1     
ELECTRONIC INFORMATION AND DATA PRIVACY

2     
AMENDMENTS

3     
2021 GENERAL SESSION

4     
STATE OF UTAH

5     
Chief Sponsor: Craig Hall

6     
Senate Sponsor: Todd D. Weiler

7     

8     LONG TITLE
9     General Description:
10          This bill amends provisions related to the privacy of electronic data and information.
11     Highlighted Provisions:
12          This bill:
13          ▸     requires, with certain exceptions, law enforcement agencies to obtain a warrant for
14     electronic data or information transmitted through an electronic communication
15     service;
16          ▸     provides that law enforcement agencies are not required to obtain a warrant or
17     subpoena to obtain or use data from the National Center for Missing and Exploited
18     Children;
19          ▸     requires law enforcement agencies to notify an owner within 90 days of a search
20     warrant for an electronic device or electronic information or data;
21          ▸     requires law enforcement agencies to notify an owner of an electronic device or
22     electronic information or data that is the subject of a search warrant within three
23     days after an investigation is concluded;
24          ▸     repeals language related to an extension for a delayed notification;
25          ▸     allows law enforcement agencies to delay notification of a search warrant to an
26     owner of an electronic device or electronic information or data, which is the subject
27     of the search warrant, if the purpose of the delayed notification is to apprehend a
28     fugitive of justice;
29          ▸     allows a law enforcement agency to obtain, use, copy, or disclose, without a
30     subpoena, certain information about subscribers and customers; and
31          ▸     makes technical and conforming changes.
32     Money Appropriated in this Bill:
33          None
34     Other Special Clauses:
35          None
36     Utah Code Sections Affected:
37     AMENDS:
38          77-23c-102, as last amended by Laws of Utah 2019, Chapters 362, 479 and last
39     amended by Coordination Clause, Laws of Utah 2019, Chapter 479
40          77-23c-103, as last amended by Laws of Utah 2019, Chapter 362
41          77-23c-104, as enacted by Laws of Utah 2019, Chapter 362
42     

