1
2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill requires the Driver License Division to provide notification to each applicant
10 for a driver license or an identification card regarding the disclosure of certain
11 information and the ability to opt out of the disclosure.
12 Highlighted Provisions:
13 This bill:
14 ▸ requires the University of Utah to provide information regarding the disclosure of
15 personal identifying information;
16 ▸ provides means for an individual to opt out of certain disclosures to the University
17 of Utah for data collection in relation to genetic and epidemiologic research;
18 ▸ provides means for an individual to remove personal identifying information from
19 the database controlled by the University of Utah;
20 ▸ requires audits of the security of the University of Utah database;
21 ▸ requires reports to the Transportation Interim Committee; and
22 ▸ makes technical changes.
23 Money Appropriated in this Bill:
24 None
25 Other Special Clauses:
26 None
27 Utah Code Sections Affected:
28 AMENDS:
29 53-3-109, as last amended by Laws of Utah 2019, Chapter 380
30
31 Be it enacted by the Legislature of the state of Utah:
32 Section 1. Section 53-3-109 is amended to read:
33 53-3-109. Records -- Access -- Fees -- Rulemaking.
34 (1) (a) Except as provided in this section, all records of the division shall be classified
35 and disclosed in accordance with Title 63G, Chapter 2, Government Records Access and
36 Management Act.
37 (b) The division may disclose personal identifying information in accordance with 18
38 U.S.C. Chapter 123:
39 (i) to a licensed private investigator holding a valid agency license, with a legitimate
40 business need;
41 (ii) to an insurer, insurance support organization, or a self-insured entity, or its agents,
42 employees, or contractors that issues any motor vehicle insurance under Title 31A, Chapter 22,
43 Part 3, Motor Vehicle Insurance, for use in connection with claims investigation activities,
44 antifraud activities, rating, or underwriting for any person issued a license certificate under this
45 chapter;
46 (iii) to a depository institution as that term is defined in Section 7-1-103;
47 (iv) to the State Tax Commission for the purposes of tax fraud detection and
48 prevention and any other use required by law;
49 (v) subject to Subsection (7), to the University of Utah for data collection in relation to
50 genetic and epidemiologic research; or
51 (vi) (A) to a government entity, including any court or law enforcement agency, to
52 fulfill the government entity's functions[
53 (B) to a private person acting on behalf of a government entity to fulfill the government
54 entity's functions, if the division determines disclosure of the information is in the interest of
55 public safety.
56 (2) (a) A person who receives personal identifying information shall be advised by the
57 division that the person may not:
58 (i) disclose the personal identifying information from that record to any other person;
59 or
60 (ii) use the personal identifying information from that record for advertising or
61 solicitation purposes.
62 (b) Any use of personal identifying information by an insurer or insurance support
63 organization, or by a self-insured entity or its agents, employees, or contractors not authorized
64 by Subsection (1)(b)(ii) is:
65 (i) an unfair marketing practice under Section 31A-23a-402; or
66 (ii) an unfair claim settlement practice under Subsection 31A-26-303(3).
67 (3) (a) Notwithstanding the provisions of Subsection (1)(b), the division or its designee
68 may disclose portions of a driving record, in accordance with this Subsection (3), to:
69 (i) an insurer as defined under Section 31A-1-301, or a designee of an insurer, for
70 purposes of assessing driving risk on the insurer's current motor vehicle insurance
71 policyholders;
72 (ii) an employer or a designee of an employer, for purposes of monitoring the driving
73 record and status of current employees who drive as a responsibility of the employee's
74 employment if the requester demonstrates that the requester has obtained the written consent of
75 the individual to whom the information pertains; and
76 (iii) an employer or the employer's agents to obtain or verify information relating to a
77 holder of a commercial driver license that is required under 49 U.S.C. Chapter 313.
78 (b) A disclosure under Subsection (3)(a)(i) shall:
79 (i) include the licensed driver's name, driver license number, date of birth, and an
80 indication of whether the driver has had a moving traffic violation that is a reportable violation,
81 as defined under Section 53-3-102 during the previous month;
82 (ii) be limited to the records of drivers who, at the time of the disclosure, are covered
83 under a motor vehicle insurance policy of the insurer; and
84 (iii) be made under a contract with the insurer or a designee of an insurer.
85 (c) A disclosure under Subsection (3)(a)(ii) or (iii) shall:
86 (i) include the licensed driver's name, driver license number, date of birth, and an
87 indication of whether the driver has had a moving traffic violation that is a reportable violation,
88 as defined under Section 53-3-102, during the previous month;
89 (ii) be limited to the records of a current employee of an employer;
90 (iii) be made under a contract with the employer or a designee of an employer; and
91 (iv) include an indication of whether the driver has had a change reflected in the
92 driver's:
93 (A) driving status;
94 (B) license class;
95 (C) medical self-certification status; or
96 (D) medical examiner's certificate under 49 C.F.R. Sec. 391.45.
97 (d) The contract under Subsection (3)(b)(iii) or (c)(iii) shall specify:
98 (i) the criteria for searching and compiling the driving records being requested;
99 (ii) the frequency of the disclosures;
100 (iii) the format of the disclosures, which may be in bulk electronic form; and
101 (iv) a reasonable charge for the driving record disclosures under this Subsection (3).
