Data Privacy Amendments

127
20A-11-1002
53-18-102
53H-14-501
53H-14-502
63A-16-108
63A-19-101
63A-19-202
63A-19-203
63A-19-204
63A-19-301
63A-19-302
63A-19-401
63A-19-401.1
63A-19-401.2
63A-19-401.3
63A-19-401.4
63A-19-403
63A-19-405
63A-19-406
63A-19-407
63G-2-303
63A-19-501
63A-19-502
63G-2-201
63G-2-301
63G-2-302
63G-2-601
63G-2-803
67-1a-15
67-3-1
67-3-13
2
Data Privacy Amendments
2026 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: David Shallenberger
Senate Sponsor: Kirk A. Cullimore
LONG TITLE
General Description:
This bill amends the Government Data Privacy Act and the Government Records Access
and Management Act.
Highlighted Provisions:
This bill:
defines terms;
restructures the Utah Privacy Commission (commission) to include representatives from
state agencies, cities, counties, and public education;
transfers support of the commission from the state a
uditor's office to the Utah Office of
Data Privacy (office);
authorizes the commission to establish participation requirements for commission
members;
authorizes the office to provide recommendations and guidance;
authorizes the office to partner with state institutions of higher education for research and
support functions;
requires the office and the commission to jointly study the use of passive data collection
technology by governmental entities and report findings and recommendations to the
Government Operations Interim Committee;
establishes the data privacy ombudsman as a component of the Office of Data Privacy;
establishes a data privacy complaint process;
removes duplicative provisions from the Government Records Access and Management
Act;
expands amendment and correction procedures to cover information beyond personal
data;
removes the state privacy auditor, and places the state privacy auditor's responsibility
with the state auditor's office and makes conforming changes; and
makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
20A-11-1002
, as last amended by Laws of Utah 2010, Chapter 389
53-18-102
, as last amended by Laws of Utah 2022, Chapter 367
53H-14-501
, as renumbered and amended by Laws of Utah 2025, First Special Session,
Chapter 8
53H-14-502
, as renumbered and amended by Laws of Utah 2025, First Special Session,
Chapter 8
63A-16-108
, as enacted by Laws of Utah 2023, Chapter 201
63A-19-101
, as last amended by Laws of Utah 2025, Chapter 475
63A-19-202
, as enacted by Laws of Utah 2024, Chapter 417
63A-19-203
, as renumbered and amended by Laws of Utah 2025, Chapter 475
63A-19-204
, as renumbered and amended by Laws of Utah 2025, Chapter 475
63A-19-301
, as last amended by Laws of Utah 2025, Chapter 475
63A-19-302
, as enacted by Laws of Utah 2024, Chapter 417
63A-19-401
, as last amended by Laws of Utah 2025, Chapter 475
63A-19-401.1
, as enacted by Laws of Utah 2025, Chapter 475
63A-19-401.2
, as enacted by Laws of Utah 2025, Chapter 475
63A-19-401.3
, as enacted by Laws of Utah 2025, Chapter 475
63A-19-401.4
, as enacted by Laws of Utah 2025, Chapter 475
63A-19-403
, as enacted by Laws of Utah 2024, Chapter 417
63A-19-405
, as last amended by Laws of Utah 2025, Chapter 475
63A-19-406
, as last amended by Laws of Utah 2025, Chapter 475
63A-19-501
, as last amended by Laws of Utah 2025, Chapter 475
63G-2-201
, as last amended by Laws of Utah 2025, Chapters 299, 476
63G-2-301
, as last amended by Laws of Utah 2025, First Special Session, Chapter 9
63G-2-302
, as last amended by Laws of Utah 2025, Chapter 172
63G-2-601
, as last amended by Laws of Utah 2025, Chapter 475
63G-2-803
, as last amended by Laws of Utah 2013, Chapter 426
67-1a-15
, as last amended by Laws of Utah 2025, First Special Session, Chapter 17
67-3-1
, as last amended by Laws of Utah 2025, First Special Session, Chapter 17
67-3-13
, as last amended by Laws of Utah 2025, Chapter 475
ENACTS:
63A-19-407
, Utah Code Annotated 1953
63A-19-502
, Utah Code Annotated 1953
RENUMBERS AND AMENDS:
63A-19-408
, (Renumbered from 63G-2-303, as last amended by Laws of Utah 2025,
Chapter 208)
Be it enacted by the Legislature of the state of Utah:
Section 1. Section
20A-11-1002
is amended to read:
20A-11-1002
. Retention and public inspection of financial statements -- Written
complaint if statement is false or unlawful.
(1)
The chief election officer shall:
(a)
make each financial statement required by this chapter or
Chapter 12, Part 2, Judicial
Retention Elections
:
(i)
open to public inspection in the office of the chief election officer; and
(ii)
available for viewing on the Internet in accordance with Section
20A-11-103
;
(b)
preserve those statements for at least five years; and
(c)
provide certified copies of the financial statements in the same manner as for other
public records.
(2)
Any candidate or voter may file a written complaint with the chief election officer
alleging that a filed financial statement does not conform to law or to the truth.
(3)
(a)
As used in this Subsection
(3)
, "required report" means a report, a financial
statement, or any other type of statement or disclosure that a person is required to
make under this chapter or Chapter 12, Part 2, Judicial Retention Elections.
(b)
Before posting or otherwise publicly disclosing a required report, the lieutenant
governor shall redact from the report the following information relating to each
individual referenced in the report:
(i)
the phone number of the individual; and
(ii)
the street number and street name in the address of the individual.
(c)
The information required to be redacted under Subsection
(3)(b)
is not a record under
Title 63G, Chapter 2, Government Records Access and Management Act.
(d)
It is unlawful to publicly disclose the information required to be redacted under
Subsection
(3)(b)
.
(e)
A government officer or employee who knowingly violates Subsection
(3)(d)
is
guilty of a class B misdemeanor.
Section 2. Section
53-18-102
is amended to read:
53-18-102
. Definitions.
As used in this chapter:
(1)
"Access software provider" means a provider of software, including client or server
software, or enabling tools that do any one or more of the following:
(a)
filter, screen, allow, or disallow content;
(b)
pick, choose, analyze, or digest content; or
(c)
transmit, receive, display, forward, cache, search, subset, organize, reorganize, or
translate content.
(2)
"Correctional facility" means the same as that term is defined in Section
77-16b-102
.
(3)
"Dispatcher" means the same as that term is defined in Section
53-6-102
.
(4)
"Immediate family member" means a public safety employee's spouse, child, parent, or
grandparent who resides with the public safety employee.
(5)
"Interactive computer service" means the same as that term is defined in Subsection 47
U.S.C. 230(f).
(6)
"Law enforcement officer" or "officer":
(a)
means the same as that term is defined in Section
53-13-103
;
(b)
includes correctional officers as defined in Section
53-13-104
; and
(c)
refers only to officers who are currently employed by, retired from, or were killed in
the line of duty while in the employ of a state or local governmental law enforcement
agency.
(7)
(a)
"Personal information" means a public safety employee's or a public safety
employee's immediate family member's home address, home telephone number,
personal mobile telephone number, personal pager number, personal email address,
or personal photograph, directions to locate the public safety employee's home, or
photographs of the public safety employee's or the public safety employee's
immediate family member's home or vehicle.
(b)
"Personal information" includes a record or a part of a record that:
(i)
a public safety employee who qualifies as an at-risk government employee under
Section
63G-2-303
63A-19-408
requests to be classified as private under
Subsection
63G-2-302(1)(h)
; and
(ii)
is classified as private under
Title 63G, Chapter 2, Government Records Access
and Management Act
.
(8)
"Public safety employee" means:
(a)
a law enforcement officer;
(b)
a dispatcher; or
(c)
a current or retired employee or contractor of:
(i)
a law enforcement agency; or
(ii)
a correctional facility.
(9)
"Publicly post" or "publicly display" means to intentionally communicate or otherwise
make available to the general public.
Section 3. Section
53H-14-501
is amended to read:
53H-14-501
. General provisions -- Definitions.
As used in this part:
(1)
"Advisory group" means the institution of higher education privacy advisory group
established by the
state privacy auditor
chief privacy officer
under Section
53H-14-502
.
(2)
"Aggregate data" means data that:
(a)
are totaled and reported at the group, cohort, class, course, institution, region, or state
level, with at least 10 individuals in the level; and
(b)
do not reveal personally identifiable student data.
(3)
"Chief privacy officer" means the individual appointed under Section
63A-19-302
.
(3)
(4)
"Data breach" means an unauthorized release of or unauthorized access to
personally identifiable student data that an education entity maintains.
(4)
(5)
"Data governance plan" means an education entity's comprehensive plan for
managing education data that:
(a)
incorporates reasonable data industry best practices to maintain and protect student
data and other education-related data;
(b)
describes the role, responsibility, and authority of the board or an institution privacy
officer;
(c)
provides for necessary technical assistance, training, support, and auditing;
(d)
describes the process for sharing student data between the education entity and
another person;
(e)
describes the education entity's data expungement process, including how to respond
to requests for expungement;
(f)
describes the data breach response process; and
(g)
is published annually and available on the institution's website or the Utah System of
Higher Education's website.
(5)
(6)
"Education entity" means the Utah Board of Higher Education or an institution.
(6)
(7)
"Higher education privacy officer" means a privacy officer that the board
designates under Section
53H-14-503
.
(7)
(8)
"Minor" means a person younger than 18 years old.
(8)
(9)
(a)
"Personally identifiable student data" means student data that identifies or is
used by the holder to identify a student.
(b)
"Personally identifiable student data" includes:
(i)
a student's first and last name;
(ii)
the first and last name of a student's family member;
(iii)
a student's or a student's family's home or physical address;
(iv)
a student's email address or other online contact information;
(v)
a student's telephone number;
(vi)
a student's social security number;
(vii)
a student's biometric identifier;
(viii)
a student's health or disability data;
(ix)
a student's education entity student identification number;
(x)
a student's social media user name and password or alias;
(xi)
if associated with personally identifiable student data, the student's persistent
identifier, including:
(A)
a customer number held in a cookie; or
(B)
a processor serial number;
(xii)
a combination of a student's last name or photograph with other information that
together permits a person to contact the student online;
(xiii)
information about a student or a student's family that a person collects online
and combines with other personally identifiable student data to identify the
student; and
(xiv)
information that, alone or in combination, is linked or linkable to a specific
student that would allow a reasonable person in the school community, who does
not have personal knowledge of the relevant circumstances, to identify the student
with reasonable certainty.
(9)
"State privacy auditor" means the state privacy auditor described in Section
67-3-13
.
(10)
"Student" means an individual enrolled in an institution.
(11)
(a)
"Student data" means information about a student at the individual student level.
(b)
"Student data" does not include aggregate or de-identified data.
(12)
"Third-party contractor" means a person who:
(a)
is not an institution or an employee of an institution; and
(b)
pursuant to a contract with an education entity, collects or receives student data in
order to provide a product or service, as described in the contract, if the product or
service is not related to school photography, yearbooks, graduation announcements,
or a similar product or service.
Section 4. Section
53H-14-502
is amended to read:
53H-14-502
. State student data protection governance.
(1)
The
state privacy auditor
chief privacy officer
shall establish a higher education
privacy advisory group to advise institutions and institution boards of trustees on student
data protection.
(2)
The advisory group shall consist of:
(a)
the
state privacy auditor
chief privacy officer
;
(b)
the higher education privacy officer; and
(c)
the following members, appointed by the commissioner:
(i)
at least one Utah System of Higher Education employee; and
(ii)
at least one representative of the Utah Board of Higher Education.
(3)
The advisory group shall:
(a)
discuss and make recommendations to the board and institutions regarding:
(i)
existing and proposed:
(A)
board rules; or
(B)
board policies of the Utah Board of Higher Education or institutions; and
(ii)
training on protecting student data privacy; and
(b)
perform other tasks related to student data protection as designated by the Utah
Board of Higher Education.