43     Be it enacted by the Legislature of the state of Utah:
44          Section 1. Section 77-23c-102 is amended to read:
45          77-23c-102. Electronic information or data privacy -- Warrant required for
46     disclosure.
47          (1) (a) Except as provided in Subsection (2), for a criminal investigation or
48     prosecution, a law enforcement agency may not obtain, without a search warrant issued by a
49     court upon probable cause:
50          (i) the location information, stored data, or transmitted data of an electronic device; or
51          (ii) electronic information or data transmitted by the owner of the electronic
52     information or data:
53          (A) to a provider of a remote computing service [provider.]; or
54          (B) through a provider of an electronic communication service.
55          (b) Except as provided in Subsection (1)(c), a law enforcement agency may not use,
56     copy, or disclose, for any purpose, the location information, stored data, or transmitted data of
57     an electronic device, or electronic information or data provided by a provider of a remote
58     computing service [provider] or an electronic communication service, that:
59          (i) is not the subject of the warrant; and
60          (ii) is collected as part of an effort to obtain the location information, stored data, or
61     transmitted data of an electronic device, or electronic information or data provided by a
62     provider of a remote computing service [provider] or an electronic communication service that
63     is the subject of the warrant in Subsection (1)(a).
64          (c) A law enforcement agency may use, copy, or disclose the transmitted data of an
65     electronic device used to communicate with the electronic device that is the subject of the
66     warrant if the law enforcement agency reasonably believes that the transmitted data is
67     necessary to achieve the objective of the warrant.
68          (d) The electronic information or data described in Subsection (1)(b) shall be destroyed
69     in an unrecoverable manner by the law enforcement agency as soon as reasonably possible after
70     the electronic information or data is collected.
71          (2) (a) A law enforcement agency may obtain location information without a warrant
72     for an electronic device:
73          (i) in accordance with Section 53-10-104.5;
74          (ii) if the device is reported stolen by the owner;
75          (iii) with the informed, affirmative consent of the owner or user of the electronic
76     device;
77          (iv) in accordance with a judicially recognized exception to warrant requirements;
78          (v) if the owner has voluntarily and publicly disclosed the location information; or
79          (vi) from [the] a provider of a remote computing service [provider if the remote
80     computing service] or an electronic communications service if the provider voluntarily
81     discloses the location information:
82          (A) under a belief that an emergency exists involving an imminent risk to an individual
83     of death, serious physical injury, sexual abuse, live-streamed sexual exploitation, kidnapping,
84     or human trafficking; or
85          (B) that is inadvertently discovered by the [remote computing service] provider and
86     appears to pertain to the commission of a felony, or of a misdemeanor involving physical
87     violence, sexual abuse, or dishonesty.
88          (b) A law enforcement agency may obtain stored data or transmitted data from an
89     electronic device[,] or electronic information or data transmitted by the owner of the electronic
90     information or data to a provider of a remote computing service [provider] or through a
91     provider of an electronic communication service, without a warrant:
92          (i) with the informed consent of the owner of the electronic device or electronic
93     information or data;
94          (ii) in accordance with a judicially recognized exception to warrant requirements; or
95          [(iii) in connection with a report forwarded by the National Center for Missing and
96     Exploited Children under 18 U.S.C. Sec. 2258A; or]
97          [(iv)] (iii) subject to Subsection 77-23c-102(2)(a)(vi)(B), from a provider of a remote
98     computing service [provider if the remote computing service] or an electronic communication
99     service if the provider voluntarily discloses the stored or transmitted data as otherwise
100     permitted under 18 U.S.C. Sec. 2702.
101          (c) A prosecutor may obtain a judicial order as described in Section 77-22-2.5 for the
102     purposes [enumerated] described in Section 77-22-2.5.
103          (3) [An] A provider of an electronic communication service [provider] or a remote
104     computing service [provider], the provider's officers, employees, or agents, or other specified
105     persons may not be held liable for providing information, facilities, or assistance in good faith
106     reliance on the terms of the warrant issued under this section or without a warrant in
107     accordance with Subsection (2).
108          (4) Nothing in this chapter:
109          (a) limits or affects the disclosure of public records under Title 63G, Chapter 2,
110     Government Records Access and Management Act[.];
111          [(5)] (b) [Nothing in this chapter] affects the rights of an employer under Subsection
112     34-48-202(1)(e) or an administrative rule adopted under Section 63F-1-206[.]; or
113          (c) limits the ability of a law enforcement agency to receive or use information, without
114     a warrant or subpoena, from the National Center for Missing and Exploited Children under 18
115     U.S.C. Sec. 2258A.
116          Section 2. Section 77-23c-103 is amended to read:
117          77-23c-103. Notification required -- Delayed notification.
118          [(1) (a) Except as provided in Subsection (2), a law enforcement agency that executes a
119     warrant pursuant to Subsection 77-23c-102(1)(a) or 77-23c-104(3) shall, within 14 days after
120     the day on which the electronic information or data that is the subject of the warrant is obtained
121     by the law enforcement agency, issue a notification to the owner of the electronic device or
122     electronic information or data specified in the warrant that states:]
123          (1) (a) Except as provided in Subsection (2), if a law enforcement agency executes a
124     warrant in accordance with Subsection 77-23c-102(1) or 77-23c-104(3), the law enforcement
125     agency shall notify the owner of the electronic device or electronic information or data
126     specified in the warrant within 90 days after the day on which the electronic device or the
127     electronic data or information is obtained by the law enforcement agency but in no case shall
128     the law enforcement agency notify the owner more than three days after the day on which the
129     investigation is concluded.
130          (b) The notification described in Subsection (1)(a) shall state:
131          (i) that a warrant was applied for and granted;
132          (ii) the kind of warrant issued;
133          (iii) the period of time during which the collection of the electronic information or data
134     was authorized;
135          (iv) the offense specified in the application for the warrant;
136          (v) the identity of the law enforcement agency that filed the application; and
137          (vi) the identity of the judge who issued the warrant.
