1
2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill enacts provisions relating to the collection, storage, use, and retention of
10 certain electronic information or data related to COVID-19.
11 Highlighted Provisions:
12 This bill:
13 ▸ defines terms;
14 ▸ creates requirements for the collection, storage, use, and retention of certain
15 electronic information or data by a government entity to investigate or control
16 COVID-19;
17 ▸ prohibits the collection of location information without clear and affirmative
18 consent from the individual;
19 ▸ requires a government entity to submit a contract to collect certain electronic
20 information or data to the attorney general to certify that the contract meets the
21 requirements in this bill;
22 ▸ prohibits a government entity from collecting certain location information for the
23 purpose of investigating or controlling COVID-19 unless the collection of location
24 information is approved by the Legislature and the governor by concurrent
25 resolution;
26 ▸ requires a government entity with an existing contract to collect certain location
27 information to terminate collection of that location information and destroy certain
28 location information that has been collected; and
29 ▸ makes it a felony to willfully and knowingly violate an injunction or court order to
30 enforce the requirements in this bill.
31 Money Appropriated in this Bill:
32 None
33 Other Special Clauses:
34 This bill provides a special effective date.
35 This bill provides revisor instructions.
36 Utah Code Sections Affected:
37 ENACTS:
38 13-44-203, Utah Code Annotated 1953
39 Utah Code Sections Affected by Revisor Instructions:
40 13-44-203, Utah Code Annotated 1953
41
42 Be it enacted by the Legislature of the state of Utah:
43 Section 1. Section 13-44-203 is enacted to read:
44 13-44-203. COVID-19 data privacy requirements - Willful violation of an
45 injunction a felony.
46 (1) As used in this section:
47 (a) "Covered data" means electronic information or data that:
48 (i) is collected by a government entity or under a contract between a third party and a
49 government entity;
50 (ii) is collected for the purpose of investigating or controlling COVID-19; and
51 (iii) (A) is identifiable health data as defined in Section 26-3-1;
52 (B) is location information; or
53 (C) otherwise makes the individual supplying or described in the electronic
54 information or data identifiable.
55 (b) "Covered location information" means location information that is collected for the
56 purpose of investigating or controlling COVID-19:
57 (i) by a government entity; or
58 (ii) under a contract between a government entity and a person who is not a
59 government entity.
60 (c) "COVID-19" means the same as that term is defined in Section 78B-4-517.
61 (d) "Electronic information or data" means the same as that term is defined in Section
62 77-23c-101.2.
63 (e) "Government entity" means the same as that term is defined in Section 77-23d-102.
64 (f) "Location information" means the same as that term is defined in Section
65 77-23c-101.2.
66 (2) A person who enters into a contract with a government entity to collect or provide
67 covered data:
68 (a) may not sell, offer for sale, or otherwise provide the covered data collected under
69 the contract to any person other than:
70 (i) the government entity;
71 (ii) a subcontractor for the purpose of carrying out the provisions of the contract; or
72 (iii) at the request and with clear and affirmative consent by the individual described in
73 the covered data.
74 (b) shall implement and maintain reasonable procedures to:
75 (i) prevent unlawful use or disclosure of covered data collected or maintained in the
76 regular course of business; and
77 (ii) destroy, or arrange for the destruction of, records containing covered data that are
78 not to be retained by the person by:
79 (A) shredding;
80 (B) erasing; or
81 (C) otherwise modifying the covered data to make the electronic information or data
82 indecipherable; and
83 (c) may not collect location information without clear and affirmative consent by the
84 individual about which the location information is being collected.
85 (3) Before entering into a contract to collect covered data, a government entity shall
86 submit the contract to the attorney general to certify that the contract complies with the
87 provisions of Subsection (2).
88 (4) (a) Beginning the effective date of this bill, a government entity may not collect
89 covered data that is location information unless the collection of covered data that is location
90 information receives approval of the Legislature and the governor through concurrent
91 resolution that specifies:
92 (i) the type of covered data will be collected;
93 (ii) how long the collection of the covered data will occur; and
94 (iii) how the covered data will be used.
95 (b) Within five days after the effective date of this bill, a government entity with an
96 existing contract to collect covered location information shall:
97 (i) terminate or direct the termination of the collection of any covered location
98 information under the contract;
99 (ii) direct the person with which the government entered into the contract to destroy
100 any covered location information collected under the contract in accordance with the
101 requirements described in Subsection (2)(b)(ii); and
102 (iii) require the person with which the government entered into the contract to certify
103 that the person has satisfied the requirement described in Subsection (4)(b)(ii).
104 (c) This Subsection (4):
105 (i) does not impair a government entity's obligations to pay money under a contract
106 entered into before the effective date of this bill; and
107 (ii) may not be waived or suspended under Title 53, Chapter 2a, Emergency
108 Management Act.
109 (5) In addition to the penalties described in Section 13-44-301, a person who willfully
110 and knowingly violates an injunction or court order issued under Section 13-44-301 to enforce
111 a requirement in this section is guilty of a felony of the third degree.
112 Section 2. Effective date.
113 If approved by two-thirds of all the members elected to each house, this bill takes effect
114 upon approval by the governor, or the day following the constitutional time limit of Utah
115 Constitution, Article VII, Section 8, without the governor's signature, or in the case of a veto,
116 the date of veto override.
117 Section 3. Revisor instructions.
118 The Legislature intends that the Office of Legislative Research and General Counsel, in
119 preparing the Utah Code database for publication, replace the reference in Section 13-44-203
120 "the effective date of this bill" to the bill's actual effective date.