(4)
The higher education privacy officer shall:
(a)
provide training and support to institution boards and employees; and
(b)
produce:
(i)
resource materials;
(ii)
model data governance plans;
(iii)
model forms for institution student data protection governance; and
(iv)
a model data collection notice.
(5)
The board shall:
(a)
(i)
create and maintain a data governance plan; and
(ii)
annually publish the data governance plan on the Utah System of Higher
Education website; and
(b)
establish standards for:
(i)
institution policies to protect student data;
(ii)
institution data governance plans; and
(iii)
a third-party contractor's use of student data.
Section 5. Section
63A-16-108
is amended to read:
63A-16-108
. Digital verifiable credential and records.
(1)
As used in this section:
(a)
"Blockchain" means a distributed ledger of ordered electronic records that:
(i)
is distributed across a network of computers;
(ii)
utilizes technology to prevent the unauthorized alteration of electronic records;
and
(iii)
is mathematically verified.
(b)
"Chief privacy officer" means the individual appointed under Section
63A-19-302
.
(b)
(c)
"Digital record schema" means a description of the data fields and
tamper-evident technologies required to create a digital verifiable credential or digital
verifiable record that can be registered on a distributed ledger technology.
(c)
(d)
"Digital signature" means a tamper-evident, immutable, electronic seal that is
equivalent in function and status to a notary seal issued by a government entity.
(d)
(e)
"Digital verifiable credential" means a digital document that:
(i)
attests to a fact;
(ii)
is issued by a government entity;
(iii)
can be mathematically verified; and
(iv)
conveys rights, privileges, and legal enforceability equivalent to the possession
of a physical credential of the same type.
(e)
(f)
"Digital verifiable record" means a digital record that:
(i)
is issued by a government entity or has been digitally signed by a government
entity;
(ii)
has a digital signature;
(iii)
can be mathematically verified; and
(iv)
conveys rights, privileges, and legal enforceability equivalent to the possession
of a physical record of the same type.
(f)
(g)
"Distributed ledger" means a decentralized database that is maintained by the
consensus of replicated, shared, and synchronized digital data.
(g)
(h)
"Government entity" means:
(i)
the state;
(ii)
a state agency; or
(iii)
a political subdivision of the state.
(h)
"Government operations privacy officer" means the government operations privacy
officer described in Section
67-1-17
.
(i)
"State archivist" means the state archivist appointed under Section
63A-12-102
.
(j)
"State privacy officer" means the state privacy officer described in Section
67-3-13
.
(k)
(j)
"State registrar" means the state registrar of vital records appointed under
Section
26B-8-102
.
(2)
The Division of Technology Services shall:
(a)
provide recommendations to government entities regarding:
(i)
appropriate digital record schemas that allow a government to issue a digital
verifiable credential or record;
(ii)
policies and procedures to protect the privacy of personal identifying information
maintained within distributed ledger programs;
(iii)
the manner and format in which an issuer may certify a document through
blockchain; and
(iv)
processes and procedures for the preservation, auditability, integrity, security,
and confidentiality of digital verifiable credentials and records;
(b)
create a pilot program for the implementation of digital verifiable credentials by
governmental entities; and
(c)
report to Public Utilities, Energy, and Technology Interim Committee by October 31,
2023, on the duties described in Subsections
(2)(a)
and
(b)
.
(3)
In performing the duties described in Subsections
(2)(a)
and
(b)
, the Division of
Technology Services shall consult with:
(a)
the state archivist;
(b)
the chief privacy officer;
(b)
the state privacy officer;
(c)
the government operations privacy officer;
(d)
(c)
the state registrar;
(e)
(d)
private industry professionals with relevant expertise;
(f)
(e)
the Utah League of Cities and Towns; and
(g)
(f)
an association of counties in the state.
Section 6. Section
63A-19-101
is amended to read:
63A-19-101
. Definitions.
As used in this chapter:
(1)
"Anonymized data" means information that has been irreversibly modified so that there
is no possibility of using the information, alone or in combination with other
information, to identify an individual.
(2)
"At-risk government employee" means the same as that term is defined in Section
63G-2-303
63A-19-408
.
(3)
"Automated decision making" means using personal data to make a decision about an
individual through automated processing, without human review or intervention.
(4)
"Biometric data" means the same as that term is defined in Section
13-61-101
.
(5)
(a)
"Chief administrative officer" means the same as that term is defined in Section
63A-12-100.5
.
(b)
"Chief administrative officer" for a municipality may be, in the municipality's
discretion, a separate and distinct role from the chief administrative officer role
described in Section
11-50-202
.
(6)
"Chief privacy officer" means the individual appointed under Section
63A-19-302
.
(7)
"Commission" means the Utah Privacy Commission established in Section
63A-19-203
.
(8)
"Contract" means an agreement between a governmental entity and a person for goods
or services that involve personal data.
(9)
(a)
"Contractor" means a person who:
(i)
has entered into a contract with a governmental entity; and
(ii)
may process personal data under the contract.
(b)
"Contractor" includes a contractor's employees, agents, or subcontractors.
(10)
"Cyber Center" means the Utah Cyber Center created in Section
63A-16-1102
.
(11)
"Data breach" means the unauthorized access, acquisition, disclosure, loss of access, or
destruction of personal data held by a governmental entity, unless the governmental
entity concludes, according to standards established by the Cyber Center, that there is a
low probability that personal data has been compromised.
(12)
"Data privacy complaint" means a complaint or concern raised by an individual
regarding:
(a)
an alleged infringement on the individual's data privacy interests described in
Subsection
63A-19-102(1)
; or
(b)
a governmental entity's data privacy practices described in Part 4, Duties of
Governmental Entities.
(13)
"De-identified data" means information from which personal data has been removed or
obscured so that the information is not readily identifiable to a specific individual, and
which may not be re-identified.
(13)
(14)
"Genetic data" means the same as that term is defined in Section
13-60-102
.
(14)
(15)
"Governing board" means the Utah Privacy Governing Board established in
Section
63A-19-201
.
(15)
(16)
"Governmental entity" means the same as that term is defined in Section
63G-2-103
.
(16)
(17)
"Government website" means a set of related web pages that is operated by or on
behalf of a governmental entity and is:
(a)
located under a single domain name or web address; and
(b)
accessible directly through the
Internet
internet
or by the use of a software program.
(17)
(18)
(a)
"High-risk processing activities" means a governmental entity's processing
of personal data that may have a significant impact on an individual's privacy
interests, based on factors that include:
(i)
the sensitivity of the personal data processed;
(ii)
the amount of personal data being processed;
(iii)
the individual's ability to consent to the processing of personal data; and
(iv)
risks of unauthorized access or use.
(b)
"High-risk processing activities" may include the use of:
(i)
facial recognition technology;
(ii)
automated decision making;
(iii)
profiling;
(iv)
genetic data
of a living person
;
(v)
biometric data; or
(vi)
specific
geolocation data.
(18)
(19)
"Independent entity" means the same as that term is defined in Section
63E-1-102
.
(19)
(20)
"Individual" means the same as that term is defined in Section
63G-2-103
.
(20)
(21)
"Legal guardian" means:
(a)
the parent of a minor; or
(b)
an individual appointed by a court to be the guardian of a minor or incapacitated
individual and given legal authority to make decisions regarding the person or
property of the minor or incapacitated individual.
(21)
(22)
"Office" means the Utah Office of Data Privacy created in Section
63A-19-301
.
(22)
(23)
"Ombudsperson" means the data privacy ombudsperson appointed under Section
63A-19-501
.
(23)
(24)
"Person" means the same as that term is defined in Section
63G-2-103
.
(24)
(25)
"Personal data" means information that is linked or can be reasonably linked to
an identified individual or an identifiable individual.
(25)
(26)
"Privacy annotation" means a summary of personal data contained in a record
series as described in Section
63A-19-401.1
.
(26)
(27)
"Privacy practice" means a governmental entity's:
(a)
organizational, technical, administrative, and physical safeguards designed to protect
an individual's personal data;
(b)
policies and procedures related to the acquisition, use, storage, sharing, retention,
and disposal of personal data; and
(c)
practice of providing notice to an individual regarding the individual's privacy rights.
(27)
(28)
"Process," "processing," or "processing activity" means any operation or set of
operations performed on personal data, including collection, recording, organization,
structuring, storage, adaptation, alteration, access, retrieval, consultation, use, disclosure
by transmission, transfer, dissemination, alignment, combination, restriction, erasure, or
destruction.
(28)
(29)
"Profiling"
means the processing of personal data to evaluate or predict an
individual's:
means any form of automated processing performed on personal data to
evaluate, analyze, or predict an identified or identifiable individual's economic situation,
health, personal preferences, interests, reliability, behavior, location, or movements.
(a)
economic situation;
(b)
health;
(c)
personal preferences;
(d)
interests;
(e)
reliability;
(f)
behavior;
(g)
location; or
(h)
movements
.
(29)
(30)
(a)
"Purchase" or "purchasing" means the exchange of monetary consideration
to obtain the personal data of an individual who is not a party to the transaction.
(b)
"Purchase" or "purchasing" does not include payment from one governmental entity
to another governmental entity for access to a record in accordance with Section
63G-2-203
.
(30)
(31)
"Record" means the same as that term is defined in Section
63G-2-103
.
(31)
(32)
"Record series" means the same as that term is defined in Section
63G-2-103
.
(32)
(33)
"Retention schedule" means a governmental entity's schedule for the retention or
disposal of records that has been approved by the Records Management Committee
pursuant to Section
63A-12-113
.
(33)
(34)
(a)
"Sell" means
an exchange
the transfer
of personal data
in exchange
for
monetary consideration by a governmental entity to a third party.
(b)
"Sell" does not include a fee:
(i)
charged by a governmental entity for access to a record pursuant to Section
63G-2-203
; or
(ii)
assessed in accordance with an approved fee schedule.
(35)
"Specific geolocation data" means the same as that term is defined in Section
13-61-101
.
(34)
(36)
(a)
"State agency" means the following entities that are under the direct
supervision and control of the governor or the lieutenant governor:
(i)
a department;
(ii)
a commission;
(iii)
a board;
(iv)
a council;
(v)
an institution;
(vi)
an officer;
(vii)
a corporation;
(viii)
a fund;
(ix)
a division;
(x)
an office;
(xi)
a committee;
(xii)
an authority;
(xiii)
a laboratory;
(xiv)
a library;
(xv)
a bureau;
(xvi)
a panel;
(xvii)
another administrative unit of the state; or
(xviii)
an agent of an entity described in Subsections
(34)(a)(i)
(36)(a)(i)
through
(xvii)
.
(b)
"State agency" does not include:
(i)
the legislative branch;
(ii)
the judicial branch;
(iii)
an executive branch agency within the Office of the Attorney General, the state
auditor, the state treasurer, or the State Board of Education; or
(iv)
an independent entity.
(35)
"State privacy auditor" means the same as that term is defined in Section
67-3-13
.
(36)
(37)
"Synthetic data" means artificial data that:
(a)
is generated from personal data; and
(b)
models the statistical properties of the original personal data.
(37)
(38)
"User" means an individual who accesses a government website.
(38)
(39)
(a)
"User data" means any information about a user that is automatically
collected by a government website when a user accesses the government website.
(b)
"User data" includes information that identifies:
(i)
a user as having requested or obtained specific materials or services from a
government website;
(ii)
Internet
internet
sites visited by a user;
(iii)
the contents of a user's data-storage device;
(iv)
any identifying code linked to a user of a government website; and
(v)
a user's:
(A)
IP or Mac address; or
(B)
session ID.
(39)
(40)
"Website tracking technology" means any tool used by a government website to:
(a)
monitor a user's behavior; or
(b)
collect user data.
Section 7. Section
63A-19-202
is amended to read:
2. Utah Privacy Governing Board and Utah Privacy Commission
63A-19-202
. Governing board duties.
