Electronic Information Privacy Act Amendments

12
77-23c-101.2
77-23c-102
77-23c-103
77-23c-104
77-23c-104.1
77-23c-105
77-23c-101.2
77-23c-102
77-23c-103
77-23c-104
77-23c-104.1
77-23c-105
0
Electronic Information Privacy Act Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Jason B. Kyle
Senate Sponsor: Todd Weiler
LONG TITLE
General Description:
This bill amends the Electronic Information Privacy Act.
Highlighted Provisions:
This bill:
amends and clarifies definitions;
clarifies and amends procedures and requirements for a law enforcement agency that
seeks to obtain, use, copy, or disclose certain electronic information or records;
revises liability provisions for a provider of an electronic communication service or a
remote computing service;
provides that the procedures and requirements described in the Electronic Information
Privacy Act (act) are the only permissible methods for a law enforcement agency to
obtain, use, copy, disclose, or otherwise access certain electronic information or records,
with certain exceptions;
prohibits a law enforcement agency from contracting with or otherwise using a third party
to obtain, use, copy, disclose, or otherwise access certain electronic information or
records in a manner that the law enforcement agency would be prohibited from doing
directly, with certain exceptions;
provides that electronic information or records obtained in violation of the act, as well as
any evidence derived from the electronic information or records, are subject to the same
rules governing exclusion of evidence obtained in violation of constitutional
requirements; and
makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
77-23c-101.2
, as last amended by Laws of Utah 2023, Chapter 382
77-23c-102
, as last amended by Laws of Utah 2023, Chapters 382, 514
77-23c-103
, as last amended by Laws of Utah 2023, Chapter 382
77-23c-104
, as last amended by Laws of Utah 2023, Chapter 382
77-23c-105
, as enacted by Laws of Utah 2019, Chapter 362
ENACTS:
77-23c-104.1
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section
77-23c-101.2
is amended to read:
77-23c-101.2
. Definitions.
As used in this chapter:
(1)
"Electronic communication service" means a service that provides to users of the
service the ability to send or receive wire or electronic communications.
(2)
"Electronic device" means a device that enables access to or use of an electronic
communication service, remote computing service, or location information service.
(3)
(a)
"Electronic information" means information or data including a sign, signal,
writing, image, sound, or intelligence of any nature transmitted or stored in whole or
in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system.
(b)
"Electronic information" includes the location information, stored data, or
transmitted data of an electronic device.
(c)
"Electronic information" does not include:
(i)
a wire or oral communication;
(ii)
a communication made through a tone-only paging device; or
(iii)
electronic funds transfer information stored by a financial institution in a
communications system used for the electronic storage and transfer of money.
(4)
"Law enforcement agency" means:
(a)
an entity of the state or a political subdivision of the state that exists to primarily
prevent, detect, or prosecute crime and enforce criminal statutes or ordinances; or
(b)
an individual or entity acting for or on behalf of an entity described in Subsection
(4)(a)
.
(5)
(a)
"Location information" means information concerning the geographical location
of an electronic device that, in whole or in part, is generated or derived from or
obtained by the operation of an electronic device or the operation of a software
application on an electronic device.
(b)
"Location information" includes past, current, and future location information.
(6)
"Location information service" means the provision of a global positioning service or
other mapping, location, or directional information service.
(7)
"Oral communication" means the same as that term is defined in Section
77-23a-3
.
(8)
"Remote computing service" means the provision to the public of computer storage or
processing services by means of an electronic communications system.
(9)
"Subscriber record" means a record or information that:
(a)
(i)
is in the possession of a provider of an electronic communication service or a
remote computing service;
(ii)
is created or maintained by a provider of an electronic communication service or
a remote computing service; or
(iii)
is received from, or derived from, a record or information originally possessed,
created, or maintained by a provider of an electronic communication service or a
remote computing service; and
(b)
reveals a subscriber's or customer's:
(i)
name;
(ii)
address;
(iii)
local or long distance telephone connection record, or record of session time and
duration;
(iv)
length of service, including the start date;
(v)
type of service used;
(vi)
telephone number, instrument number, or other subscriber or customer number or
identification, including a temporarily assigned network address; or
(vii)
means or source of payment to the electronic communication service or a remote
computing service, including a credit card or bank account number.
