• Home
• 2020 Fifth Special Session
• H.B. 5001

H.B. 5001 Data Privacy Amendments

• Bill Text
• Status
• Hearings/Debate

Bill Sponsor: Rep. Spendlove, Robert M.

Floor Sponsor: Sen. Grover, Keith

• Substitute Sponsor: Rep. Stratton, Keven J.

• Drafting Attorney: Daniel M. Cheung
• Fiscal Analyst: Clare Tobin Lence

---

• Bill Tracking

Track thisTracking Page

---

• Bill Text
  • Introduced (Currently Displayed)

---

• Other Versions
  • H.B. 5001
    Substitute Sponsor:
    

    • Introduced
    • Fiscal Note
    • House Transmittal Letter 1
    • Agency Perf Note
  • H.B. 5001 1st Substitute
    Substitute Sponsor:
    

    • Introduced
    • Fiscal Note
    • HB5001 comparison
    • Agency Perf Note

---

• Related Documents
  • Fiscal Note
  • Agency Perf Note

---

• Information
  • Last Action: 18 Jun 2020, House/ filed
  • Last Location: House file for bills not passed

---

• Similar Bills
  • Health
  • Medical Records

---

Introduced

Printer Friendly

H.B. 5001

2nd Sub.

Representative Keven J. Stratton proposes the following substitute bill:

1     DATA PRIVACY AMENDMENTS
2     2020 FIFTH SPECIAL SESSION
3     STATE OF UTAH
4     Chief Sponsor: Robert M. Spendlove
5     Senate Sponsor: Keith Grover
6     

---

7     LONG TITLE
8     General Description:
9          This bill enacts provisions relating to the collection, storage, use, and retention of
10     certain electronic information or data related to COVID-19.
11     Highlighted Provisions:
12          This bill:
13          ▸     defines terms;
14          ▸     creates requirements for the collection, storage, use, and retention of certain
15     electronic information or data by a government entity to investigate or control
16     COVID-19;
17          ▸     prohibits the collection of location information without clear and affirmative
18     consent from the individual;
19          ▸     requires a government entity to submit a contract to collect certain electronic
20     information or data to the attorney general to certify that the contract meets the
21     requirements in this bill;
22          ▸     prohibits a government entity from collecting certain location information for the
23     purpose of investigating or controlling COVID-19 unless the collection of location
24     information is approved by the Legislature and the governor by concurrent
25     resolution;

---

26          ▸     requires a government entity with an existing contract to collect certain location
27     information to terminate collection of that location information and destroy certain
28     location information that has been collected; and
29          ▸     makes it a felony to willfully and knowingly violate an injunction or court order to
30     enforce the requirements in this bill.
31     Money Appropriated in this Bill:
32          None
33     Other Special Clauses:
34          This bill provides a special effective date.
35          This bill provides revisor instructions.
36     Utah Code Sections Affected:
37     ENACTS:
38          13-44-203, Utah Code Annotated 1953
39     Utah Code Sections Affected by Revisor Instructions:
40          13-44-203, Utah Code Annotated 1953
41     

---

42     Be it enacted by the Legislature of the state of Utah:
43          Section 1. Section 13-44-203 is enacted to read:
44          13-44-203. COVID-19 data privacy requirements - Willful violation of an
45     injunction a felony.
46          (1) As used in this section:
47          (a) "Covered data" means electronic information or data that:
48          (i) is collected by a government entity or under a contract between a third party and a
49     government entity;
50          (ii) is collected for the purpose of investigating or controlling COVID-19; and
51          (iii) (A) is identifiable health data as defined in Section 26-3-1;
52          (B) is location information; or
53          (C) otherwise makes the individual supplying or described in the electronic
54     information or data identifiable.
55          (b) "Covered location information" means location information that is collected for the
56     purpose of investigating or controlling COVID-19:

---

57          (i) by a government entity; or
58          (ii) under a contract between a government entity and a person who is not a
59     government entity.
60          (c) "COVID-19" means the same as that term is defined in Section 78B-4-517.
61          (d) "Electronic information or data" means the same as that term is defined in Section
62     77-23c-101.2.
63          (e) "Government entity" means the same as that term is defined in Section 77-23d-102.
64          (f) "Location information" means the same as that term is defined in Section
65     77-23c-101.2.
66          (2) A person who enters into a contract with a government entity to collect or provide
67     covered data:
68          (a) may not sell, offer for sale, or otherwise provide the covered data collected under
69     the contract to any person other than:
70          (i) the government entity;
71          (ii) a subcontractor for the purpose of carrying out the provisions of the contract; or
72          (iii) at the request and with clear and affirmative consent by the individual described in
73     the covered data.
74          (b) shall implement and maintain reasonable procedures to:
75          (i) prevent unlawful use or disclosure of covered data collected or maintained in the
76     regular course of business; and
77          (ii) destroy, or arrange for the destruction of, records containing covered data that are
78     not to be retained by the person by:
79          (A) shredding;
80          (B) erasing; or
81          (C) otherwise modifying the covered data to make the electronic information or data
82     indecipherable; and
83          (c) may not collect location information without clear and affirmative consent by the
84     individual about which the location information is being collected.
85          (3) Before entering into a contract to collect covered data, a government entity shall
86     submit the contract to the attorney general to certify that the contract complies with the
87     provisions of Subsection (2).

---

88          (4) (a) Beginning the effective date of this bill, a government entity may not collect
89     covered data that is location information unless the collection of covered data that is location
90     information receives approval of the Legislature and the governor through concurrent
91     resolution that specifies:
92          (i) the type of covered data will be collected;
93          (ii) how long the collection of the covered data will occur; and
94          (iii) how the covered data will be used.
95          (b) Within five days after the effective date of this bill, a government entity with an
96     existing contract to collect covered location information shall:
97          (i) terminate or direct the termination of the collection of any covered location
98     information under the contract;
99          (ii) direct the person with which the government entered into the contract to destroy
100     any covered location information collected under the contract in accordance with the
101     requirements described in Subsection (2)(b)(ii); and
102          (iii) require the person with which the government entered into the contract to certify
103     that the person has satisfied the requirement described in Subsection (4)(b)(ii).
104          (c) This Subsection (4):
105          (i) does not impair a government entity's obligations to pay money under a contract
106     entered into before the effective date of this bill; and
107          (ii) may not be waived or suspended under Title 53, Chapter 2a, Emergency
108     Management Act.
109          (5) In addition to the penalties described in Section 13-44-301, a person who willfully
110     and knowingly violates an injunction or court order issued under Section 13-44-301 to enforce
111     a requirement in this section is guilty of a felony of the third degree.
112          Section 2. Effective date.
113          If approved by two-thirds of all the members elected to each house, this bill takes effect
114     upon approval by the governor, or the day following the constitutional time limit of Utah
115     Constitution, Article VII, Section 8, without the governor's signature, or in the case of a veto,
116     the date of veto override.
117          Section 3. Revisor instructions.
118          The Legislature intends that the Office of Legislative Research and General Counsel, in

---

119     preparing the Utah Code database for publication, replace the reference in Section 13-44-203
120     "the effective date of this bill" to the bill's actual effective date.