(1)
The governing board shall:
(a)
recommend changes to the state data privacy policy;
(b)
by July 1 of each year, approve the data privacy agenda items for the commission
and make recommendations for additional items for the data privacy agenda;
(c)
(b)
hear issues raised by the ombudsperson regarding existing governmental entity
privacy practices;
(d)
(c)
evaluate and recommend the appropriate:
(i)
structure and placement for the office within state government; and
(ii)
authority to be granted to the office, including any authority to make rules; and
(e)
(d)
recommend funding mechanisms and strategies for governmental entities to
enable compliance with data privacy responsibilities, including:
(i)
appropriations;
(ii)
rates;
(iii)
grants; and
(iv)
internal service funds.
(2)
In fulfilling the duties under this part, the governing board may receive and request
input from:
(a)
governmental entities;
(b)
elected officials;
(c)
subject matter experts; and
(d)
other stakeholders.
Section 8. Section
63A-19-203
is amended to read:
63A-19-203
. Utah Privacy Commission created.
(1)
There is created the Utah Privacy Commission.
(2)
(a)
The commission shall be composed of
12
no more than 14
members.
(b)
The governor shall appoint:
(i)
one member who, at the time of appointment provides internet technology services
for a county;
(ii)
one member with experience in cybersecurity;
(iii)
one member representing private industry in technology;
(iv)
one member representing law enforcement;
and
(v)
one member with experience in data privacy law
.
; and
(vi)
one member who is a private citizen representing the public.
(c)
The State Board of Education shall appoint one member representing public
education entities and the privacy interests of students.
(c)
(d)
The state auditor shall appoint:
(i)
one member with experience in internet technology services;
(ii)
one member with experience in cybersecurity;
(iii)
one member representing private industry in technology;
(iv)
one member with experience in data privacy law; and
(v)
one member representing municipalities
who, at the time of appointment, has
expertise in civil liberties law, the ethical use of data, or the impacts of the use of
a technology on different populations.
.
(d)
(e)
The attorney general shall appoint:
(i)
one member with experience as a prosecutor or appellate attorney and with
experience in data privacy or civil liberties law; and
(ii)
one member representing law enforcement.
(3)
(a)
Except as provided in Subsection
(3)(b)
, a member is appointed for a term of four
years.
(b)
The initial appointments of members described in Subsections
(2)(b)(i) through
(b)(iii), (2)(c)(iv) through (c)(v), and (2)(d)(ii)
(2)(b)(i) through
(iii)
, (2)(d)(iv) and
(v), and (2)(e)(ii)
shall be for two-year terms.
(c)
When the term of a current member expires, a member shall be reappointed or a new
member shall be appointed in accordance with Subsection
(2)
.
(4)
(a)
When a vacancy occurs in the membership for any reason, a replacement shall be
appointed in accordance with Subsection
(2)
for the unexpired term.
(b)
A member whose term has expired may continue to serve until a replacement is
appointed.
(5)
The commission shall select officers from the commission's members as the
commission finds necessary.
(6)
(a)
A majority of the members of the commission is a quorum.
(b)
The action of a majority of a quorum constitutes an action of the commission.
(7)
A member may not receive compensation or benefits for the member's service but may
receive per diem and travel expenses incurred as a member of the commission at the
rates established by the Division of Finance under:
(a)
Sections
63A-3-106
and
63A-3-107
; and
(b)
rules made by the Division of Finance in accordance with Sections
63A-3-106
and
63A-3-107
.
(8)
A member shall refrain from participating in a review of:
(a)
an entity of which the member is an employee; or
(b)
a technology in which the member has a financial interest.
(9)
The
state auditor
office
shall provide staff and support to the commission.
(10)
The commission shall meet up to 12 times a year to accomplish the duties described in
Section
63A-19-204
.
(11)
(a)
The commission shall, in accordance with Title 63G, Chapter 3, Utah
Administrative Rulemaking Act, make rules establishing participation requirements
for commission members.
(b)
A commission member who fails to meet the participation requirements established
under Subsection
(11)(a)
may be removed by the official who appointed the member
in accordance with Subsection
(2)
.
Section 9. Section
63A-19-204
is amended to read:
63A-19-204
. Commission duties.
(1)
The commission shall:
(a)
annually develop
, approve, and make public by May 1 of each year
a data privacy
agenda that identifies for the upcoming year:
(i)
governmental entity privacy practices to be reviewed by the commission;
(ii)
educational and training materials that the commission intends to develop;
(iii)
any other items related to data privacy the commission intends to study; and
(iv)
best practices and guiding principles that the commission plans to develop
related to government privacy practices;
(b)
develop guiding standards and best practices with respect to government privacy
practices;
(c)
develop educational and training materials that include information about:
(i)
the privacy implications and civil liberties concerns of the privacy practices of
government entities;
(ii)
best practices for government collection and retention policies regarding personal
data; and
(iii)
best practices for government personal data security standards;
and
(d)
review the privacy implications and civil liberties concerns of government privacy
practices
; and
.
(e)
provide the data privacy agenda to the governing board by May 1 of each year.
(2)
The commission may, in addition to the approved items in the data privacy agenda
prepared under Subsection
(1)(a)
:
(a)
review specific government privacy practices as referred to the commission by the
chief privacy officer described in Section
63A-19-302
or the state
privacy
auditor

described in Section
67-3-13
;
(b)
review a privacy practice not accounted for in the data privacy agenda only upon
referral by the chief privacy officer or the state
privacy
auditor in accordance with
this section;
(c)
review and provide recommendations regarding consent mechanisms used by
governmental entities to collect personal
information
data
;
(d)
develop and provide recommendations to the Legislature on how to balance
transparency and public access of public records against an individual's reasonable
expectations of privacy and data protection;
and
(e)
develop recommendations for legislation regarding the guiding standards and best
practices the commission has developed in accordance with Subsection
(1)(a)
.
;
(f)
consult with relevant public and private entities in the performance of the
commission's duties listed in Subsection
(1)
; and
(g)
study and recommend which information contained in the privacy program report
described in Section
63A-19-401.3
should be a public record.
(3)
At least annually, on or before October 1, the commission shall report to the
Judiciary
Government Operations
Interim Committee:
(a)
the results of any reviews the commission has conducted;
(b)
the guiding standards and best practices described in Subsection
(1)(b)
; and
(c)
any recommendations for legislation the commission has developed in accordance
with Subsection
(2)(e)
(2)(d)
.
(4)
(a)
Upon request by the governing board, a member of the commission shall give an
update on the work of the commission at any governing board meeting.
(b)
The governing board may at any time instruct the commission to review and report
upon any privacy developments related to governmental privacy within the scope of
the commission's duties.
(4)
At least annually, on or before June 1, the commission shall report to the governing
board regarding:
(a)
governmental entity privacy practices the commission plans to review in the next
year;
(b)
any educational and training programs the commission intends to develop in relation
to government data privacy best practices;
(c)
results of the commission's data privacy practice reviews from the previous year; and
(d)
recommendations from the commission related to data privacy legislation,
standards, or best practices.
(5)
The data privacy agenda detailed in Subsection (1)(a) does not add to or expand the
authority of the commission.
Section 10. Section
63A-19-301
is amended to read:
63A-19-301
. Utah Office of Data Privacy.
(1)
There is created within the department the Utah Office of Data Privacy.
(2)
The office shall coordinate with the governing board and the commission to perform the
duties in this section.
(3)
The office shall:
(a)
create and maintain a data privacy framework designed to:
(i)
assist governmental entities to identify and implement effective and efficient data
privacy practices, tools, and systems that:
(A)
protect the privacy of personal data;
(B)
comply with data privacy laws and regulations specific to the governmental
entity, program, or data;
(C)
empower individuals to protect and control their personal data; and
(D)
enable information use and sharing among governmental entities, as allowed
by law; and
(ii)
account for differences in a governmental entity's resources, capabilities,
populations served, data types, and maturity level regarding data privacy practices;
(b)
review statutory provisions related to governmental data privacy and records
management to:
(i)
identify conflicts and gaps in data privacy law; and
(ii)
standardize language;
(c)
work with governmental entities to study, research, and identify:
(i)
additional data privacy practices that are feasible for governmental entities;
(ii)
potential remedies and accountability mechanisms for non-compliance of a
governmental entity;
(iii)
ways to expand an individual's control over the individual's personal data
processed by a governmental entity;
(iv)
resources needed to develop, implement, and improve data privacy programs; and
(v)
best practices regarding:
(A)
automated decision making;
(B)
the creation and use of synthetic, de-identified, or anonymized data; and
(C)
the use of website tracking technology;
(d)
monitor high-risk data processing activities within governmental entities;
(e)
coordinate with the Cyber Center to develop an incident response plan for data
breaches affecting governmental entities;
(f)
coordinate with the state archivist to:
(i)
incorporate data privacy practices into records management; and
(ii)
include data privacy content in the trainings described in Section
63A-12-110
; and
(g)
develop, maintain, and make available data privacy training, education, and
awareness materials that meet the requirements of Section
63A-19-401.2
.
(g)
create a data privacy training program for employees of governmental entities as
described in Section
63A-19-401.3
.
(4)
The office may:
(a)
provide expertise and assistance to governmental entities for high-risk data
processing activities;
(b)
create assessment tools and resources that a governmental entity may use to:
(i)
review, evaluate, and mature the governmental entity's privacy program, practices,
and processing activities; and
(ii)
evaluate the privacy impact, privacy risk, and privacy compliance of the
governmental entity's privacy program, practices, and processing activities;
(c)
charge a governmental entity a service fee, established in accordance with Section
63J-1-504
, for providing services that enable a governmental entity to perform the
governmental entity's duties under Section
63A-19-401
, if the governmental entity
requests the office provide those services;
(d)
bill a state agency, as provided in Section
63J-1-410
, for any services the office
provides to a state agency;
(e)
provide funding to assist a governmental entity in complying with:
(i)
this chapter; and
(ii)
Title 63G, Chapter 2, Part 3, Classification, and Title 63G, Chapter 2, Part 6,
Collection of Information and Accuracy of Records;
(f)
advise the governing board about widespread or systemic data privacy matters or
alleged violations;
(g)
work with the Division of Purchasing and General Services to develop cooperative
contracts that a governmental entity may choose to use to support the governmental
entity's data privacy compliance;
(h)
make available to governmental entities privacy compliance assessment tools that
may be used by governmental entities to assess the governmental entity's reasonable
compliance of processing activities described in this chapter;
(i)
upon request of a governmental entity or on the office's own initiative, issue guidance
or recommendations regarding:
(i)
compliance with this chapter; and
(ii)
best practices for data privacy and data governance;
(j)
contract with an institute, component, or department at a state institution of higher
education to support the office in:
(i)
conducting research and prepare reports regarding data privacy and data
governance;
(ii)
providing support to the commission;
(iii)
holding data governance summits and educational programs;
(iv)
developing systems and tools to support data privacy and data governance; and
(v)
providing other services in support of the office's duties under this chapter;
(k)
create data governance models that may be used by governmental entities;
and
(f)
(l)
make rules in accordance with Title 63G, Chapter 3, Utah Administrative
Rulemaking Act, to administer this
part
chapter
.
(5)
(a)
Upon application by a governmental entity, the office may
:
(i)

grant, for a limited period of time, a governmental entity with an:
(A)
(i)
extension of time to comply with certain requirements of Part 4, Duties of
Governmental Entities; or
(B)
(ii)
exemption from complying with certain requirements of Part 4, Duties of
Governmental Entities
; or
.
(ii)
allow a governmental entity to establish a data privacy training program for the
governmental entity's employees to complete, instead of the data privacy training
program established by the office under Section
63A-19-401.3
, if the
governmental entity's data privacy training program contains the same information
contained in the office's data privacy training program.
(b)
On the office's own initiative, the office may issue a one-time extension to a category
or group of governmental entities to comply with certain requirements of Part 4,
Duties of Governmental Entities.
(c)
An extension issued under Subsection
(5)(b)
:
(i)
shall:
(A)
identify the specific duty for which the extension is granted and the section
that imposes the duty; and
(B)
specify the category or group of governmental entities to which the extension
applies; and
(ii)
may not be longer than 12 months.
(d)
An application for an extension or exemption submitted under Subsection
(5)(a)(i)
(5)(a)

shall:
(i)
identify the specific duty from which the governmental entity seeks an extension
or exemption and the section that imposes that duty; and
(ii)
include a justification for the requested extension or exemption.
