Representative Craig Hall proposes the following substitute bill:


1     
ELECTRONIC INFORMATION AND DATA PRIVACY

2     
AMENDMENTS

3     
2020 GENERAL SESSION

4     
STATE OF UTAH

5     
Chief Sponsor: Craig Hall

6     
Senate Sponsor: Todd Weiler

7     

8     LONG TITLE
9     General Description:
10          This bill amends provisions related to the privacy of electronic data and information.
11     Highlighted Provisions:
12          This bill:
13          ▸     requires, with certain exceptions, law enforcement agencies to obtain a warrant for
14     electronic data or information transmitted through an electronic communication
15     service;
16          ▸     provides that law enforcement agencies are not required to obtain a warrant or
17     subpoena to obtain or use data from the National Center for Missing and Exploited
18     Children;
19          ▸     requires law enforcement agencies to notify an owner within 90 days of a search
20     warrant for an electronic device or electronic information or data;
21          ▸     requires law enforcement agencies to notify an owner of an electronic device or
22     electronic information or data that is the subject of a search warrant within three
23     days after an investigation is concluded;
24          ▸     repeals language related to an extension for a delayed notification;
25          ▸     allows law enforcement agencies to delay notification of a search warrant to an
26     owner of an electronic device or electronic information or data, which is the subject of the
27     search warrant, if the purpose of the delayed notification is to apprehend a fugitive of justice;
28          ▸     allows a law enforcement agency to obtain, use, copy, or disclose, without a
29     subpoena, certain information about subscribers and customers; and
30          ▸     makes technical and conforming changes.
31     Money Appropriated in this Bill:
32          None
33     Other Special Clauses:
34          None
35     Utah Code Sections Affected:
36     AMENDS:
37          77-23c-102, as last amended by Laws of Utah 2019, Chapters 362, 479 and last
38     amended by Coordination Clause, Laws of Utah 2019, Chapter 479
39          77-23c-103, as last amended by Laws of Utah 2019, Chapter 362
40          77-23c-104, as enacted by Laws of Utah 2019, Chapter 362
41     