(9)
(10)
"Transmitted data" means electronic information that is transmitted wirelessly:
(a)
from an electronic device to another electronic device without the use of an
intermediate connection or relay; or
(b)
from an electronic device to a nearby antenna or from a nearby antenna to an
electronic device.
(10)
(11)
"Wire communication" means the same as that term is defined in Section
77-23a-3
.
Section 2. Section
77-23c-102
is amended to read:
77-23c-102
. Electronic information privacy -- Warrant required for disclosure.
(1)
(a)
Except as provided in Subsection
(2)
or
,

(4)
, or Section
77-23c-104.1
, and
subject to Section
77-23c-105
, for a criminal investigation or prosecution, a law
enforcement agency may not obtain,
without
copy, or use the following information
or data except through the use of
a search warrant issued by a court upon probable
cause:
(i)
the location information, stored data, or transmitted data of an electronic device; or
(ii)
electronic information transmitted by the owner of the electronic information:
(A)
to a provider of a remote computing service; or
(B)
through a provider of an electronic communication service.
(b)
(i)
Except as provided in
Subsection
(1)(b)(ii)
and subject to
Subsection
(1)(c)
,
a
if a law enforcement agency, in response to a warrant obtained under Subsection
(1)(a)
, obtains information or data described in Subsection
(1)(a)(i)
or
(ii)
, the
law
enforcement agency may not use, copy, or disclose, for any purpose,
the location
information, stored data, or transmitted data of an electronic device, or electronic
information provided by a provider of a remote computing service or an electronic
communication service,
any information or data described in Subsection
(1)(a)(i)

or
(ii)

that:
(i)
(A)
is not the subject of the warrant
obtained under Subsection
(1)(a)
; and
(ii)
(B)
is collected as part of an effort to obtain the
location information, stored
data, or transmitted data of an electronic device, or electronic information
provided by a provider of a remote computing service or an electronic
communication service
information or data described in Subsection
(1)(a)(i)
or
(ii)
that is the subject of the warrant
in
obtained under
Subsection
(1)(a)
.
(c)
(ii)
A law enforcement agency may use, copy, or disclose the transmitted data of
an electronic device used to communicate with the electronic device that is the
subject of the warrant if the law enforcement agency reasonably believes that the
transmitted data is necessary to achieve the objective of the warrant.
(d)
(c)
The electronic information described in Subsection
(1)(b)
shall be destroyed in
an unrecoverable manner by the law enforcement agency as soon as reasonably
possible after the electronic information is collected.
(2)
(a)
A
Except as provided in Subsection
(2)(c)
or Section
77-23c-104.1
and subject
to Section
77-23c-105
, a
law enforcement agency may obtain location information
without a warrant for an electronic device
only
:
(i)
in accordance with Section
53-10-104.5
;
(ii)
if the device is reported stolen by the owner;
(iii)
with the informed, affirmative consent of the owner or user of the electronic
device;
(iv)
except for the automobile exception to the warrant requirement, in accordance
with a judicially recognized exception to warrant requirements;
(v)
if the owner has voluntarily and publicly disclosed the location information; or
(vi)
from a provider of a remote computing service or an electronic communications
service if the provider voluntarily discloses the location information:
(A)
under a belief that an emergency exists involving an imminent risk to an
individual of death, serious physical injury, sexual abuse, live-streamed sexual
exploitation, kidnapping, or human trafficking; or
(B)
that is inadvertently discovered by the provider and appears to pertain to the
commission of a felony, or of a misdemeanor involving physical violence,
sexual abuse, or dishonesty.