(c)
(e)
If the office grants an exemption under Subsection
(5)(a)
, the office shall report
at the next board meeting:
(i)
the name of the governmental entity that received an exemption; and
(ii)
the nature of the exemption.
(d)
The office shall notify the state privacy auditor of any approved extensions or
exemptions.
Section 11. Section
63A-19-302
is amended to read:
63A-19-302
. Chief privacy officer -- Appointment -- Powers -- Reporting.
(1)
The governor shall, with the advice and consent of the Senate, appoint a chief privacy
officer.
(2)
The chief privacy officer is the director of the office.
(3)
The chief privacy officer:
(a)
shall exercise all powers given to and perform all duties imposed on the office;
(b)
has administrative authority over the office;
(c)
may make changes in office personnel and service functions under the chief privacy
officer's administrative authority;
(d)
may authorize a designee to assist with the chief privacy officer's responsibilities; and
(e)
shall report annually, on or before
October 1
June 30
, to the
Judiciary Interim
Committee
Government Operations Interim Committee
regarding:
(i)
recommendations for legislation to address data privacy concerns; and
(ii)
reports received from state agencies regarding the sale or sharing of personal data
provided under
Subsection 63A-19-401(2)(f)(ii).
Section
63A-19-401.3
.
Section 12. Section
63A-19-401
is amended to read:
63A-19-401
. Duties of governmental entities.
(1)
(a)
Except as provided in Subsections
(1)(b)
and
(c)
, a governmental entity shall
comply with the requirements of this part.
(b)
If any provision in this part conflicts with any other provisions of law, the more
specific or more restrictive law shall control
If a more specific or more restrictive law
governs the treatment of a type of personal data, the more specific or more restrictive
law shall control
.
(c)
A governmental entity that is exempt under Section
63G-2-702
,
63G-2-703
, or
63G-2-704
from complying with the requirements in Title 63G, Chapter 2, Part 6,
Collection of Information and Accuracy of Records, is exempt from complying with
the requirements in this chapter.
(2)
(a)
A governmental entity shall:
(i)
initiate a data privacy program before December 31, 2025;
(ii)
obtain and process only the minimum amount of personal data reasonably
necessary to efficiently achieve a specified purpose;
(iii)
meet the requirements of this part for all new processing activities implemented
by a governmental entity; and
(iv)
for any processing activity implemented before May 7, 2025, as soon as is
reasonably practicable, but no later than July 1, 2027:
(A)
identify any non-compliant processing activity;
(B)
document the non-compliant processing activity;
(C)
(B)
prepare a strategy for bringing the non-compliant processing activity into
compliance with this part; and
(D)
(C)
include the information described in Subsections
(2)(a)(iv)(A)

through
(C)
and
(B)
in the privacy program report described in Section
63A-19-401.3
.
(b)
A governmental entity that fulfills the reporting requirement under Section
63A-19-401.3
satisfies the requirement to initiate a privacy program under
Subsection
(2)(a)(i)
.
(3)
A governmental entity may not:
(a)
establish, maintain, or use undisclosed or covert surveillance of individuals unless
permitted by law;
(b)
sell personal data unless expressly required by law; and
(c)
share personal data unless permitted by law.
Section 13. Section
63A-19-401.1
is amended to read:
63A-19-401.1
. Privacy annotations.
(1)
(a)
Beginning July 1, 2027, a state agency shall make a complete and accurate
privacy annotation for each record series containing personal data that the state
agency collects, maintains, or uses.
(b)
After July 1, 2027, a state agency that has not
created
completed
a privacy
annotation for a record series containing personal data, may not collect, maintain, or
use the personal data
in the record series
.
(2)
If a state agency determines that a record series:
(a)
does not contain personal data, the privacy annotation shall be limited to a statement
indicating that the record series does not include personal data; or
(b)
contains personal data, the privacy annotation shall include:
(i)
an inventory of all types of personal data included in the record series;
(ii)
a description of all purposes for which the state agency collects, keeps, or uses the
personal data;
(iii)
a citation to the state agency's legal authority for collecting, keeping, or using the
personal data; and
(iv)
any other information required by the rules created by the office under Section
63A-19-301
.
Section 14. Section
63A-19-401.2
is amended to read:
63A-19-401.2
. Training requirements.
(1)
The data privacy training program created by the office under Section
63A-4-301
shall
be:
(a)
designed to provide instruction regarding:
(i)
data privacy best practices, obligations, and responsibilities; and
(ii)
the relationship between privacy, records management, and security; and
(b)
required for all employees of a governmental entity who:
(i)
have access to personal data as part of the employee's work duties; or
(ii)
supervise an employee who has access to personal data.
(2)
The training described in Subsection (1) shall be completed:
(a)
within 30 days after an employee of a governmental entity begins employment; and
(b)
at least once in each calendar year.
(3)
A governmental entity is responsible for:
(a)
ensuring that each employee of the governmental entity completes the data privacy
training as required by Subsection (2); and
(b)
reporting the governmental entity's compliance with the training requirements as
described in Section
63A-19-401.3
.
(1)
An employee of a governmental entity shall complete data privacy training that includes
instruction on:
(a)
data privacy best practices, obligations, and responsibilities;
(b)
the relationship between privacy, records management, and security;
(c)
the privacy interests and requirements of this chapter; and
(d)
as applicable, the privacy interests and requirements of Title 63G, Chapter 2,
Government Records Access and Management Act.
(2)
An employee of a governmental entity shall complete the data privacy training
described in Subsection
(1)
if the employee:
(a)
has access to personal data as part of the employee's assigned duties; or
(b)
supervises an employee who has access to personal data.
(3)
The training described in Subsection
(1)
shall be completed:
(a)
within 30 days after the day on which the employee begins employment with a
governmental entity; and
(b)
at least once in each calendar year.
(4)
A governmental entity shall:
(a)
ensure that each employee described in Subsection
(2)
completes a data privacy
training that meets the requirements described in Subsection
(1)
; and
(b)
report the percentage of the governmental entity's employees required to complete
the data privacy training under this section that have completed the training as part of
the privacy program report described in Section
63A-19-401.3
.
(5)
A governmental entity may use the data privacy training created by the office to satisfy
the requirements of this section, or may provide separate data privacy training that meets
the requirements of this section.
Section 15. Section
63A-19-401.3
is amended to read:
63A-19-401.3
. Privacy program report.
(1)
On or before December 31 of each year, the chief administrative officer of each
governmental entity shall prepare a report that includes:
(a)
whether
how
the governmental entity has initiated
a
the governmental entity's

privacy program;
(b)
a description of:
(i)
any privacy practices implemented by the governmental entity
the governmental
entity's privacy program including privacy practices
;
(ii)
strategies for improving
and maturing
the governmental entity's privacy program
and practices; and
(iii)
the governmental entity's high-risk processing activities;
(c)
a list of the types of personal data the governmental entity currently shares, sells, or
purchases;
(d)
the legal basis for sharing, selling, or purchasing personal data;
(e)
the category of individuals or entities:
(i)
with whom the governmental entity shares personal data;
(ii)
to whom the governmental entity sells personal data; or
(iii)
from whom the governmental entity purchases personal data;
(f)
the percentage of the governmental entity's employees that have fulfilled the data
privacy training requirements described in Section
63A-19-401.2
the percentage of
the governmental entity's employees required to complete the data privacy training
under Section
63A-19-401.2
that have completed the training
; and
(g)
a description of any non-compliant processing activities identified under Subsection
63A-19-401(2)(a)(iv)
and the governmental entity's strategy for bringing those
activities into compliance with this part.
(2)
The report described in Subsection
(1)
shall be
:
(a)
shall be
considered a protected record under Section
63G-2-305
;
and
(b)
may be made available at the request of the office.
shared with the office, in
accordance with Section
63G-2-206
, on or before December 31 each year; and
(c)
retained by the governmental entity for no less than five years.
Section 16. Section
63A-19-401.4
is amended to read:
63A-19-401.4
. Requirements for contractors.
(1)
Except as provided in Subsection
(4)
, a contractor that processes or has access to
personal data as a part of the contractor's duties under a contract with a governmental
entity is subject to the requirements of this chapter to the same extent as the
governmental entity for any personal data the contractor processes or has access to under
a contract with the governmental entity.
(2)
A contract entered into or renewed between a contractor and a governmental entity after
July 1,
2026
2027
, shall contain specific language that requires a contractor to comply
with the requirements of this chapter with regard to the personal data processed or
accessed by the contractor as a part of the contractor's duties under a contract to the
same extent as required of the governmental entity.
(3)
The requirements under this section are in addition to and do not replace any other
requirements or liability that may be imposed for the contractor's violation of other laws
protecting privacy rights or government records.
(4)
A contractor is not subject to the data privacy training program requirements described
in Section
63A-19-401.2
.
Section 17. Section
63A-19-403
is amended to read:
63A-19-403
. Procedure to request amendment or correction of personal data.
(1)
A governmental entity that collects personal data shall provide a procedure by which an
individual or legal guardian of an individual may request an amendment or correction of
:

(a)
personal data that has been furnished to the governmental entity
.
; and
(b)
information concerning an identifiable individual contained in a record maintained
by the governmental entity, as allowed by law.
(2)
The procedure by which an individual or legal guardian of an individual may request an
amendment or correction shall comply with all applicable laws and regulations to which
the personal data
or information
at issue and to which the governmental entity is subject.
(3)
The procedure to request an amendment or correction described in this section does not
obligate the governmental entity to make the requested amendment or correction.
Section 18. Section
63A-19-405
is amended to read:
63A-19-405
. Data breach notification to the Cyber Center and the Office of the
Attorney General.
(1)
(a)
A governmental entity that identifies a data breach affecting 500 or more
individuals shall notify the Cyber Center and the attorney general of the data breach.
(b)
In addition to the notification required by Subsection
(1)(a),
a governmental entity
that identifies the unauthorized access, acquisition, disclosure, loss of access, or
destruction of data that compromises the security, confidentiality, availability, or
integrity of the computer systems used or information maintained by the
governmental entity shall
notify
provide notification to
the Cyber Center
in
accordance with Section
63A-16-1103
.
(c)
A governmental entity that identifies the unauthorized access, unauthorized
acquisition, unauthorized disclosure, loss of access, or unauthorized destruction of
personal data that is used or is reasonably likely to be used to commit theft, fraud, or
other criminal acts shall provide notification of the breach to:
(i)
each individual whose personal data is involved in the breach; and
(ii)
the attorney general.
(2)
The notification under Subsection
(1)
shall:
(a)
be made without unreasonable delay, but no later than five days from the discovery
of the data breach; and
(b)
include the following information:
(i)
the date and time the data breach occurred;
(ii)
the date the data breach was discovered;
(iii)
a short description of the data breach that occurred;
(iv)
the means by which access was gained to the system, computer, or network;
(v)
the person who perpetrated the data breach;
(vi)
steps the governmental entity is or has taken to mitigate the impact of the data
breach; and
(vii)
any other details requested by the Cyber Center.
(3)
For a data breach
under
described in
Subsection
(1)(a),
the governmental entity shall
provide the following information to the Cyber Center and the attorney general in
addition to the information required under Subsection
(2)(b)
:
(a)
the total number of individuals affected by the data breach, including the total
number of Utah residents affected; and
(b)
the type of personal data involved in the data breach.
(4)
If the information required by Subsections
(2)(b)
and (3) is not available within five
days of discovering the breach, the governmental entity shall provide as much of the
information required under Subsections
(2)(b)
and
(3)
as is available and supplement
the notification with additional information as soon as the information becomes
available.
(5)
(a)
A governmental entity that experiences a data breach affecting fewer than 500
individuals shall create an internal incident report containing the information in
Subsection
(2)(b)
as soon as practicable and shall provide additional information as
the information becomes available.
(b)
A governmental entity shall provide to the Cyber Center:
(i)
an internal incident report described in Subsection
(5)(a)
upon request of the
Cyber Center; and
(ii)
an annual report logging all of the governmental entity's data breach incidents
affecting fewer than 500 individuals.