42     Be it enacted by the Legislature of the state of Utah:
43          Section 1. Section 77-23c-102 is amended to read:
44          77-23c-102. Electronic information or data privacy -- Warrant required for
45     disclosure.
46          (1) (a) Except as provided in Subsection (2), for a criminal investigation or
47     prosecution, a law enforcement agency may not obtain, without a search warrant issued by a
48     court upon probable cause:
49          (i) the location information, stored data, or transmitted data of an electronic device; or
50          (ii) electronic information or data transmitted by the owner of the electronic
51     information or data:
52          (A) to a provider of a remote computing service [provider.]; or
53          (B) through a provider of an electronic communication service.
54          (b) Except as provided in Subsection (1)(c), a law enforcement agency may not use,
55     copy, or disclose, for any purpose, the location information, stored data, or transmitted data of
56     an electronic device, or electronic information or data provided by a provider of a remote
57     computing service [provider] or an electronic communication service, that:
58          (i) is not the subject of the warrant; and
59          (ii) is collected as part of an effort to obtain the location information, stored data, or
60     transmitted data of an electronic device, or electronic information or data provided by a
61     provider of a remote computing service [provider] or an electronic communication service that
62     is the subject of the warrant in Subsection (1)(a).
63          (c) A law enforcement agency may use, copy, or disclose the transmitted data of an
64     electronic device used to communicate with the electronic device that is the subject of the
65     warrant if the law enforcement agency reasonably believes that the transmitted data is
66     necessary to achieve the objective of the warrant.
67          (d) The electronic information or data described in Subsection (1)(b) shall be destroyed
68     in an unrecoverable manner by the law enforcement agency as soon as reasonably possible after
69     the electronic information or data is collected.
70          (2) (a) A law enforcement agency may obtain location information without a warrant
71     for an electronic device:
72          (i) in accordance with Section 53-10-104.5;
73          (ii) if the device is reported stolen by the owner;
74          (iii) with the informed, affirmative consent of the owner or user of the electronic
75     device;
76          (iv) in accordance with a judicially recognized exception to warrant requirements;
77          (v) if the owner has voluntarily and publicly disclosed the location information; or
78          (vi) from [the] a provider of a remote computing service [provider if the remote
79     computing service] or an electronic communications service if the provider voluntarily
80     discloses the location information:
81          (A) under a belief that an emergency exists involving an imminent risk to an individual
82     of death, serious physical injury, sexual abuse, live-streamed sexual exploitation, kidnapping,
83     or human trafficking; or
84          (B) that is inadvertently discovered by the [remote computing service] provider and
85     appears to pertain to the commission of a felony, or of a misdemeanor involving physical
86     violence, sexual abuse, or dishonesty.
87          (b) A law enforcement agency may obtain stored data or transmitted data from an
88     electronic device[,] or electronic information or data transmitted by the owner of the electronic
89     information or data to a provider of a remote computing service [provider] or through a
90     provider of an electronic communication service, without a warrant:
91          (i) with the informed consent of the owner of the electronic device or electronic
92     information or data;
93          (ii) in accordance with a judicially recognized exception to warrant requirements; or
94          [(iii) in connection with a report forwarded by the National Center for Missing and
95     Exploited Children under 18 U.S.C. Sec. 2258A; or]
96          [(iv)] (iii) subject to Subsection 77-23c-102(2)(a)(vi)(B), from a provider of a remote
97     computing service [provider if the remote computing service] or an electronic communication
98     service if the provider voluntarily discloses the stored or transmitted data as otherwise
99     permitted under 18 U.S.C. Sec. 2702.
100          (c) A prosecutor may obtain a judicial order as described in Section 77-22-2.5 for the
101     purposes [enumerated] described in Section 77-22-2.5.
102          (3) [An] A provider of an electronic communication service [provider] or a remote
103     computing service [provider], the provider's officers, employees, or agents, or other specified
104     persons may not be held liable for providing information, facilities, or assistance in good faith
105     reliance on the terms of the warrant issued under this section or without a warrant in
106     accordance with Subsection (2).
107          (4) Nothing in this chapter:
108          (a) limits or affects the disclosure of public records under Title 63G, Chapter 2,
109     Government Records Access and Management Act[.];
110          [(5)] (b) [Nothing in this chapter] affects the rights of an employer under Subsection
111     34-48-202(1)(e) or an administrative rule adopted under Section 63F-1-206[.]; or
112          (c) limits the ability of a law enforcement agency to receive or use information, without
113     a warrant or subpoena, from the National Center for Missing and Exploited Children under 18
114     U.S.C. Sec. 2258A.
115          Section 2. Section 77-23c-103 is amended to read:
116          77-23c-103. Notification required -- Delayed notification.
117          [(1) (a) Except as provided in Subsection (2), a law enforcement agency that executes a
118     warrant pursuant to Subsection 77-23c-102(1)(a) or 77-23c-104(3) shall, within 14 days after
119     the day on which the electronic information or data that is the subject of the warrant is obtained
120     by the law enforcement agency, issue a notification to the owner of the electronic device or
121     electronic information or data specified in the warrant that states:]
122          (1) (a) Except as provided in Subsection (2), if a law enforcement agency executes a
123     warrant in accordance with Subsection 77-23c-102(1) or 77-23c-104(3), the law enforcement
124     agency shall notify the owner of the electronic device or electronic information or data
125     specified in the warrant within 90 days after the day on which the electronic device or the
126     electronic data or information is obtained by the law enforcement agency but in no case shall
127     the law enforcement agency notify the owner more than three days after the day on which the
128     investigation is concluded.
129          (b) The notification described in Subsection (1)(a) shall state:
130          (i) that a warrant was applied for and granted;
131          (ii) the kind of warrant issued;
132          (iii) the period of time during which the collection of the electronic information or data
133     was authorized;
134          (iv) the offense specified in the application for the warrant;
135          (v) the identity of the law enforcement agency that filed the application; and
136          (vi) the identity of the judge who issued the warrant.
