1
2
3
4
5
6
7 LONG TITLE
8 General Description:
9 This bill modifies provisions related to disclosure of nonprofit entity related personal
10 information by public agencies.
11 Highlighted Provisions:
12 This bill:
13 ▸ modifies definitions;
14 ▸ clarifies the individuals about whom personal information may not be disclosed;
15 ▸ amends the exemptions from the prohibition of disclosing personal information;
16 ▸ addresses damages; and
17 ▸ makes technical and conforming amendments.
18 Money Appropriated in this Bill:
19 None
20 Other Special Clauses:
21 None
22 Utah Code Sections Affected:
23 AMENDS:
24 63G-26-102, as last amended by Laws of Utah 2023, Chapter 16
25 63G-26-103, as last amended by Laws of Utah 2023, Chapter 33
26 63G-26-104, as enacted by Laws of Utah 2020, Chapter 393
27
28 Be it enacted by the Legislature of the state of Utah:
29 Section 1. Section 63G-26-102 is amended to read:
30 63G-26-102. Definitions.
31 As used in this chapter:
32 (1) "Nonprofit entity" means an entity exempt from federal income tax under Section
33 501(c), Internal Revenue Code, or that has submitted an application with the Internal Revenue
34 Service for recognition of an exemption under Section 501(c), Internal Revenue Code.
35 (2) "Personal information" means a record or other compilation of data that identifies a
36 person as a donor to [
37
38 [
39 (a) a department, division, agency, office, commission, board, or other government
40 organization;
41 (b) a political subdivision, including a county, city, town, metro township, special
42 district, or special service district;
43 (c) a public school, school district, charter school, or public higher education
44 institution; or
45 (d) a judicial or quasi-judicial body.
46 Section 2. Section 63G-26-103 is amended to read:
47 63G-26-103. Protection of personal information.
48 (1) Except as provided in Subsections (2), (3), and [
49 (a) require an individual who is a donor to a nonprofit entity to provide the public
50 agency with personal information or otherwise compel the release of personal information;
51 (b) require [
52
53 information or compel the nonprofit entity to release personal information;
54 (c) release, publicize, or otherwise publicly disclose personal information in possession
55 of a public agency; or
56 (d) request or require a current or prospective contractor or grantee of the public
57 agency to provide the public agency with a list of [
58
59 prospective contractor or grantee has provided financial or nonfinancial support.
60 (2) Subsection (1) does not apply to:
61 (a) a disclosure of personal information required under Title 20A, Election Code, or
62 Title 36, Chapter 11, Lobbyist Disclosure and Regulation Act[
63
64
65 [
66 [
67 information by a public agency if the information is voluntarily released to the public by the
68 individual or nonprofit entity to which the personal information relates, including:
69 (i) as part of public comment or in a public meeting; or
70 (ii) in another manner that is publicly accessible;
71 [
72 order issued by a court [
73 [
74 criminal proceeding if the court with jurisdiction:
75 (i) finds that the requestor demonstrates a compelling need for the personal information
76 by clear and convincing evidence; and
77 (ii) issues a protective order barring disclosure of personal information to a person not
78 named in the litigation;
79 (e) admission of personal information as relevant evidence before a court with
80 jurisdiction, except that a court may not publicly reveal personal information absent a specific
81 finding of good cause;
82 [
83 [
84
85 [
86 Corporations Act[
87 (g) disclosure of personal information to the Department of Financial Institutions to
88 conduct regulatory oversight of federally insured depositories to comply with the requirements
89 of statute, rule, or regulation;
90 (h) disclosure of personal information to the Insurance Department to conduct
91 regulatory oversight of persons licensed under Title 31A, Insurance Code, to comply with the
92 requirements of statute, rule, or regulation; or
93 (i) disclosure of personal information that is required, requested, or released by the
94 following divisions of the Department of Commerce, provided that each division may only use
95 personal information in connection with the specific request to which the personal information
96 relates and for a related proceeding:
97 (i) by the Division of Consumer Protection in accordance with the Division of
98 Consumer Protection's administration and enforcement of a chapter described in Section
99 13-2-1;
100 (ii) by the Division of Corporations and Commercial Code in accordance with the
101 Division of Corporations and Commercial Code's authority under Title 13, Chapter 1a,
102 Division of Corporations and Commercial Code, and in the course of the Division of
103 Corporations and Commercial Code's administration of:
104 (A) Title 3, Uniform Agricultural Cooperative Association Act;
105 (B) Title 16, Corporations;
106 (C) Title 42, Chapter 2, Conducting Business Under Assumed Name;
107 (D) Title 48, Unincorporated Business Entity Act;
108 (E) Title 70, Chapter 3a, Registration and Protection of Trademarks and Service Marks
109 Act; and
110 (F) Title 70A, Chapter 9a, Uniform Commercial Code - Secured Transactions; and
111 (iii) by the Division of Securities to conduct regulatory oversight of persons regulated
112 under Title 61, Chapter 1, Utah Uniform Securities Act, to comply with the requirements of
113 statute, rule, or regulation.
114 (3) Subsections (1)(a), (b), and (d) do not apply to:
115 [
116
117 [
118 Commission's administration of tax or motor vehicle laws, except that the State Tax
119 Commission may only use personal information in connection with the administration of tax or
120 motor vehicle laws or for a related proceeding; or
121 [
122 General to conduct an audit authorized under Utah Constitution, Article VI, Section 33, and
123 Section 36-12-15, or the state auditor's office to conduct an audit authorized under Title 67,
124 Chapter 3, Auditor, except the legislative auditor general or state auditor may only use the
125 personal information in connection with the specific audit to which the request relates.
126 [
127 [
128 [
129
130 [
131 organization, as those terms are defined in Section 41-1a-1601.
132 Section 3. Section 63G-26-104 is amended to read:
133 63G-26-104. Enforcement -- Penalty.
134 (1) (a) A person whose personal information is recklessly provided or disclosed by a
135 public agency in violation of this chapter may bring a civil action for appropriate injunctive
136 relief, damages, or both.
137 (b) When a court awards damages under this section, the court shall order:
138 (i) an amount of not less than $2,500 to compensate for injury or loss caused by each
139 violation of this chapter; or
140 (ii) for an intentional violation of this chapter, an amount not to exceed three times the
141 amount described in Subsection (1)(b)(i).
142 (2) A court may award court costs and attorney fees to a person that brings an action
143 described in Subsection (1) if the person prevails in that action.
144 (3) A person that knowingly violates a provision of Section 63G-26-103 is guilty of a
145 class C misdemeanor, punishable by imprisonment for not more than 90 days or a fine of not
146 more than $1,000, or both.
147 Section 4. Effective date.
148 This bill takes effect on May 1, 2024.