Section 19. Section
63A-19-406
is amended to read:
63A-19-406
. Data breach notice to individuals affected by data breach.
(1)
(a)
Except as provided in Subsection
(1)(b),
a governmental entity shall provide
cause

a data breach notice to
be sent to
an individual or legal guardian of an individual
affected by the data breach:
(i)
after determining the scope of the data breach;
(ii)
after restoring the reasonable integrity of the affected system, if necessary; and
(iii)
without unreasonable delay except as provided in Subsection
(2).
(b)
A governmental entity
or the governmental entity's contractor
is not required to
provide a data breach notice to an affected individual as described in Subsection
(1)(a)
if the:
(i)
personal data involved in the data breach would be classified as a public record
under Section
63G-2-301
; and
(ii)
the governmental entity prominently posts notice of the data breach on the
homepage of the governmental entity's government website.
(2)
A governmental entity
or the governmental entity's contractor
shall delay providing
notification under Subsection
(1)
at the request of a law enforcement agency that
determines that notification may impede a criminal investigation, until
such time as
the
law enforcement agency informs the governmental entity that notification will no longer
impede the criminal investigation.
(3)
The data breach notice to an affected individual shall include:
(a)
a description of the data breach;
(b)
the individual's personal data that was accessed or may have been accessed;
(c)
steps the governmental entity is taking or has taken to mitigate the impact of the data
breach;
and
(d)
recommendations to the individual on how to protect
themselves
the individual

from identity theft and other financial losses
; and
.
(e)
any other language required by the Cyber Center.
(4)
Unless the governmental entity reasonably believes that providing notification would
pose a threat to the safety of an individual, or unless an individual has designated to the
governmental entity a preferred method of communication, a governmental entity
or the
governmental entity's contractor
shall provide notice by:
(a)
(i)
email, if reasonably available and allowed by law; or
(ii)
mail; and
(b)
one of the following methods, if the individual's contact information is reasonably
available and the method is allowed by law:
(i)
text message with a summary of the data breach notice and instructions for
accessing the full notice; or
(ii)
telephone message with a summary of the data breach notice and instructions for
accessing the full data breach notice.
(5)
A governmental entity shall also provide a data breach notice in a manner that is
reasonably calculated to have the best chance of being received by the affected
individual or the legal guardian of an individual, such as through a press release, posting
on appropriate social media accounts, or publishing notice in a newspaper of general
circulation when:
(a)
a data breach affects more than 500 individuals; and
(b)
a governmental entity is unable to obtain an individual's contact information to
provide notice for any method listed in Subsection
(4).
Section 20. Section
63A-19-407
is enacted to read:
63A-19-407
. Technology transparency study -- Report to Legislature.
(1)
The office and the commission shall jointly study the implementation of processing
activities for which an individual's personal data may be collected without the ability to
provide direct notice:
(a)
the public safety benefits and legitimate governmental purposes served by the
processing activities described in this Subsection
(1)
;
(b)
the privacy implications of the processing activities described in this Subsection
(1)
;
and
(c)
appropriate frameworks for governing the processing activities described in this
Subsection
(1)
by governmental entities.
(2)
In conducting the study described in Subsection
(1)
, the office and the commission shall
solicit input from:
(a)
state and local law enforcement agencies;
(b)
civil liberties organizations;
(c)
governmental entities that use or are considering the use of data collection
technology; and
(d)
other interested stakeholders.
(3)
On or before the November 2027 interim meeting, the office shall report the findings
and recommendations of the study described in Subsection
(2)
to the Government
Operations Interim Committee, including any recommended legislation.
Section 21. Section
63A-19-408
, which is renumbered from Section 63G-2-303 is renumbered
and amended to read:
63G-2-303
63A-19-408
. Private information concerning certain government
employees.
(1)
As used in this section:
(a)
"At-risk government employee" means a current or former:
(i)
peace officer as specified in Section
53-13-102
;
(ii)
state or federal judge of an appellate, district, justice, or juvenile court, or court
commissioner;
(iii)
judge authorized by Title 39A, Chapter 5, Utah Code of Military Justice;
(iv)
judge authorized by Armed Forces, Title 10, United States Code;
(v)
federal prosecutor;
(vi)
prosecutor appointed pursuant to Armed Forces, Title 10, United States Code;
(vii)
law enforcement official as defined in Section
53-5a-311
;
(viii)
prosecutor authorized by Title 39A, Chapter 5, Utah Code of Military Justice; or
(ix)
state
, federal,
or local government employee who, because of the unique nature
of the employee's regular work assignments or because of one or more recent
credible threats directed to or against the employee, would be at immediate and
substantial risk of physical harm if the employee's personal information is
disclosed.
(b)
"Family member" means the spouse, child, sibling, parent, or grandparent of an
at-risk government employee who is living with the employee.
(c)
"Personal information" means the employee's or the employee's family member's
home address, home telephone number, personal mobile telephone number, personal
pager number, personal email address, social security number, insurance coverage,
marital status, or payroll deductions.
(2)
(a)
Pursuant to Subsection
63G-2-302(1)(h)
, an at-risk government employee may
file a written application that:
(i)
gives notice of the employee's status as an at-risk government employee to each
agency of a government entity holding a record or a part of a record that would
disclose the employee's personal information; and
(ii)
requests that the government agency classify those records or parts of records as
private.
(b)
An at-risk government employee desiring to file an application under this section
may request assistance from the government agency to identify the individual records
containing personal information.
(c)
Each government agency shall develop a form that:
(i)
requires the at-risk government employee to designate each specific record or part
of a record containing the employee's personal information that the applicant
desires to be classified as private;
(ii)
affirmatively requests that the government entity holding those records classify
them as private;
(iii)
informs the employee that by submitting a completed form the employee may
not receive official announcements affecting the employee's property, including
notices about proposed municipal annexations, incorporations, or zoning
modifications; and
(iv)
contains a place for the signature required under Subsection
(2)(d)
.
(d)
A form submitted by an employee under Subsection
(2)(c)
shall be signed by the
highest ranking elected or appointed official in the employee's chain of command
certifying that the employee submitting the form is an at-risk government employee.
(3)
A county recorder, county treasurer, county auditor, or a county tax assessor may fully
satisfy the requirements of this section by:
(a)
providing a method for the assessment roll and index and the tax roll and index that
will block public access to the home address, home telephone number, situs address,
and Social Security number; and
(b)
providing the at-risk government employee requesting the classification with a
disclaimer informing the employee that the employee may not receive official
announcements affecting the employee's property, including notices about proposed
annexations, incorporations, or zoning modifications.
(4)
A government agency holding records of an at-risk government employee classified as
private under this section may release the record or part of the record if:
(a)
the employee or former employee gives written consent;
(b)
a court orders release of the records;
(c)
the government agency receives a certified death certificate for the employee or
former employee; or
(d)
as it relates to the employee's voter registration record:
(i)
the person to whom the record or part of the record is released is a qualified
person under Subsection
20A-2-104(4)(n)
; and
(ii)
the government agency's release of the record or part of the record complies with
the requirements of Subsection
20A-2-104(4)(o)
.
(5)
(a)
If the government agency holding the private record receives a subpoena for the
records, the government agency shall attempt to notify the at-risk government
employee or former employee by mailing a copy of the subpoena to the employee's
last-known mailing address together with a request that the employee either:
(i)
authorize release of the record; or
(ii)
within 10 days of the date that the copy and request are mailed, deliver to the
government agency holding the private record a copy of a motion to quash filed
with the court who issued the subpoena.
(b)
The government agency shall comply with the subpoena if the government agency
has:
(i)
received permission from the at-risk government employee or former employee to
comply with the subpoena;
(ii)
not received a copy of a motion to quash within 10 days of the date that the copy
of the subpoena was mailed; or
(iii)
received a court order requiring release of the records.
(6)
(a)
Except as provided in Subsection
(6)(b)
, a form submitted under this section
remains in effect until the earlier of:
(i)
four years after the date the employee signs the form, whether or not the
employee's employment terminates before the end of the four-year period; and
(ii)
one year after the government agency receives official notice of the death of the
employee.
(b)
A form submitted under this section may be rescinded at any time by:
(i)
the at-risk government employee who submitted the form; or
(ii)
if the at-risk government employee is deceased, a member of the employee's
immediate family.
Section 22. Section
63A-19-501
is amended to read:
63A-19-501
. Data privacy ombudsperson.
(1)
The governor shall appoint a data privacy ombudsperson with the advice of the
governing board.
There is created within the office the position of data privacy
ombudsperson.
(2)
The governor shall appoint the ombudsperson with the advice of the governing board.
(2)
(3)
The ombudsperson shall:
(a)
be an attorney in good standing and authorized to practice law in this state;
(b)
be familiar with the provisions of:
(i)
this chapter;
(ii)
Chapter 12, Division of Archives and Records Service and Management of
Government Records; and
(iii)
Title 63G, Chapter 2, Government Records Access and Management Act; and
(b)
(c)
serve as a resource for:
(i)
an individual who is making
or responding to a complaint about a governmental
entity's data privacy practice
a data privacy complaint
; and
(ii)
a governmental entity
which
that
is the subject of a data privacy complaint.
(3)
(4)
The ombudsperson may
,
:

(a)
(i)
upon request by a governmental entity or individual, mediate
data privacy
disputes between individuals and governmental entities
a dispute between the
governmental entity and the individual regarding the individual's data privacy
complaint; and
(ii)
upon resolution of a data privacy complaint described in Subsection
(4)(a)(i)
, post
on the office's website a brief summary of the data privacy complaint and the
resolution of the matter; and
(b)
provide data privacy education and training in accordance with Subsection
63A-19-301(3)(g)
.
(5)
The ombudsperson may not:
(a)
mediate a dispute between a governmental entity and an individual if the individual's
data privacy complaint is within the authority of:
(i)
the Government Records Office created in Section
63A-12-202
; or
(ii)
the government records ombudsman established in Section
63A-12-204
;
(b)
expand the scope of a mediation beyond the individual's data privacy complaint;
(c)
testify, or be compelled to testify, regarding a matter for which the ombudsperson
provides services under this section; or
(d)
conduct an audit of a governmental entity's privacy practices.
(4)
(6)
After consultation with the chief privacy officer, the ombudsperson may raise
issues
matters
and questions
before
to
the governing board
regarding serious and
repeated violations of data privacy from:
.
(a)
a specific governmental entity; or
(b)
widespread governmental entity data privacy practices.
(5)
When a data privacy complaint has been resolved, the ombudsperson shall post on the
office's website a summary of the complaint and the resolution of the matter.
Section 23. Section
63A-19-502
is enacted to read:
63A-19-502
. Data privacy complaint process.
(1)
An individual who makes a data privacy complaint shall first submit the complaint to
the chief administrative officer of the governmental entity that is the subject of the
complaint.
(2)
Upon receipt of a data privacy complaint under Subsection
(1)
, the chief administrative
officer shall attempt to resolve the complaint with the individual.
(3)
If the chief administrative officer is unable to resolve a data privacy complaint with the
individual under Subsection
(2)
, the individual or the governmental entity may request
mediation with the ombudsperson in accordance with Section
63A-19-501
.
(4)
If an individual submits a data privacy complaint directly to the ombudsperson, the
ombudsperson shall:
(a)
notify the individual and the governmental entity that the complaint will be referred
to the chief administrative officer of the governmental entity; and
(b)
refer the complaint to the chief administrative officer.
(5)
This section does not apply to a complaint about data privacy that is within the authority
of:
(a)
the Government Records Office created in Section
63A-12-202
; or
(b)
the government records ombudsman established in Section
63A-12-204
.
(6)
An employee of a governmental entity may submit a confidential and anonymous data
privacy complaint directly to the attorney general.
(7)
An employee of a governmental entity who submits a complaint under Subsection
(6)
is
entitled to the protections described in Title 67, Chapter 21, Utah Protection of Public
Employees Act.