137          [(b)] (c) [The notification requirement under Subsection (1)(a) is not triggered until]
138     For the notification requirement described in Subsection (1)(a), a time period under Subsection
139     (1)(a) begins on the day after the day on which the owner of the electronic device or electronic
140     information or data specified in the warrant is known, or could be reasonably identified, by the
141     law enforcement agency.
142          (2) A law enforcement agency seeking a warrant [pursuant to] in accordance with
143     Subsection 77-23c-102(1)(a) or 77-23c-104(3) may submit a request, and the court may grant
144     permission, to delay the notification required by Subsection (1) for a period not to exceed 30
145     days, if the court determines that there is reasonable cause to believe that the notification may:
146          (a) endanger the life or physical safety of an individual;
147          (b) cause a person to flee from prosecution;
148          (c) lead to the destruction of or tampering with evidence;
149          (d) intimidate a potential witness; or
150          (e) otherwise seriously jeopardize an investigation or unduly delay a trial.
151          (3) [(a)] When a delay of notification is granted under Subsection (2) and upon
152     application by the law enforcement agency, the court may grant additional extensions of up to
153     30 days each.
154          [(b) Notwithstanding Subsection (3)(a), when a delay of notification is granted under
155     Subsection (2), and upon application by a law enforcement agency, the court may grant an
156     additional extension of up to 60 days if the court determines that a delayed notification is
157     justified because the investigation involving the warrant:]
158          [(i) is interstate in nature and sufficiently complex; or]
159          [(ii) is likely to extend up to or beyond an additional 60 days.]
160          (4) (a) A law enforcement agency that seeks a warrant for an electronic device or
161     electronic information or data in accordance with Subsection 77-23c-102(1)(a) or
162     77-23c-104(3) may submit a request to the court to delay a notification under Subsection (1) if
163     the purpose of delaying the notification is to apprehend an individual:
164          (i) who is a fugitive from justice under Section 77-30-13; and
165          (ii) for whom an arrest warrant has been issued for a violent felony offense as defined
166     in Section 76-3-203.5.
167          (b) The court may grant the request under Subsection (4)(a) to delay notification until
168     the individual who is a fugitive from justice under Section 77-30-13 is apprehended by the law
169     enforcement agency.
170          (c) A law enforcement agency shall issue a notification described in Subsection (5) to
171     the owner of the electronic device or electronic information or data within 14 days after the day
172     on which the law enforcement agency apprehends the individual described in Subsection (4)(a).
173          [(4)] (5) Upon expiration of the period of delayed notification granted under
174     Subsection (2) or (3), or upon the apprehension of an individual described in Subsection (4)(a),
175     the law enforcement agency shall serve upon or deliver by first-class mail, or by other means if
176     delivery is impracticable, to the owner of the electronic device or electronic information or data
177     a copy of the warrant together with notice that:
178          (a) states with reasonable specificity the nature of the law enforcement inquiry; and
179          (b) contains:
180          (i) the information described in [Subsections (1)(a)(i) through (vi)] Subsection (1)(a);
181          (ii) a statement that notification of the search was delayed;
182          (iii) the name of the court that authorized the delay of notification; and
183          (iv) a reference to the provision of this chapter that allowed the delay of notification.
184          [(5)] (6) A law enforcement agency is not required to notify the owner of the electronic
185     device or electronic information or data if the owner is located outside of the United States.
186          Section 3. Section 77-23c-104 is amended to read:
187          77-23c-104. Third-party electronic information or data.
188          (1) As used in this section, "subscriber record" means a record or information of a
189     provider of an electronic communication service or remote computing service that reveals the
190     subscriber's or customer's:
191          (a) name;
192          (b) address;
193          (c) local and long distance telephone connection record, or record of session time and
194     duration;
195          (d) length of service, including the start date;
196          (e) type of service used;
197          (f) telephone number, instrument number, or other subscriber or customer number or
198     identification, including a temporarily assigned network address; and
199          (g) means and source of payment for the service, including a credit card or bank
200     account number.
201          (2) Except as provided in Chapter 22, Subpoena Powers for Aid of Criminal
202     Investigation and Grants of Immunity, a law enforcement agency may not obtain, use, copy, or
203     disclose a subscriber record.
204          (3) A law enforcement agency may not obtain, use, copy, or disclose, for a criminal
205     investigation or prosecution, any record or information, other than a subscriber record, of a
206     provider of an electronic communication service or remote computing service related to a
207     subscriber or customer without a warrant.
208          (4) Notwithstanding Subsections (2) and (3), a law enforcement agency may obtain,
209     use, copy, or disclose a subscriber record, or other record or information related to a subscriber
210     or customer, without [a] an investigative subpoena or a warrant:
211          (a) with the informed, affirmed consent of the subscriber or customer;
212          (b) in accordance with a judicially recognized exception to warrant requirements;
213          (c) if the subscriber or customer voluntarily discloses the record in a manner that is
214     publicly accessible; or
215          (d) if the provider of an electronic communication service or remote computing service
216     voluntarily discloses the record:
217          (i) under a belief that an emergency exists involving the imminent risk to an individual
218     of:
219          (A) death;
220          (B) serious physical injury;
221          (C) sexual abuse;
222          (D) live-streamed sexual exploitation;
223          (E) kidnapping; or
224          (F) human trafficking;
225          (ii) that is inadvertently discovered by the provider, if the record appears to pertain to
226     the commission of:
227          (A) a felony; or
228          (B) a misdemeanor involving physical violence, sexual abuse, or dishonesty; or
229          (iii) subject to Subsection 77-23c-104(4)(d)(ii), as otherwise permitted under 18 U.S.C.
230     Sec. 2702.
231          (5) A provider of an electronic communication service or remote computing service, or
232     the provider's officers, employees, agents, or other specified persons may not be held liable for
233     providing information, facilities, or assistance in good faith reliance on the terms of a warrant
234     issued under this section, or without a warrant in accordance with Subsection (3).