138          [(b)] (c) [The notification requirement under Subsection (1)(a) is not triggered until]
139     For the notification requirement described in Subsection (1)(a), the time period under
140     Subsection (1)(a) begins on the day after the day on which the owner of the electronic device or
141     electronic information or data specified in the warrant is known, or could be reasonably
142     identified, by the law enforcement agency.
143          (2) A law enforcement agency seeking a warrant [pursuant to] in accordance with
144     Subsection 77-23c-102(1)(a) or 77-23c-104(3) may submit a request, and the court may grant
145     permission, to delay the notification required by Subsection (1) for a period not to exceed 30
146     days, if the court determines that there is reasonable cause to believe that the notification may:
147          (a) endanger the life or physical safety of an individual;
148          (b) cause a person to flee from prosecution;
149          (c) lead to the destruction of or tampering with evidence;
150          (d) intimidate a potential witness; or
151          (e) otherwise seriously jeopardize an investigation or unduly delay a trial.
152          (3) [(a)] When a delay of notification is granted under Subsection (2) and upon
153     application by the law enforcement agency, the court may grant additional extensions of up to
154     30 days each.
155          [(b) Notwithstanding Subsection (3)(a), when a delay of notification is granted under
156     Subsection (2), and upon application by a law enforcement agency, the court may grant an
157     additional extension of up to 60 days if the court determines that a delayed notification is
158     justified because the investigation involving the warrant:]
159          [(i) is interstate in nature and sufficiently complex; or]
160          [(ii) is likely to extend up to or beyond an additional 60 days.]
161          (4) (a) A law enforcement agency that seeks a warrant for an electronic device or
162     electronic information or data in accordance with Subsection 77-23c-102(1)(a) or
163     77-23c-104(3) may submit a request to the court to delay a notification under Subsection (2) if
164     the purpose of delaying the notification is to apprehend an individual:
165          (i) who is a fugitive from justice under Section 77-30-13; and
166          (ii) for whom an arrest warrant has been issued for a violent felony offense as defined
167     in Section 76-3-203.5.
168          (b) The court may grant the request under Subsection (4)(a) to delay notification until
169     the individual who is a fugitive from justice under Section 77-30-13 is apprehended by the law
170     enforcement agency.
171          (c) A law enforcement agency shall issue a notification described in Subsection (5) to
172     the owner of the electronic device or electronic information or data within 14 days after the day
173     on which the law enforcement agency apprehends the individual described in Subsection (4)(a).
174          [(4)] (5) Upon expiration of the period of delayed notification granted under
175     Subsection (2) or (3), or upon the apprehension of an individual described in Subsection (4)(a),
176     the law enforcement agency shall serve upon or deliver by first-class mail, or by other means if
177     delivery is impracticable, to the owner of the electronic device or electronic information or data
178     a copy of the warrant together with notice that:
179          (a) states with reasonable specificity the nature of the law enforcement inquiry; and
180          (b) contains:
181          (i) the information described in [Subsections (1)(a)(i) through (vi)] Subsection (1)(b);
182          (ii) a statement that notification of the search was delayed;
183          (iii) the name of the court that authorized the delay of notification; and
184          (iv) a reference to the provision of this chapter that allowed the delay of notification.
185          [(5)] (6) A law enforcement agency is not required to notify the owner of the electronic
186     device or electronic information or data if the owner is located outside of the United States.
187          Section 3. Section 77-23c-104 is amended to read:
188          77-23c-104. Third-party electronic information or data.
189          (1) As used in this section, "subscriber record" means a record or information of a
190     provider of an electronic communication service or remote computing service that reveals the
191     subscriber's or customer's:
192          (a) name;
193          (b) address;
194          (c) local and long distance telephone connection record, or record of session time and
195     duration;
196          (d) length of service, including the start date;
197          (e) type of service used;
198          (f) telephone number, instrument number, or other subscriber or customer number or
199     identification, including a temporarily assigned network address; and
200          (g) means and source of payment for the service, including a credit card or bank
201     account number.
202          (2) Except as provided in Chapter 22, Subpoena Powers for Aid of Criminal
203     Investigation and Grants of Immunity, a law enforcement agency may not obtain, use, copy, or
204     disclose a subscriber record.
205          (3) A law enforcement agency may not obtain, use, copy, or disclose, for a criminal
206     investigation or prosecution, any record or information, other than a subscriber record, of a
207     provider of an electronic communication service or remote computing service related to a
208     subscriber or customer without a warrant.
209          (4) Notwithstanding Subsections (2) and (3), a law enforcement agency may obtain,
210     use, copy, or disclose a subscriber record, or other record or information related to a subscriber
211     or customer, without [a] an investigative subpoena or a warrant:
212          (a) with the informed, affirmed consent of the subscriber or customer;
213          (b) in accordance with a judicially recognized exception to warrant requirements;
214          (c) if the subscriber or customer voluntarily discloses the record in a manner that is
215     publicly accessible; or
216          (d) if the provider of an electronic communication service or remote computing service
217     voluntarily discloses the record:
218          (i) under a belief that an emergency exists involving the imminent risk to an individual
219     of:
220          (A) death;
221          (B) serious physical injury;
222          (C) sexual abuse;
223          (D) live-streamed sexual exploitation;
224          (E) kidnapping; or
225          (F) human trafficking;
226          (ii) that is inadvertently discovered by the provider, if the record appears to pertain to
227     the commission of:
228          (A) a felony; or
229          (B) a misdemeanor involving physical violence, sexual abuse, or dishonesty; or
230          (iii) subject to Subsection 77-23c-104(4)(d)(ii), as otherwise permitted under 18 U.S.C.
231     Sec. 2702.
232          (5) A provider of an electronic communication service or remote computing service, or
233     the provider's officers, employees, agents, or other specified persons may not be held liable for
234     providing information, facilities, or assistance in good faith reliance on the terms of a warrant
235     issued under this section, or without a warrant in accordance with Subsection (3).