Section 24. Section
63G-2-201
is amended to read:
63G-2-201
. Provisions relating to records -- Public records -- Private, controlled,
protected, and other restricted records -- Disclosure and nondisclosure of records --
Certified copy of record -- Limits on obligation to respond to record request.
(1)
(a)
Except as provided in Subsection
(1)(b)
, a person has the right to inspect a public
record free of charge, and the right to take a copy of a public record during normal
working hours, subject to Sections
63G-2-203
and
63G-2-204
.
(b)
A right under Subsection
(1)(a)
does not apply with respect to a record:
(i)
a copy of which the governmental entity has already provided to the person;
(ii)
that is the subject of a records request that the governmental entity is not required
to fill under Subsection
(7)(a)(v)
; or
(iii)
(A)
that is accessible only by a computer or other electronic device owned or
controlled by the governmental entity;
(B)
that is part of an electronic file that also contains a record that is private,
controlled, or protected; and
(C)
that the governmental entity cannot readily segregate from the part of the
electronic file that contains a private, controlled, or protected record.
(2)
A record is public unless otherwise expressly provided by statute.
(3)
The following records are not public:
(a)
a record that is private, controlled, or protected under Sections
63G-2-302
,
63G-2-303
63A-19-408
,
63G-2-304
, and
63G-2-305
; and
(b)
a record to which access is restricted pursuant to court rule, another state statute,
federal statute, or federal regulation, including records for which access is governed
or restricted as a condition of participation in a state or federal program or for
receiving state or federal funds.
(4)
Only a record specified in Section
63G-2-302
,
63G-2-303
63A-19-408
,
63G-2-304
, or
63G-2-305
may be classified private, controlled, or protected.
(5)
(a)
A governmental entity may not disclose a record that is private, controlled, or
protected to any person except as provided in Subsection
(5)(b)
, Subsection
(5)(c)
,
Section
63G-2-202
,
63G-2-206
, or
63G-2-303
63A-19-408
.
(b)
A governmental entity may disclose a record that is private under Subsection
63G-2-302(2)
or protected under Section
63G-2-305
to persons other than those
specified in Section
63G-2-202
or
63G-2-206
if the head of a governmental entity, or
a designee, determines that:
(i)
there is no interest in restricting access to the record; or
(ii)
the interests favoring access are greater than or equal to the interest favoring
restriction of access.
(c)
In addition to the disclosure under Subsection
(5)(b)
, a governmental entity may
disclose a record that is protected under Subsection
63G-2-305(51)
if:
(i)
the head of the governmental entity, or a designee, determines that the disclosure:
(A)
is mutually beneficial to:
(I)
the subject of the record;
(II)
the governmental entity; and
(III)
the public; and
(B)
serves a public purpose related to:
(I)
public safety; or
(II)
consumer protection; and
(ii)
the person who receives the record from the governmental entity agrees not to use
or allow the use of the record for advertising or solicitation purposes.
(6)
A governmental entity shall provide a person with a certified copy of a record if:
(a)
the person requesting the record has a right to inspect it;
(b)
the person identifies the record with reasonable specificity; and
(c)
the person pays the lawful fees.
(7)
(a)
In response to a request, a governmental entity is not required to:
(i)
create a record;
(ii)
compile, format, manipulate, package, summarize, or tailor information;
(iii)
provide a record in a particular format, medium, or program not currently
maintained by the governmental entity;
(iv)
fulfill a person's records request if the request unreasonably duplicates prior
records requests from that person;
(v)
fill a person's records request if:
(A)
the record requested is:
(I)
publicly accessible online; or
(II)
included in a public publication or product produced by the governmental
entity receiving the request; and
(B)
the governmental entity:
(I)
specifies to the person requesting the record where the record is accessible
online; or
(II)
provides the person requesting the record with the public publication or
product and specifies where the record can be found in the public
publication or product; or
(vi)
fulfill a person's records request if:
(A)
the person has been determined under Section
63G-2-209
to be a vexatious
requester;
(B)
the order of the director of the Government Records Office determining the
person to be a vexatious requester provides that the governmental entity is not
required to fulfill a request from the person for a period of time; and
(C)
the period of time described in Subsection
(7)(a)(vi)(B)
has not expired.
(b)
A governmental entity shall conduct a reasonable search for a requested record.
(8)
(a)
Although not required to do so, a governmental entity may, upon request from the
person who submitted the records request, compile, format, manipulate, package,
summarize, or tailor information or provide a record in a format, medium, or program
not currently maintained by the governmental entity.
(b)
In determining whether to fulfill a request described in Subsection
(8)(a)
, a
governmental entity may consider whether the governmental entity is able to fulfill
the request without unreasonably interfering with the governmental entity's duties
and responsibilities.
(c)
A governmental entity may require a person who makes a request under Subsection
(8)(a)
to pay the governmental entity, in accordance with Section
63G-2-203
, for
providing the information or record as requested.
(9)
(a)
Notwithstanding any other provision of this chapter, and subject to Subsection
(9)(b)
, a governmental entity is not required to respond to, or provide a record in
response to, a record request if the request is submitted by or in behalf of an
individual who is on parole or confined in a jail or other correctional facility
following the individual's conviction.
(b)
Subsection
(9)(a)
does not apply to:
(i)
the first five record requests submitted to the governmental entity by or in behalf
of an individual described in Subsection
(9)(a)
during any calendar year
requesting only a record that contains a specific reference to the individual; or
(ii)
a record request that is submitted by an attorney of an individual described in
Subsection
(9)(a)
.
(10)
(a)
A governmental entity may allow a person requesting more than 50 pages of
records to copy the records if:
(i)
the records are contained in files that do not contain records that are exempt from
disclosure, or the records may be segregated to remove private, protected, or
controlled information from disclosure; and
(ii)
the governmental entity provides reasonable safeguards to protect the public from
the potential for loss of a public record.
(b)
If the requirements of Subsection
(10)(a)
are met, the governmental entity may:
(i)
provide the requester with the facilities for copying the requested records and
require that the requester make the copies; or
(ii)
allow the requester to provide the requester's own copying facilities and personnel
to make the copies at the governmental entity's offices and waive the fees for
copying the records.
(11)
(a)
A governmental entity that owns an intellectual property right and that offers the
intellectual property right for sale or license may control by ordinance or policy the
duplication and distribution of the material based on terms the governmental entity
considers to be in the public interest.
(b)
Nothing in this chapter shall be construed to limit or impair the rights or protections
granted to the governmental entity under federal copyright or patent law as a result of
its ownership of the intellectual property right.
(12)
A governmental entity may not use the physical form, electronic or otherwise, in
which a record is stored to deny, or unreasonably hinder the rights of a person to inspect
and receive a copy of a record under this chapter.
(13)
Subject to the requirements of Subsection
(7)
, a governmental entity shall provide
access to an electronic copy of a record in lieu of providing access to its paper
equivalent if:
(a)
the person making the request requests or states a preference for an electronic copy;
(b)
the governmental entity currently maintains the record in an electronic format that is
reproducible and may be provided without reformatting or conversion; and
(c)
the electronic copy of the record:
(i)
does not disclose other records that are exempt from disclosure; or
(ii)
may be segregated to protect private, protected, or controlled information from
disclosure without the undue expenditure of public resources or funds.
(14)
In determining whether a record is properly classified as private under Subsection
63G-2-302(2)(d)
, the governmental entity, the director of the Government Records
Office, local appeals board, or court shall consider and weigh:
(a)
any personal privacy interests, including those in images, that would be affected by
disclosure of the records in question; and
(b)
any public interests served by disclosure.
Section 25. Section
63G-2-301
is amended to read:
63G-2-301
. Public records.
(1)
As used in this section:
(a)
"Business address" means a single address of a governmental agency designated for
the public to contact an employee or officer of the governmental agency.
(b)
"Business email address" means a single email address of a governmental agency
designated for the public to contact an employee or officer of the governmental
agency.
(c)
"Business telephone number" means a single telephone number of a governmental
agency designated for the public to contact an employee or officer of the
governmental agency.
(d)
"Correctional facility" means the same as that term is defined in Section
77-16b-102
.
(2)
The following records are public except to the extent they contain information expressly
permitted to be treated confidentially under the provisions of Subsections
63G-2-201(3)(b)
and
(6)(a)
:
(a)
laws;
(b)
the name, gender, gross compensation, job title, job description, business address,
business email address, business telephone number, number of hours worked per pay
period, dates of employment, and relevant education, previous employment, and
similar job qualifications of a current or former employee or officer of the
governmental entity, excluding:
(i)
undercover law enforcement personnel; and
(ii)
investigative personnel if disclosure could reasonably be expected to impair the
effectiveness of investigations or endanger any individual's safety;
(c)
final opinions, including concurring and dissenting opinions, and orders that are
made by a governmental entity in an administrative, adjudicative, or judicial
proceeding except that if the proceedings were properly closed to the public, the
opinion and order may be withheld to the extent that they contain information that is
private, controlled, or protected;
(d)
final interpretations of statutes or rules by a governmental entity unless classified as
protected as provided in Subsection
63G-2-305(17)
or
(18)
;
(e)
information contained in or compiled from a transcript, minutes, or report of the open
portions of a meeting of a governmental entity as provided by
Title 52, Chapter 4,
Open and Public Meetings Act
, including the records of all votes of each member of
the governmental entity;
(f)
judicial records unless a court orders the records to be restricted under the rules of
civil or criminal procedure or unless the records are private under this chapter;
(g)
unless otherwise classified as private under Section
63G-2-303
63A-19-408
, records
or parts of records filed with or maintained by county recorders, clerks, treasurers,
surveyors, zoning commissions, the Division of Forestry, Fire, and State Lands, the
School and Institutional Trust Lands Administration, the Division of Oil, Gas, and
Mining, the Division of Water Rights, or other governmental entities that give public
notice of:
(i)
titles or encumbrances to real property;
(ii)
restrictions on the use of real property;
(iii)
the capacity of persons to take or convey title to real property; or
(iv)
tax status for real and personal property;
(h)
records of the Department of Commerce that evidence incorporations, mergers, name
changes, and uniform commercial code filings;
(i)
data on individuals that would otherwise be private under this chapter if the
individual who is the subject of the record has given the governmental entity written
permission to make the records available to the public;
(j)
documentation of the compensation that a governmental entity pays to a contractor or
private provider;
(k)
summary data;
(l)
voter registration records, including an individual's voting history, except for a voter
registration record or those parts of a voter registration record that are classified as
private under Subsections
63G-2-302(1)(j)
through (n) or withheld under Subsection
20A-2-104(7)
;
(m)
for an elected official, as defined in Section
11-47-102
, a telephone number, if
available, and email address, if available, where that elected official may be reached
as required in
Title 11, Chapter 47, Access to Elected Officials
;
(n)
for a school community council member, a telephone number, if available, and email
address, if available, where that elected official may be reached directly as required
in Section
53G-7-1203
;
(o)
annual audited financial statements of the Utah Educational Savings Plan described
in Section
53H-10-210
; and
(p)
an initiative packet, as defined in Section
20A-7-101
, and a referendum packet, as
defined in Section
20A-7-101
, after the packet is submitted to a county clerk.
