2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill requires reporting regarding personal identifying information collected, used,
10 or disclosed by a government agency.
11 Highlighted Provisions:
12 This bill:
13 ▸ defines terms;
14 ▸ requires a government agency to make an annual report to the state auditor
15 regarding:
16 • the government agency's collection, use, and disclosure of personal identifying
17 information;
18 • any misuse or improper disclosure of personal identifying information; and
19 • measures taken to notify individuals of any misuse or improper disclosure of
20 personal identifying information and to prevent future misuse or improper
21 disclosure; and
22 ▸ requires the state auditor to post the annual reports, and a list of each government
23 agency that fails to provide the report, on the state auditor's website.
24 Money Appropriated in this Bill:
25 None
26 Other Special Clauses:
27 None
28 Utah Code Sections Affected:
29 ENACTS:
30 63F-5-101, Utah Code Annotated 1953
31 63F-5-102, Utah Code Annotated 1953
32 63F-5-103, Utah Code Annotated 1953
33
34 Be it enacted by the Legislature of the state of Utah:
35 Section 1. Section 63F-5-101 is enacted to read:
36
37 63F-5-101. Title.
38 This chapter is known as "Government Records Transparency Act."
39 Section 2. Section 63F-5-102 is enacted to read:
40 63F-5-102. Definitions.
41 As used in this chapter:
42 (1) "Government agency" means an executive, legislative, or judicial office, agency,
43 bureau, or department of the state or of a county, municipality, or other political subdivision of
44 the state.
45 (2) "Personal identifying information" means an individual's:
46 (a) first name, middle name, first or middle initial, last name, or maiden name;
47 (b) alias or nickname, including a name used in childhood;
48 (c) photograph or image;
49 (d) social security number;
50 (e) medical or disability information;
51 (f) date of birth;
52 (g) place of birth;
53 (h) mother's maiden name;
54 (i) address;
55 (j) telephone number;
56 (k) personal characteristics;
57 (l) gender;
58 (m) driver license number;
59 (n) passport number;
60 (o) identification number;
61 (p) credit card number;
62 (q) financial account number;
63 (r) DNA; or
64 (s) other information that may be used to identify the individual.
65 (3) "Type of personal identifying information" means each type described in
66 Subsection (2).
67 Section 3. Section 63F-5-103 is enacted to read:
68 63F-5-103. Government agency personal identifying information report -- Public
69 disclosure.
70 (1) Each government agency shall annually, on or after December 1, and on or before
71 December 31, upload a report to the state auditor, in a format specified by the state auditor,
72 detailing the collection, use, and disclosure of personal identifying information by the
73 government agency for that year.
74 (2) The report shall include:
75 (a) a list of each type of personal identifying information collected, used, or disclosed;
76 (b) the statutory authority for collecting, using, or disclosing the personal identifying
77 information;
78 (c) a description of how the personal identifying information is used by the government
79 agency;
80 (d) a list of each entity, and a general description of the category of individuals, with
81 which the government agency shares the personal identifying information;
82 (e) a list of each type of personal identifying information shared with each entity and
83 category of individual described in Subsection (2)(d); and
84 (f) a list of each misuse or improper disclosure of personal identifying information by
85 or from the government agency during that year, including for each:
86 (i) actions taken to notify the individuals whose personal identifying information was
87 improperly disclosed or used;
88 (ii) details regarding any remedial measures taken to assist individuals whose personal
89 identifying information was misused or improperly disclosed; and
90 (iii) details regarding actions taken or proposed to prevent future misuse or improper
91 disclosure of personal identifying information.
92 (3) The state auditor shall:
93 (a) within 30 days after the day on which the state auditor receives a report described in
94 Subsection (1), post the report on the state auditor's website; and
95 (b) on or before January 31 each year, post on the state auditor's website a list of each
96 government agency that did not timely comply with the requirements of this section for the
97 preceding year.
98 (4) Except for an annual report submitted in 2020, a government agency shall include
99 in each annual report any information that was not included in the preceding year's report
100 because the event occurred too late to be included in the preceding year's report.