102 (4) The division may charge fees:
103 (a) in accordance with Section 53-3-105 for searching and compiling its files or
104 furnishing a report on the driving record of a person;
105 (b) for each document prepared under the seal of the division and deliver upon request,
106 a certified copy of any record of the division, and charge a fee set in accordance with Section
107 63J-1-504 for each document authenticated; and
108 (c) established in accordance with the procedures and requirements of Section
109 63J-1-504 for disclosing personal identifying information under Subsection (1)(b).
110 (5) Each certified copy of a driving record furnished in accordance with this section is
111 admissible in any court proceeding in the same manner as the original.
112 (6) (a) A driving record furnished under this section may only report on the driving
113 record of a person for a period of 10 years.
114 (b) Subsection (6)(a) does not apply to court or law enforcement reports, reports of
115 commercial driver license violations, or reports for commercial driver license holders.
116 (7) (a) The division shall include on each application for or renewal of a license or
117 identification card under this chapter:
118 (i) the following notice: "The Driver License Division may disclose the information
119 provided on this form to an entity described in Utah Code Ann. Subsection
120 53-3-109(1)(b)(v)."; and
121 (ii) a reference to a website created by the University of Utah that provides:
122 (A) subject to Subsection (7)(d)(i), a description of what information may be disclosed
123 under Subsection (1)(b)(v);
124 (B) subject to Subsection (7)(d)(i), an explanation about the personal identifying
125 information disclosed under Subsection (1)(b)(v) as described in Subsection (7)(b);
126 (C) a link to the division website for an online form for the individual to opt out of the
127 disclosure of personal identifying information as described in Subsection (1)(b)(v); and
128 (D) a link to the division website for an online form for the individual to affirmatively
129 choose to remove any personal identifying information from the database controlled by the
130 University of Utah described in Subsection (1)(b)(v).
131 (b) The explanation on the website described in Subsection (7)(a)(ii)(B) shall include
132 the following information:
133 (i) how the information is used;
134 (ii) how the information is secured;
135 (iii) the methods and timing of anonymizing the information;
136 (iv) how long the information is retained;
137 (v) who has access to the information; and
138 (vi) the research techniques and purposes for which the information is used.
139 (c) The University of Utah shall create the website described in Subsection (7)(a)(ii)
140 before July 1, 2020.
141 (d) (i) The University of Utah shall consult with the division to create the description
142 and explanation described in Subsection (7)(a)(ii).
143 (ii) In the course of business, the division shall provide information regarding the
144 disclosure of personal identifying information, including providing on the division website a
145 link to the website created under Subsection (7)(a)(ii) to provide individuals with information
146 regarding the disclosure of personal identifying information under Subsection (1)(b)(v).
147 (e) (i) The division may not disclose the personal identifying information under
148 Subsection (1)(b)(v) if an individual opts out of the disclosure as described in Subsection
149 (7)(a)(ii)(C).
150 (ii) Pursuant to Subsection (7)(a)(ii)(D), if an individual affirmatively chooses to
151 remove personal identifying information from a database controlled by the University of Utah
152 as described in Subsection (1)(b)(v):
153 (A) the division may not disclose any personal identifying information under
154 Subsection (1)(b)(v); and
155 (B) the University of Utah may not use and shall immediately destroy all personal
156 identifying information related to the individual.
157 (f) (i) Subject to prioritization of the Audit Subcommittee created in Section 36-12-8,
158 the Office of the Legislative Auditor General shall conduct an audit and issue a report on:
159 (A) procedures and safeguards utilized by the University of Utah related to the security
160 of personal identifying information disclosed pursuant to Subsection (1)(b)(v); and
161 (B) potential risks of disclosure or breaches in the security of personal identifying
162 information disclosed pursuant to Subsection (1)(b)(v).
163 (ii) The Office of the Legislative Auditor General shall provide the report described in
164 Subsection (7)(f)(i) to the Transportation Interim Committee before October 31, 2020.
165 (g) The University of Utah shall contract with a third party to biennially conduct
166 information security audits of the data received pursuant to Subsection (1)(b)(v).
167 (h) The University of Utah shall provide a report to the Transportation Interim
168 Committee before October 31, 2020 regarding the requirements of this Subsection (7).
169 [
170 Act, the division may make rules to designate:
171 (a) what information shall be included in a report on the driving record of a person;
172 (b) the form of a report or copy of the report which may include electronic format;
173 (c) the form of a certified copy, as required under Section 53-3-216, which may include
174 electronic format;
175 (d) the form of a signature required under this chapter which may include electronic
176 format;
177 (e) the form of written request to the division required under this chapter which may
178 include electronic format;
179 (f) the procedures, requirements, and formats for disclosing personal identifying
180 information under Subsection (1)(b); and
181 (g) the procedures, requirements, and formats necessary for the implementation of
182 Subsection (3).
183 [
184 access, use, disclose, or disseminate a record created or maintained by the division or any
185 information contained in a record created or maintained by the division for a purpose
186 prohibited or not permitted by statute, rule, regulation, or policy of a governmental entity.
187 (b) A person who discovers or becomes aware of any unauthorized use of records
188 created or maintained by the division shall inform the commissioner and the division director
189 of the unauthorized use.