(3)
The following records are normally public, but to the extent that a record is expressly
exempt from disclosure, access may be restricted under Subsection
63G-2-201(3)(b)
,
Section
63G-2-302
,
63G-2-304
, or
63G-2-305
:
(a)
administrative staff manuals, instructions to staff, and statements of policy;
(b)
records documenting a contractor's or private provider's compliance with the terms
of a contract with a governmental entity;
(c)
records documenting the services provided by a contractor or a private provider to
the extent the records would be public if prepared by the governmental entity;
(d)
contracts entered into by a governmental entity;
(e)
any account, voucher, or contract that deals with the receipt or expenditure of funds
by a governmental entity;
(f)
records relating to government assistance or incentives publicly disclosed, contracted
for, or given by a governmental entity, encouraging a person to expand or relocate a
business in Utah, except as provided in Subsection
63G-2-305(35)
;
(g)
chronological logs and initial contact reports;
(h)
correspondence by and with a governmental entity in which the governmental entity
determines or states an opinion upon the rights of the state, a political subdivision,
the public, or any person;
(i)
empirical data contained in drafts if:
(i)
the empirical data is not reasonably available to the requester elsewhere in similar
form; and
(ii)
the governmental entity is given a reasonable opportunity to correct any errors or
make nonsubstantive changes before release;
(j)
drafts that are circulated to anyone other than:
(i)
a governmental entity;
(ii)
a political subdivision;
(iii)
a federal agency if the governmental entity and the federal agency are jointly
responsible for implementation of a program or project that has been legislatively
approved;
(iv)
a government-managed corporation; or
(v)
a contractor or private provider;
(k)
drafts that have never been finalized but were relied upon by the governmental entity
in carrying out action or policy;
(l)
original data in a computer program if the governmental entity chooses not to
disclose the program;
(m)
arrest warrants after issuance, except that, for good cause, a court may order
restricted access to arrest warrants prior to service;
(n)
search warrants after execution and filing of the return, except that a court, for good
cause, may order restricted access to search warrants prior to trial;
(o)
records that would disclose information relating to formal charges or disciplinary
actions against a past or present governmental entity employee if:
(i)
the disciplinary action has been completed and all time periods for administrative
appeal have expired; and
(ii)
the charges on which the disciplinary action was based were sustained;
(p)
records maintained by the Division of Forestry, Fire, and State Lands, the School and
Institutional Trust Lands Administration, or the Division of Oil, Gas, and Mining that
evidence mineral production on government lands;
(q)
final audit reports;
(r)
occupational and professional licenses;
(s)
business licenses;
(t)
a notice of violation, a notice of agency action under Section
63G-4-201
, or similar
records used to initiate proceedings for discipline or sanctions against persons
regulated by a governmental entity, but not including records that initiate employee
discipline; and
(u)
(i)
records that disclose a standard, regulation, policy, guideline, or rule regarding
the operation of a correctional facility or the care and control of inmates
committed to the custody of a correctional facility; and
(ii)
records that disclose the results of an audit or other inspection assessing a
correctional facility's compliance with a standard, regulation, policy, guideline, or
rule described in Subsection
(3)(u)(i)
.
(4)
The list of public records in this section is not exhaustive and should not be used to limit
access to records.
Section 26. Section
63G-2-302
is amended to read:
63G-2-302
. Private records.
(1)
The following records are private:
(a)
records concerning an individual's eligibility for unemployment insurance benefits,
social services, welfare benefits, or the determination of benefit levels;
(b)
records containing data on individuals describing medical history, diagnosis,
condition, treatment, evaluation, or similar medical data;
(c)
records of publicly funded libraries that when examined alone or with other records
identify a patron;
(d)
records received by or generated by or for:
(i)
the Independent Legislative Ethics Commission, except for:
(A)
the commission's summary data report that is required under legislative rule;
and
(B)
any other document that is classified as public under legislative rule; or
(ii)
a Senate or House Ethics Committee in relation to the review of ethics
complaints, unless the record is classified as public under legislative rule;
(e)
records received by, or generated by or for, the Independent Executive Branch Ethics
Commission, except as otherwise expressly provided in Title 63A, Chapter 14,
Review of Executive Branch Ethics Complaints;
(f)
records received or generated for a Senate confirmation committee concerning
character, professional competence, or physical or mental health of an individual:
(i)
if, prior to the meeting, the chair of the committee determines release of the
records:
(A)
reasonably could be expected to interfere with the investigation undertaken by
the committee; or
(B)
would create a danger of depriving a person of a right to a fair proceeding or
impartial hearing; and
(ii)
after the meeting, if the meeting was closed to the public;
(g)
employment records concerning a current or former employee of, or applicant for
employment with, a governmental entity that would disclose that individual's home
address, home telephone number, social security number, insurance coverage, marital
status, or payroll deductions;
(h)
records or parts of records under Section
63G-2-303
63A-19-408
that a current or
former employee identifies as private according to the requirements of that section;
(i)
that part of a record indicating a person's social security number or federal employer
identification number if provided under Section
31A-23a-104
,
31A-25-202
,
31A-26-202
,
58-1-301
,
58-55-302
,
61-1-4
, or
61-2f-203
;
(j)
that part of a voter registration record identifying a voter's:
(i)
driver license or identification card number;
(ii)
social security number, or last four digits of the social security number;
(iii)
email address;
(iv)
date of birth; or
(v)
phone number;
(k)
a voter registration record that is classified as a private record by the lieutenant
governor or a county clerk under Subsection
20A-2-101.1(5)(a)
,
20A-2-104(4)(h
), or
20A-2-204(4)(b
);
(l)
a voter registration record that is withheld under Subsection
20A-2-104(7)
;
(m)
a withholding request form described in Subsections
20A-2-104(7)
and
(8)
and any
verification submitted in support of the form;
(n)
a record or information regarding whether a voter returned a ballot with postage
attached;
(o)
a record that:
(i)
contains information about an individual;
(ii)
is voluntarily provided by the individual; and
(iii)
goes into an electronic database that:
(A)
is designated by and administered under the authority of the
Chief
Information Officer
chief information officer
; and
(B)
acts as a repository of information about the individual that can be
electronically retrieved and used to facilitate the individual's online interaction
with a state agency;
(p)
information provided to the
Commissioner of Insurance
commissioner of insurance

under:
(i)
Subsection
31A-23a-115(3)(a)
;
(ii)
Subsection
31A-23a-302(4)
; or
(iii)
Subsection
31A-26-210(4)
;
(q)
information obtained through a criminal background check under Title 11, Chapter
40, Criminal Background Checks by Political Subdivisions Operating Water Systems;
(r)
information provided by an offender that is:
(i)
required by the registration requirements of Title 53, Chapter 29, Sex, Kidnap, and
Child Abuse Offender Registry; and
(ii)
not required to be made available to the public under Subsection
53-29-404(3)(a)
;
(s)
a statement and any supporting documentation filed with the attorney general in
accordance with Section
34-45-107
, if the federal law or action supporting the filing
involves homeland security;
(t)
electronic toll collection customer account information received or collected under
Section
72-6-118
and customer information described in Section
17B-2a-815

received or collected by a public transit district, including contact and payment
information and customer travel data;
(u)
an email address provided by a military or overseas voter under Section
20A-16-501
;
(v)
a completed military-overseas ballot that is electronically transmitted under Title
20A, Chapter 16, Uniform Military and Overseas Voters Act;
(w)
records received by or generated by or for the Political Subdivisions Ethics Review
Commission established in Section
63A-15-201
, except for:
(i)
the commission's summary data report that is required in Section
63A-15-202
; and
(ii)
any other document that is classified as public in accordance with Title 63A,
Chapter 15, Political Subdivisions Ethics Review Commission;
(x)
a record described in Section
53G-9-604
that verifies that a parent was notified of an
incident or threat;
(y)
a criminal background check or credit history report conducted in accordance with
Section
63A-3-201
;
(z)
a record described in Subsection
53-5a-104(7)
;
(aa)
on a record maintained by a county for the purpose of administering property taxes,
an individual's:
(i)
email address;
(ii)
phone number; or
(iii)
personal financial information related to a person's payment method;
(bb)
a record submitted by a taxpayer to establish the taxpayer's eligibility for an
exemption, deferral, abatement, or relief under:
(i)
Title 59, Chapter 2, Part 11, Exemptions; or
(ii)
Title 59, Chapter 2a, Tax Relief Through Property Tax;
(cc)
a record provided by the State Tax Commission in response to a request under
Subsection
59-1-403(4)(y)(iii)
;
(dd)
a record of the Child Welfare Legislative Oversight Panel regarding an individual
child welfare case, as described in Subsection
36-33-103(3)
;
(ee)
a record relating to drug or alcohol testing of a state employee under Section
63A-17-1004
;
(ff)
a record relating to a request by a state elected official or state employee who has
been threatened to the Division of Technology Services to remove personal
identifying information from the open web under Section
63A-16-109
;
(gg)
a record including confidential information as that term is defined in Section
67-27-106
; and
(hh)
a record or notice received or generated under Title 53, Chapter 30, Security
Improvements Act, relating to:
(i)
an application for certification described in Section
53-30-201
; or
(ii)
a security improvement, including a building permit application or building
permit for a security improvement described in Section
53-30-301
.
(2)
The following records are private if properly classified by a governmental entity:
(a)
records concerning a current or former employee of, or applicant for employment
with a governmental entity, including performance evaluations and personal status
information such as race, religion, or disabilities, but not including records that are
public under Subsection
63G-2-301(2)(b)
or
63G-2-301(3)(o
) or private under
Subsection
(1)(b)
;
(b)
records describing an individual's finances, except that the following are public:
(i)
records described in Subsection
63G-2-301(2)
;
(ii)
information provided to the governmental entity for the purpose of complying
with a financial assurance requirement; or
(iii)
records that must be disclosed in accordance with another statute;
(c)
records of independent state agencies if the disclosure of those records would
conflict with the fiduciary obligations of the agency;
(d)
other records containing data on individuals the disclosure of which constitutes a
clearly unwarranted invasion of personal privacy;
(e)
records provided by the United States or by a government entity outside the state that
are given with the requirement that the records be managed as private records, if the
providing entity states in writing that the record would not be subject to public
disclosure if retained by it;
(f)
any portion of a record in the custody of the Division of Aging and Adult Services,
created in Section
26B-6-102
, that may disclose, or lead to the discovery of, the
identity of a person who made a report of alleged abuse, neglect, or exploitation of a
vulnerable adult; and
(g)
audio and video recordings created by a body-worn camera, as defined in Section
77-7a-103
, that record sound or images inside a home or residence except for
recordings that:
(i)
depict the commission of an alleged crime;
(ii)
record any encounter between a law enforcement officer and a person that results
in death or bodily injury, or includes an instance when an officer fires a weapon;
(iii)
record any encounter that is the subject of a complaint or a legal proceeding
against a law enforcement officer or law enforcement agency;
(iv)
contain an officer-involved critical incident as defined in Subsection
76-2-408(1)(f)
; or
(v)
have been requested for reclassification as a public record by a subject or
authorized agent of a subject featured in the recording.
(3)
(a)
As used in this Subsection
(3)
, "medical records" means medical reports, records,
statements, history, diagnosis, condition, treatment, and evaluation.
(b)
Medical records in the possession of the University of Utah Hospital, its clinics,
doctors, or affiliated entities are not private records or controlled records under
Section
63G-2-304
when the records are sought:
(i)
in connection with any legal or administrative proceeding in which the patient's
physical, mental, or emotional condition is an element of any claim or defense; or
(ii)
after a patient's death, in any legal or administrative proceeding in which any
party relies upon the condition as an element of the claim or defense.
(c)
Medical records are subject to production in a legal or administrative proceeding
according to state or federal statutes or rules of procedure and evidence as if the
medical records were in the possession of a nongovernmental medical care provider.
Section 27. Section
63G-2-601
is amended to read:
63G-2-601
. Rights of individuals on whom data is maintained -- Classification
statement filed with state archivist -- Notice to provider of information.
(1)
(a)
Each governmental entity shall file with the state archivist a statement explaining,
for each record series collected, maintained, or used by the governmental entity, the
purposes for which each private or controlled record in the record series is collected,
maintained, or used by that governmental entity.
(b)
The statement filed under Subsection
(1)(a)
:
(i)
shall identify the authority under which the governmental entity collects the
records or information included in the statement described in Subsection
(1)(a)
;
and
(ii)
is a public record.
(2)
A governmental entity may only use the information contained in a controlled or private
record for:
(a)
the purposes described in the statement provided under Subsection
(1)
; or
(b)
the purposes for which another governmental entity may use the record under
Section
63G-2-206
.
(2)
(a)
A governmental entity shall provide the notice described in this Subsection
(2)

to a person that is asked to furnish information that could be classified as a private or
controlled record.