(b)
A
Except as provided in Subsection
(2)(c)
or Section
77-23c-104.1
and subject to
Section
77-23c-105
, a
law enforcement agency may obtain stored data or transmitted
data from an electronic device or electronic information transmitted by the owner of
the electronic information to a provider of a remote computing service or through a
provider of an electronic communication service, without a warrant
, only
:
(i)
with the informed consent of the owner of the electronic device or electronic
information;
(ii)
except for the automobile exception to the warrant requirement, in accordance
with a judicially recognized exception to warrant requirements; or
(iii)
subject to Subsection
(2)(a)(vi)(B)
, from a provider of a remote computing
service or an electronic communication service if the provider voluntarily
discloses the stored or transmitted data as otherwise permitted under 18 U.S.C.
Sec. 2702.
(c)
A prosecutor may obtain a judicial order as described in Section
77-22-2.5
for the
purposes described in Section
77-22-2.5
.
(3)
A provider of an electronic communication service or a remote computing service, the
provider's officers, employees, or agents, or other specified persons may not be held
liable for
providing
information, facilities, or assistance
provided
in good faith reliance
on the terms of the warrant issued under this section or without a warrant in accordance
with Subsection
(2)
under this section
.
(4)
Nothing in this chapter:
(a)
limits or affects the disclosure of public records under
Title 63G, Chapter 2,
Government Records Access and Management Act
;
(b)
affects the rights of an employer under Subsection
34-48-202(1)(e)
or an
administrative rule adopted under Section
63A-16-205
; or
(c)
limits the ability of a law enforcement agency to receive or use information, without
a warrant or subpoena, from the National Center for Missing and Exploited Children
under 18 U.S.C. Sec. 2258A.
Section 3. Section
77-23c-103
is amended to read:
77-23c-103
. Notification required -- Exceptions -- Delayed notification.
(1)
(a)
Except as provided in Subsection
(1)(b)
or
(2)
, a law enforcement agency that
executes a warrant under
Subsection
77-23c-102(1)
or
77-23c-104(3)
Section
77-23c-102
or
77-23c-104
shall serve the owner of the electronic device or electronic
information specified in the warrant with a notice described in Subsection
(3)
:
(i)
within 90 days after the day on which the electronic device or the electronic
information is obtained by the law enforcement agency but in no case more than
three days after the day on which the investigation is concluded; or
(ii)
if the owner of the electronic device or electronic information specified in the
warrant is unknown to the law enforcement agency, within 90 days after the day
on which the law enforcement agency identifies, or reasonably could identify, the
owner.
(b)
A law enforcement agency is not required to serve a notice described in Subsection
(1)(a)
to the owner of the electronic device or electronic information if the owner is
located outside of the United States.
(2)
(a)
(i)
A law enforcement agency seeking a warrant in accordance with
Subsection
77-23c-102(1)(a)
or
77-23c-104(3)
Section
77-23c-102
or
77-23c-104
may submit
a request, and the court may grant permission, to delay service of the notice
required under Subsection
(1)
for a period not to exceed 30 days, if the court
determines that there is reasonable cause to believe that the notification may:
(A)
endanger the life or physical safety of an individual;
(B)
cause a person to flee from prosecution;
(C)
lead to the destruction of or tampering with evidence;
(D)
intimidate a potential witness; or
(E)
otherwise seriously jeopardize an investigation or unduly delay a trial.
(ii)
When a delay of notification is granted under Subsection
(2)(a)(i)
and upon
application by the law enforcement agency, the court may grant additional
extensions of up to 30 days each.
(b)
(i)
A law enforcement agency that seeks a warrant for an electronic device or
electronic information in accordance with
Subsection
77-23c-102(1)(a)
or
77-23c-104(3)
Section
77-23c-102
or
77-23c-104
may submit a request to the
court, and the court may grant permission, to delay service of the notice required
under Subsection
(1)
, if the purpose of delaying the notification is to apprehend an
individual:
(A)
who is a fugitive from justice under Section
77-30-13
; and
(B)
for whom an arrest warrant has been issued for a violent felony offense as
defined in Section
76-3-203.5
.
(ii)
(A)
The court may grant the request under Subsection
(2)(b)(i)
to delay
notification until the individual who is a fugitive from justice under Section
77-30-13
is apprehended by the law enforcement agency.
(B)
A law enforcement agency shall serve the notice required under Subsection
(1)

to the owner of the electronic device or electronic information within 14 days
after the day on which the law enforcement agency apprehends the individual
described in Subsection
(2)(b)(i)
.
