities, rating, or underwriting for any person issued a license certificate under this
46 chapter;
47 (iii) to a depository institution as that term is defined in Section 7-1-103;
48 (iv) to the State Tax Commission for the purposes of tax fraud detection and
49 prevention and any other use required by law;
50 (v) subject to Subsection (7), to the University of Utah for data collection in relation to
51 genetic and epidemiologic research; or
52 (vi) (A) to a government entity, including any court or law enforcement agency, to
53 fulfill the government entity's functions[
54 (B) to a private person acting on behalf of a government entity to fulfill the government
55 entity's functions, if the division determines disclosure of the information is in the interest of
56 public safety.
57 (2) (a) A person who receives personal identifying information shall be advised by the
58 division that the person may not:
59 (i) disclose the personal identifying information from that record to any other person;
60 or
61 (ii) use the personal identifying information from that record for advertising or
62 solicitation purposes.
63 (b) Any use of personal identifying information by an insurer or insurance support
64 organization, or by a self-insured entity or its agents, employees, or contractors not authorized
65 by Subsection (1)(b)(ii) is:
66 (i) an unfair marketing practice under Section 31A-23a-402; or
67 (ii) an unfair claim settlement practice under Subsection 31A-26-303(3).
68 (3) (a) Notwithstanding the provisions of Subsection (1)(b), the division or its designee
69 may disclose portions of a driving record, in accordance with this Subsection (3), to:
70 (i) an insurer as defined under Section 31A-1-301, or a designee of an insurer, for
71 purposes of assessing driving risk on the insurer's current motor vehicle insurance
72 policyholders;
73 (ii) an employer or a designee of an employer, for purposes of monitoring the driving
74 record and status of current employees who drive as a responsibility of the employee's
75 employment if the requester demonstrates that the requester has obtained the written consent of
76 the individual to whom the information pertains; and
77 (iii) an employer or the employer's agents to obtain or verify information relating to a
78 holder of a commercial driver license that is required under 49 U.S.C. Chapter 313.
79 (b) A disclosure under Subsection (3)(a)(i) shall:
80 (i) include the licensed driver's name, driver license number, date of birth, and an
81 indication of whether the driver has had a moving traffic violation that is a reportable violation,
82 as defined under Section 53-3-102 during the previous month;
83 (ii) be limited to the records of drivers who, at the time of the disclosure, are covered
84 under a motor vehicle insurance policy of the insurer; and
85 (iii) be made under a contract with the insurer or a designee of an insurer.
86 (c) A disclosure under Subsection (3)(a)(ii) or (iii) shall:
87 (i) include the licensed driver's name, driver license number, date of birth, and an
88 indication of whether the driver has had a moving traffic violation that is a reportable violation,
89 as defined under Section 53-3-102, during the previous month;
90 (ii) be limited to the records of a current employee of an employer;
91 (iii) be made under a contract with the employer or a designee of an employer; and
92 (iv) include an indication of whether the driver has had a change reflected in the
93 driver's:
94 (A) driving status;
95 (B) license class;
96 (C) medical self-certification status; or
97 (D) medical examiner's certificate under 49 C.F.R. Sec. 391.45.
98 (d) The contract under Subsection (3)(b)(iii) or (c)(iii) shall specify:
99 (i) the criteria for searching and compiling the driving records being requested;
100 (ii) the frequency of the disclosures;
101 (iii) the format of the disclosures, which may be in bulk electronic form; and
102 (iv) a reasonable charge for the driving record disclosures under this Subsection (3).
103 (4) The division may charge fees:
104 (a) in accordance with Section 53-3-105 for searching and compiling its files or
105 furnishing a report on the driving record of a person;
106 (b) for each document prepared under the seal of the division and deliver upon request,
107 a certified copy of any record of the division, and charge a fee set in accordance with Section
108 63J-1-504 for each document authenticated; and
109 (c) established in accordance with the procedures and requirements of Section
110 63J-1-504 for disclosing personal identifying information under Subsection (1)(b).
111 (5) Each certified copy of a driving record furnished in accordance with this section is
112 admissible in any court proceeding in the same manner as the original.
113 (6) (a) A driving record furnished under this section may only report on the driving
114 record of a person for a period of 10 years.
115 (b) Subsection (6)(a) does not apply to court or law enforcement reports, reports of
116 commercial driver license violations, or reports for commercial driver license holders.
117 (7) (a) The division shall include on each application for or renewal of a license or
118 identification card under this chapter:
119 (i) the following notice: "The Driver License Division may disclose the information
120 provided on this form to an entity described in Utah Code Ann. Subsection
121 53-3-109(1)(b)(v).";
122 (ii) a reference to the website described in Subsection (7)(b); and
123 (iii) a link to the division website for:
124 (A) information provided by the division, after consultation with the University of
125 Utah, containing the explanation and description described in Subsection (7)(b); and
126 (B) an online form for the individual to opt out of the disclosure of personal identifying
127 information as described in Subsection (1)(b)(v).
