Representative Andrew Stoddard proposes the following substitute bill:


1     
ELECTRONIC INFORMATION OR DATA PRIVACY ACT

2     
MODIFICATIONS

3     
2023 GENERAL SESSION

4     
STATE OF UTAH

5     
Chief Sponsor: Andrew Stoddard

6     
Senate Sponsor: ____________

7     

8     LONG TITLE
9     General Description:
10          This bill amends provisions concerning electronic information or data privacy.
11     Highlighted Provisions:
12          This bill:
13          ▸     provides that law enforcement may obtain a specific category of electronic
14     information or data with a subpoena under certain conditions;
15          ▸     amends notification provisions after a search warrant has been executed; and
16          ▸     makes technical and conforming changes.
17     Money Appropriated in this Bill:
18          None
19     Other Special Clauses:
20          This bill provides a coordination clause.
21     Utah Code Sections Affected:
22     AMENDS:
23          77-23c-102, as last amended by Laws of Utah 2022, Chapter 274
24          77-23c-103, as last amended by Laws of Utah 2021, Chapter 42
25     Utah Code Sections Affected by Coordination Clause:

26          77-23c-102, as last amended by Laws of Utah 2022, Chapter 274
27     

28     Be it enacted by the Legislature of the state of Utah:
29          Section 1. Section 77-23c-102 is amended to read:
30          77-23c-102. Electronic information or data privacy -- Warrant required for
31     disclosure.
32          (1) (a) Except as provided in Subsection (2), for a criminal investigation or
33     prosecution, a law enforcement agency may not obtain, without a search warrant issued by a
34     court upon probable cause:
35          (i) the location information, stored data, or transmitted data of an electronic device; or
36          (ii) electronic information or data transmitted by the owner of the electronic
37     information or data:
38          (A) to a provider of a remote computing service; or
39          (B) through a provider of an electronic communication service.
40          (b) Except as provided in Subsection (1)(c), a law enforcement agency may not use,
41     copy, or disclose, for any purpose, the location information, stored data, or transmitted data of
42     an electronic device, or electronic information or data provided by a provider of a remote
43     computing service or an electronic communication service, that:
44          (i) is not the subject of the warrant; and
45          (ii) is collected as part of an effort to obtain the location information, stored data, or
46     transmitted data of an electronic device, or electronic information or data provided by a
47     provider of a remote computing service or an electronic communication service that is the
48     subject of the warrant in Subsection (1)(a).
49          (c) A law enforcement agency may use, copy, or disclose the transmitted data of an
50     electronic device used to communicate with the electronic device that is the subject of the
51     warrant if the law enforcement agency reasonably believes that the transmitted data is
52     necessary to achieve the objective of the warrant.
53          (d) The electronic information or data described in Subsection (1)(b) shall be destroyed
54     in an unrecoverable manner by the law enforcement agency as soon as reasonably possible after
55     the electronic information or data is collected.
56          (2) (a) A law enforcement agency may obtain location information without a warrant

57     for an electronic device:
58          (i) in accordance with Section 53-10-104.5;
59          (ii) if the device is reported stolen by the owner;
60          (iii) with the informed, affirmative consent of the owner or user of the electronic
61     device;
62          (iv) in accordance with a judicially recognized exception to warrant requirements;
63          (v) if the owner has voluntarily and publicly disclosed the location information; or
64          (vi) from a provider of a remote computing service or an electronic communications
65     service if the provider voluntarily discloses the location information:
66          (A) under a belief that an emergency exists involving an imminent risk to an individual
67     of death, serious physical injury, sexual abuse, live-streamed sexual exploitation, kidnapping,
68     or human trafficking; or
69          (B) that is inadvertently discovered by the provider and appears to pertain to the
70     commission of a felony, or of a misdemeanor involving physical violence, sexual abuse, or
71     dishonesty.
72          (b) A law enforcement agency may obtain stored data or transmitted data from an
73     electronic device or electronic information or data transmitted by the owner of the electronic
74     information or data to a provider of a remote computing service or through a provider of an
75     electronic communication service, without a warrant:
76          (i) with the informed consent of the owner of the electronic device or electronic
77     information or data;
78          (ii) with a subpoena under Section 77-22-2 if the stored or transmitted data or the
79     electronic information or data is an audio or video surveillance recording;
80          [(ii)] (iii) in accordance with a judicially recognized exception to warrant requirements;
81     or
82          [(iii)] (iv) subject to Subsection (2)(a)(vi)(B), from a provider of a remote computing
83     service or an electronic communication service if the provider voluntarily discloses the stored
84     or transmitted data as otherwise permitted under 18 U.S.C. Sec. 2702.
85          (c) A prosecutor may obtain a judicial order as described in Section 77-22-2.5 for the
86     purposes described in Section 77-22-2.5.
87          (3) A provider of an electronic communication service or a remote computing service,