(3)
A notice required under Subsection
(1)
shall include:
(a)
a copy of the warrant; and
(b)
a written statement identifying:
(i)
the offense specified in the warrant application;
(ii)
the identity of the law enforcement agency that filed the application;
(iii)
the date on which the electronic information was obtained; and
(iv)
the number and length of any authorized delays in serving the notice required
under Subsection
(1)
, including, if applicable, the name of the court that
authorized the delay and a reference to the provision of this chapter that permitted
the delay.
(4)
A law enforcement agency shall serve the notice required under Subsection
(1)
to the
owner of the electronic device or electronic information by:
(a)
personal service on the owner;
(b)
first-class mail to the owner's last-known address; or
(c)
other reasonable means if the owner's last-known address is unknown.
Section 4. Section
77-23c-104
is amended to read:
77-23c-104
. Third-party electronic information and records.
(1)
As used in this section, "subscriber record" means a record or information of a provider
of an electronic communication service or remote computing service that reveals the
subscriber's or customer's:
(a)
name;
(b)
address;
(c)
local and long distance telephone connection record, or record of session time and
duration;
(d)
length of service, including the start date;
(e)
type of service used;
(f)
telephone number, instrument number, or other subscriber or customer number or
identification, including a temporarily assigned network address; and
(g)
means and source of payment for the service, including a credit card or bank
account number.
(2)
(1)
Except as provided in
Chapter 22, Subpoena Powers for Aid of Criminal
Investigation and Grants of Immunity
or Section
77-23f-105
,
Subsection
(2)
or Section
77-22-2.5
or
77-23c-104.1
, and subject to Section
77-23c-105
,
a law enforcement
agency may not
, except through the use of a search warrant issued by a court upon
probable cause,
obtain, use, copy, or disclose

:
(a)
a subscriber record
.
; or
(3)
(b)
A law enforcement agency may not obtain, use, copy, or disclose,
for a
criminal investigation or prosecution, any record or information
related to a
subscriber or a customer
, other than a subscriber record,
of a
that is:
(i)
in the possession of a
provider of an electronic communication service or
a
remote
computing service
related to a subscriber or customer without a warrant.
;
(ii)
created or maintained by a provider of an electronic communication service or a
remote computing service; or
(iii)
received from, or derived from, a record or information originally possessed,
created, or maintained by a provider of an electronic communication service or a
remote computing service.
(4)
(2)
Notwithstanding Subsections
(2)
and
(3)
, a
Except as provided in Section
77-23c-104.1
and subject to Section
77-23c-105
, a
law enforcement agency may obtain,
use, copy, or disclose a subscriber record, or other record or information related to a
subscriber or customer
described in Subsection
(1)(b)
, without an investigative subpoena
or a warrant
, only
:
(a)
with the informed, affirmed consent of the subscriber or customer;
(b)
in accordance with a judicially recognized exception to warrant requirements;
(c)
if the subscriber or customer voluntarily discloses the record in a manner that is
publicly accessible; or
(d)
if the provider of an electronic communication service or remote computing service
voluntarily discloses the record:
(i)
under a belief that an emergency exists involving the imminent risk to an
individual of:
(A)
death;
(B)
serious physical injury;
(C)
sexual abuse;
(D)
live-streamed sexual exploitation;
(E)
kidnapping; or
(F)
human trafficking;
(ii)
that is inadvertently discovered by the provider, if the record appears to pertain to
the commission of:
(A)
a felony; or
(B)
a misdemeanor involving physical violence, sexual abuse, or dishonesty; or
(iii)
subject to Subsection
77-23c-104(4)(d)(ii)
(2)(d)(ii)
, as otherwise permitted
under 18 U.S.C. Sec. 2702.
(5)
(3)
A provider of an electronic communication service or remote computing service, or
the provider's officers, employees, agents, or other specified persons may not be held
liable for
providing
information, facilities, or assistance
provided
in good faith reliance
on the terms of a warrant issued under this section, or without a warrant in accordance
with Subsection
(3)
under this section
.