128 (b) On or before July 1, 2020, and in consultation with the division, the University of
129 Utah shall create a website that provides an explanation and description of:
130 (i) what information may be disclosed by the division to the University of Utah under
131 Subsection (1)(b)(v);
132 (ii) the methods and timing of anonymizing the information;
133 (iii) for situations where the information is not anonymized:
134 (A) how the information is used;
135 (B) how the information is secured;
136 (C) how long the information is retained; and
137 (D) who has access to the information;
138 (iv) research and statistical purposes for which the information is used; and
139 (v) other relevant details regarding the information.
140 (c) The website created by the University of Utah described in Subsection (7)(b) shall
141 include the following:
142 (i) a link to the division website for an online form for the individual to opt out of the
143 disclosure of personal identifying information as described in Subsection (1)(b)(v); and
144 (ii) a link to an online form for the individual to affirmatively choose to remove,
145 subject to Subsection (7)(e)(ii), personal identifying information from the database controlled
146 by the University of Utah that was disclosed pursuant to Subsection (1)(b)(v).
147 (d) In the course of business, the division shall provide information regarding the
148 disclosure of personal identifying information, including providing on the division website:
149 (i) a link to the website created under Subsection (7)(b) to provide individuals with
150 information regarding the disclosure of personal identifying information under Subsection
151 (1)(b)(v); and
152 (ii) a link to the division website for:
153 (A) information provided by the division, after consultation with the University of
154 Utah, containing the explanation and description described in Subsection (7)(b); and
155 (B) an online form for the individual to opt out of the disclosure of personal identifying
156 information as described in Subsection (1)(b)(v).
157 (e) (i) The division may not disclose the personal identifying information under
158 Subsection (1)(b)(v) if an individual opts out of the disclosure as described in Subsection
159 (7)(a)(iii)(B) or (7)(c)(i).
160 (ii) (A) Except as provided in Subsection (7)(e)(ii)(B), if an individual makes a request
161 as described in Subsection (7)(c)(ii), the University of Utah shall, within 90 days of receiving
162 the request, remove and destroy the individual's personal identifying information received
163 under Subsection (1)(b)(v) from a database controlled by the University of Utah.
164 (B) The University of Utah is not required to remove an individual's personal
165 identifying information as described in Subsection (7)(e)(ii)(A) from data released to a research
166 study before the date of the request described in Subsection (7)(c)(ii).
167 (f) (i) Subject to prioritization of the Audit Subcommittee created in Section 36-12-8,
168 the Office of the Legislative Auditor General shall conduct an audit and issue a report on:
169 (A) procedures and safeguards utilized by the University of Utah related to the security
170 of personal identifying information disclosed pursuant to Subsection (1)(b)(v); and
171 (B) potential risks of disclosure or breaches in the security of personal identifying
172 information disclosed pursuant to Subsection (1)(b)(v).
173 (ii) The Office of the Legislative Auditor General shall provide the report described in
174 Subsection (7)(f)(i) to the Transportation Interim Committee before October 31, 2021.
175 (g) (i) The University of Utah shall report to the Transportation Interim Committee
176 before October 31, 2020, regarding the information described in Subsection (7)(b).
177 (ii) The University of Utah shall conduct a biennial internal information security audit
178 of the information systems that store the data received pursuant to Subsection (1)(b)(v), and,
179 beginning in the year 2023, provide a biennial report of the findings of the internal audit to the
180 Transportation Interim Committee.
181 [
182 Act, the division may make rules to designate:
183 (a) what information shall be included in a report on the driving record of a person;
184 (b) the form of a report or copy of the report which may include electronic format;
185 (c) the form of a certified copy, as required under Section 53-3-216, which may include
186 electronic format;
187 (d) the form of a signature required under this chapter which may include electronic
188 format;
189 (e) the form of written request to the division required under this chapter which may
190 include electronic format;
191 (f) the procedures, requirements, and formats for disclosing personal identifying
192 information under Subsection (1)(b); and
193 (g) the procedures, requirements, and formats necessary for the implementation of
194 Subsection (3).
195 [
196 access, use, disclose, or disseminate a record created or maintained by the division or any
197 information contained in a record created or maintained by the division for a purpose
198 prohibited or not permitted by statute, rule, regulation, or policy of a governmental entity.
199 (b) A person who discovers or becomes aware of any unauthorized use of records
200 created or maintained by the division shall inform the commissioner and the division director
201 of the unauthorized use.