88     the provider's officers, employees, or agents, or other specified persons may not be held liable
89     for providing information, facilities, or assistance in good faith reliance on the terms of the
90     warrant issued under this section or without a warrant in accordance with Subsection (2).
91          (4) Nothing in this chapter:
92          (a) limits or affects the disclosure of public records under Title 63G, Chapter 2,
93     Government Records Access and Management Act;
94          (b) affects the rights of an employer under Subsection 34-48-202(1)(e) or an
95     administrative rule adopted under Section 63A-16-205; or
96          (c) limits the ability of a law enforcement agency to receive or use information, without
97     a warrant or subpoena, from the National Center for Missing and Exploited Children under 18
98     U.S.C. Sec. 2258A.
99          Section 2. Section 77-23c-103 is amended to read:
100          77-23c-103. Notification required -- Delayed notification.
101          (1) (a) Except as provided in Subsection (2), if a law enforcement agency executes a
102     warrant in accordance with Subsection 77-23c-102(1) or 77-23c-104(3), the law enforcement
103     agency shall notify the owner of the electronic device or electronic information or data
104     specified in the warrant within 90 days after the day on which the electronic device or the
105     electronic data or information is obtained by the law enforcement agency but in no case shall
106     the law enforcement agency notify the owner more than three days after the day on which the
107     investigation is concluded.
108          (b) The notification described in Subsection (1)(a) shall state:
109          (i) that a warrant was applied for and granted;
110          (ii) the kind of warrant issued;
111          (iii) the period of time during which the collection of the electronic information or data
112     was authorized;
113          (iv) the offense specified in the application for the warrant;
114          (v) the identity of the law enforcement agency that filed the application; and
115          (vi) the identity of the judge who issued the warrant.
116          (c) For the notification requirement described in Subsection (1)(a), the time period
117     under Subsection (1)(a) begins on the day after the day on which the owner of the electronic
118     device or electronic information or data specified in the warrant is known, or could be

119     reasonably identified, by the law enforcement agency.
120          (2) A law enforcement agency seeking a warrant in accordance with Subsection
121     77-23c-102(1)(a) or 77-23c-104(3) may submit a request, and the court may grant permission,
122     to delay the notification required by Subsection (1) for a period not to exceed [30] 90 days, if
123     the court determines that there is reasonable cause to believe that the notification may:
124          (a) endanger the life or physical safety of an individual;
125          (b) cause a person to flee from prosecution;
126          (c) lead to the destruction of or tampering with evidence;
127          (d) intimidate a potential witness; or
128          (e) otherwise seriously jeopardize an investigation or unduly delay a trial.
129          (3) When a delay of notification is granted under Subsection (2) and upon application
130     by the law enforcement agency, the court may grant additional extensions of up to [30] 90 days
131     each.
132          (4) (a) A law enforcement agency that seeks a warrant for an electronic device or
133     electronic information or data in accordance with Subsection 77-23c-102(1)(a) or
134     77-23c-104(3) may submit a request to the court to delay a notification under Subsection (2) if
135     the purpose of delaying the notification is to apprehend an individual:
136          (i) who is a fugitive from justice under Section 77-30-13; and
137          (ii) for whom an arrest warrant has been issued for a violent felony offense as defined
138     in Section 76-3-203.5.
139          (b) The court may grant the request under Subsection (4)(a) to delay notification until
140     the individual who is a fugitive from justice under Section 77-30-13 is apprehended by the law
141     enforcement agency.
142          (c) A law enforcement agency shall issue a notification described in Subsection (5) to
143     the owner of the electronic device or electronic information or data within 14 days after the day
144     on which the law enforcement agency apprehends the individual described in Subsection (4)(a).
145          (5) Upon expiration of the period of delayed notification granted under Subsection (2)
146     or (3), or upon the apprehension of an individual described in Subsection (4)(a), the law
147     enforcement agency shall serve upon or deliver by first-class mail, or by other means if
148     delivery is impracticable, to the owner of the electronic device or electronic information or data
149     a copy of the warrant together with notice that:

150          (a) states with reasonable specificity the nature of the law enforcement inquiry; and
151          (b) contains:
152          (i) the information described in Subsection (1)(b);
153          (ii) a statement that notification of the search was delayed;
154          (iii) the name of the court that authorized the delay of notification; and
155          (iv) a reference to the provision of this chapter that allowed the delay of notification.
156          (6) A law enforcement agency is not required to notify the owner of the electronic
157     device or electronic information or data if the owner is located outside of the United States.
158          Section 3. Coordinating H.B. 158 with H.B. 57 -- Technical amendment.
159          If this H.B. 158 and H.B. 57, Law Enforcement Investigation Amendments, both pass
160     and become law, it is the intent of the Legislature that the Office of Legislative Research and
161     General Counsel prepare the Utah Code database for publication by amending Subsection
162     77-23c-102(2)(b)(ii) in this H.B. 158 to read:
163          "(ii) with a subpoena under Section 77-22-2 if the stored or transmitted data or the
164     electronic information is an audio or video surveillance recording;".