Section 5. Section
77-23c-104.1
is enacted to read:
77-23c-104.1
. Exceptions from chapter requirements.
(1)
A law enforcement agency may obtain, use, copy, disclose, or otherwise access
electronic information or a record described in this chapter without complying with the
requirements and procedures described in this chapter if the law enforcement agency
obtains the electronic information or record:
(a)
(i)
from a federal law enforcement agency, a law enforcement agency in a different
state, or a law enforcement agency in a different country; and
(ii)
the law enforcement agency described in Subsection
(1)(a)(i)
obtained the
electronic information or record:
(A)
in a legal manner under the constitutional requirements and any applicable
laws, rules, and procedures of that jurisdiction; and
(B)
as part of an investigation of conduct that was occurring in that jurisdiction or
of a person over which the law enforcement agency had jurisdiction;
(b)
as part of a written interagency agreement that:
(i)
establishes a joint task force or investigative partnership with a federal law
enforcement agency, a law enforcement agency in a different state, or a law
enforcement agency in a different country; and
(ii)
defines the scope and purpose of the joint task force or investigative partnership;
or
(c)
at the law enforcement agency's request:
(i)
from a federal law enforcement agency, a law enforcement agency in a different
state, or a law enforcement agency in a different country; and
(ii)
if the procedures employed to obtain the electronic information or record by the
law enforcement agency described in Subsection
(1)(c)(i)
comply with the level of
legal process that is required under this chapter.
(2)
Nothing in this chapter:
(a)
limits or affects the disclosure of public records under Title 63G, Chapter 2,
Government Records Access and Management Act;
(b)
affects the rights of an employer under Subsection
34-48-202(1)(e)
or an
administrative rule adopted under Section
63A-16-205
; or
(c)
limits the ability of a law enforcement agency to receive or use information, without
a warrant or subpoena, from:
(i)
the National Center for Missing and Exploited Children under 18 U.S.C. Sec.
2258A; or
(ii)
information publicly or otherwise legally accessible to a law enforcement agency
without a warrant, subpoena, or court order, either for free or for a fee, from a
third-party data aggregator.
Section 6. Section
77-23c-105
is amended to read:
77-23c-105
. Chapter is exclusive method of obtaining, using, copying, or
disclosing electronic information or records -- Exclusion of electronic information or
records obtained, used, copied, or disclosed in violation of this chapter.
All electronic
(1)
A law enforcement agency may only obtain, use, copy, disclose, or otherwise access
electronic information or a record described in this chapter if the law enforcement
agency has:
(a)
complied with the applicable procedures and requirements provided under this
chapter; or
(b)
obtained the electronic information or record under an exception described in Section
77-23c-104.1
.
(2)
Except as provided in Section
77-23c-104.1
, a law enforcement agency may not
approach, solicit, direct, or contract with or otherwise use a third party, including a
federal agency, an agency in a different state, or an agency in a different country, to
obtain, use, copy, disclose, or otherwise access electronic information or a record
described in this chapter:
(a)
in a manner that the law enforcement agency would be prohibited from doing
directly under this chapter; or
(b)
in an attempt to circumvent or subvert the requirements of this chapter.
(3)
(a)
Electronic
information
or data and records of a provider of an electronic
communications service or remote computing service pertaining to a subscriber or
customer
or records described in this chapter
that are obtained
, used, copied,
disclosed, or otherwise accessed
in violation of the provisions of this chapter shall be
subject to the rules governing exclusion as if the
electronic information or
records
were obtained
, used, copied, disclosed, or otherwise accessed
in violation of the
Fourth Amendment to the United States Constitution and
Utah Constitution, Article I,
Section 14.
(b)
Evidence derived from electronic information or records described in Subsection
(3)(a)
shall be subject to the rules governing exclusion as if the evidence were
obtained, used, copied, disclosed, or otherwise accessed in violation of the Fourth
Amendment to the United States Constitution and Utah Constitution, Article I,
Section 14.
Section 7.
Effective Date.
This bill takes effect on
May 6, 2026
.
3-11-26 11:09 AM