(b)
The notice required under Subsection
(2)(a)
shall:
(i)
identify the record series that includes the information described in Subsection
(2)(a)
;
(ii)
state the reasons the person is asked to furnish the information;
(iii)
state the intended uses of the information;
(iv)
state the consequences for refusing to provide the information; and
(v)
disclose the classes of persons and the governmental entities that currently:
(A)
share the information with the governmental entity; or
(B)
receive the information from the governmental entity on a regular or
contractual basis.
(c)
The governmental entity shall:
(i)
post the notice required under this Subsection
(2)
in a prominent place at all
locations where the governmental entity collects the information; or
(ii)
include the notice required under this Subsection
(2)
as part of the documents or
forms that are used by the governmental entity to collect the information.
(3)
Upon request, each governmental entity shall, in relation to the information described
in Subsection
(2)(a)
, as applicable, explain to a person:
(a)
the reasons the person is asked to furnish information;
(b)
the intended uses of the information;
(c)
the consequences for refusing to provide the information; and
(d)
the reasons and circumstances under which the information may be shared with, or
provided to, other persons or governmental entities.
(4)
A governmental entity may use the information that the governmental entity is required
to disclose under Subsection
(2)(a)
only for those purposes:
(a)
given in the statement filed with the state archivist under Subsection
(1)
; or
(b)
for which another governmental entity may use the record under Section
63G-2-206
.
Section 28. Section
63G-2-803
is amended to read:
63G-2-803
. No individual liability for certain decisions of a governmental entity.
(1)
Neither the governmental entity, nor any officer or employee of the governmental
entity, is liable for damages resulting from the release of a record where the person or
government requesting the record presented evidence of authority to obtain the record
even if it is subsequently determined that the requester had no authority.
(2)
Neither the governmental entity, nor any officer or employee of the governmental
entity, is liable for damages arising from the negligent disclosure of records classified as
private under Subsection
63G-2-302(1)(g)
unless:
(a)
the disclosure was of employment records maintained by the governmental entity; or
(b)
the current or former government employee had previously filed the notice required
by Section
63G-2-303
63A-19-408
and:
(i)
the government entity did not take reasonable steps to preclude access or
distribution of the record; or
(ii)
the release of the record was otherwise willfully or grossly negligent.
(3)
A mailing from a government agency to an individual who has filed an application
under Section
63G-2-303
63A-19-408
is not a wrongful disclosure under this chapter or
under
Title 63A, Chapter 12, Division of Archives and Records Service and
Management of Government Records
.
Section 29. Section
67-1a-15
is amended to read:
67-1a-15
. Local government and limited purpose entity registry.
(1)
As used in this section:
(a)
"Entity" means a limited purpose entity or a local government entity.
(b)
(i)
"Limited purpose entity" means a legal entity that:
(A)
performs a single governmental function or limited governmental functions;
and
(B)
is not a state executive branch agency, a state legislative office, or within the
judicial branch.
(ii)
"Limited purpose entity" includes:
(A)
area agencies, area agencies on aging, and area agencies on high risk adults, as
those terms are defined in Section
26B-6-101
;
(B)
charter schools created under
Title 53G, Chapter 5, Charter Schools
;
(C)
community reinvestment agencies, as that term is defined in Section
17C-1-102
;
(D)
conservation districts, as that term is defined in Section
17D-3-102
;
(E)
governmental nonprofit corporations, as that term is defined in Section
11-13a-102
;
(F)
housing authorities, as that term is defined in Section
35A-8-401
;
(G)
independent entities and independent state agencies, as those terms are
defined in Section
63E-1-102
;
(H)
interlocal entities, as that term is defined in Section
11-13-103
;
(I)
local building authorities, as that term is defined in Section
17D-2-102
;
(J)
special districts, as that term is defined in Section
17B-1-102
;
(K)
local health departments, as that term is defined in Section
26A-1-102
;
(L)
local mental health authorities, as that term is defined in Section
62A-15-102
;
(M)
nonprofit corporations that receive an amount of money requiring an
accounting report under Section
51-2a-201.5
;
(N)
school districts under
Title 53G, Chapter 3, School District Creation and
Change
;
(O)
special service districts, as that term is defined in Section
17D-1-102
; and
(P)
substance abuse authorities, as that term is defined in Section
62A-15-102
.
(c)
"Local government and limited purpose entity registry" or "registry" means the
registry of local government entities and limited purpose entities created under this
section.
(d)
"Local government entity" means:
(i)
a county, as that term is defined in Section
17-60-101
; and
(ii)
a municipality, as that term is defined in Section
10-1-104
.
(e)
"Notice of failure to register" means the notice the lieutenant governor sends, in
accordance with Subsection
(7)(a)
, to an entity that does not register.
(f)
"Notice of failure to renew" means the notice the lieutenant governor sends to a
registered entity, in accordance with Subsection
(7)(b)
.
(g)
"Notice of noncompliance" means the notice the lieutenant governor sends to a
registered entity, in accordance with Subsection
(6)(c)
.
(h)
"Notice of non-registration" means the notice the lieutenant governor sends to an
entity and the state auditor, in accordance with Subsection
(9)
.
(i)
"Notice of registration or renewal" means the notice the lieutenant governor sends, in
accordance with Subsection
(6)(b)(i)
.
(j)
"Registered entity" means an entity with a valid registration as described in
Subsection
(8)
.
(2)
The lieutenant governor shall:
(a)
create a registry of each local government entity and limited purpose entity within
the state that:
(i)
contains the information described in Subsection
(4)
; and
(ii)
is accessible on the lieutenant governor's website or otherwise publicly available;
and
(b)
establish fees for registration and renewal, in accordance with Section
63J-1-504
,
based on and to directly offset the cost of creating, administering, and maintaining
the registry.
(3)
Each local government entity and limited purpose entity shall:
(a)
on or before July 1, 2019, register with the lieutenant governor as described in
Subsection
(4)
;
(b)
on or before one year after the day on which the lieutenant governor issues the notice
of registration or renewal, annually renew the entity's registration in accordance with
Subsection
(5)
; and
(c)
on or before 30 days after the day on which any of the information described in
Subsection
(4)
changes, send notice of the changes to the lieutenant governor.
(4)
Each entity shall include the following information in the entity's registration
submission:
(a)
the resolution or other legal or formal document creating the entity or, if the
resolution or other legal or formal document creating the entity cannot be located,
conclusive proof of the entity's lawful creation;
(b)
if the entity has geographic boundaries, a map or plat identifying the current
geographic boundaries of the entity, or if it is impossible or unreasonably expensive
to create a map or plat, a metes and bounds description, or another legal description
that identifies the current boundaries of the entity;
(c)
the entity's name;
(d)
the entity's type of local government entity or limited purpose entity;
(e)
the entity's governmental function;
(f)
the entity's website, physical address, and phone number, including the name and
contact information of an individual whom the entity designates as the primary
contact for the entity;
(g)
(i)
names, email addresses, and phone numbers of the members of the entity's
governing board or commission, managing officers, or other similar managers and
the method by which the members or officers are appointed, elected, or otherwise
designated;
(ii)
the date of the most recent appointment or election of each entity governing board
or commission member; and
(iii)
the date of the anticipated end of each entity governing board or commission
member's term;
(h)
the entity's sources of revenue; and
(i)
if the entity has created an assessment area, as that term is defined in Section
11-42-102
, information regarding the creation, purpose, and boundaries of the
assessment area.
(5)
Each entity shall include the following information in the entity's renewal submission:
(a)
identify and update any incorrect or outdated information the entity previously
submitted during registration under Subsection
(4)
; or
(b)
certify that the information the entity previously submitted during registration under
Subsection
(4)
is correct without change.
(6)
Within 30 days of receiving an entity's registration or renewal submission, the lieutenant
governor shall:
(a)
review the submission to determine compliance with Subsection
(4)
or
(5)
;
(b)
if the lieutenant governor determines that the entity's submission complies with
Subsection
(4)
or
(5)
:
(i)
send a notice of registration or renewal that includes the information that the entity
submitted under Subsection
(4)
or
(5)
to:
(A)
the registering or renewing entity;
(B)
each county in which the entity operates, either in whole or in part, or where
the entity's geographic boundaries overlap or are contained within the
boundaries of the county;
(C)
the Division of Archives and Records Service; and
(D)
the Office of the Utah State Auditor; and
(ii)
publish the information from the submission on the registry, except any email
address or phone number that is personal information as defined in Section
63G-2-303
63A-19-408
; and
(c)
if the lieutenant governor determines that the entity's submission does not comply
with Subsection
(4)
or
(5)
or is otherwise inaccurate or deficient, send a notice of
noncompliance to the registering or renewing entity that:
(i)
identifies each deficiency in the entity's submission with the corresponding
statutory requirement;
(ii)
establishes a deadline to cure the entity's noncompliance that is the first business
day that is at least 30 calendar days after the day on which the lieutenant governor
sends the notice of noncompliance; and
(iii)
states that failure to comply by the deadline the lieutenant governor establishes
under Subsection
(6)(c)(ii)
will result in the lieutenant governor sending a notice
of non-registration to the Office of the Utah State Auditor, in accordance with
Subsection
(9)
.
(7)
(a)
If the lieutenant governor identifies an entity that does not make a registration
submission in accordance with Subsection
(4)
by the deadline described in
Subsection
(3)
, the lieutenant governor shall send a notice of failure to register to the
registered entity that:
(i)
identifies the statutorily required registration deadline described in Subsection
(3)

that the entity did not meet;
(ii)
establishes a deadline to cure the entity's failure to register that is the first
business day that is at least 10 calendar days after the day on which the lieutenant
governor sends the notice of failure to register; and
(iii)
states that failure to comply by the deadline the lieutenant governor establishes
under Subsection
(7)(a)(ii)
will result in the lieutenant governor sending a notice
of non-registration to the Office of the Utah State Auditor, in accordance with
Subsection
(9)
.
(b)
If a registered entity does not make a renewal submission in accordance with
Subsection
(5)
by the deadline described in Subsection
(3)
, the lieutenant governor
shall send a notice of failure to renew to the registered entity that:
(i)
identifies the renewal deadline described in Subsection
(3)
that the entity did not
meet;
(ii)
establishes a deadline to cure the entity's failure to renew that is the first business
day that is at least 30 calendar days after the day on which the lieutenant governor
sends the notice of failure to renew; and
(iii)
states that failure to comply by the deadline the lieutenant governor establishes
under Subsection
(7)(b)(ii)
will result in the lieutenant governor sending a notice
of non-registration to the Office of the Utah State Auditor, in accordance with
Subsection
(9)
.
(8)
An entity's registration is valid:
(a)
if the entity makes a registration or renewal submission in accordance with the
deadlines described in Subsection
(3)
;
(b)
during the period the lieutenant governor establishes in the notice of noncompliance
or notice of failure to renew during which the entity may cure the identified
registration deficiencies; and
(c)
for one year beginning on the day the lieutenant governor issues the notice of
registration or renewal.
(9)
(a)
The lieutenant governor shall send a notice of non-registration to the Office of the
Utah State Auditor if an entity fails to:
(i)
cure the entity's noncompliance by the deadline the lieutenant governor establishes
in the notice of noncompliance;
(ii)
register by the deadline the lieutenant governor establishes in the notice of failure
to register; or
(iii)
cure the entity's failure to renew by the deadline the lieutenant governor
establishes in the notice of failure to renew.
(b)
The lieutenant governor shall ensure that the notice of non-registration:
(i)
includes a copy of the notice of noncompliance, the notice of failure to register, or
the notice of failure to renew; and
(ii)
requests that the state auditor withhold state allocated funds or the disbursement
of property taxes and prohibit the entity from accessing money held by the state or
money held in an account of a financial institution, in accordance with
Subsections
67-3-1(7)(i)
and
67-3-1(10)
.
(10)
The lieutenant governor may extend a deadline under this section if an entity notifies
the lieutenant governor, before the deadline to be extended, of the existence of an
extenuating circumstance that is outside the control of the entity.
(11)
(a)
An entity is not required to renew submission of a registration under this section
if an entity provides a record of dissolution.
(b)
The lieutenant governor shall include in the registry an entity's record of dissolution
and indicate on the registry that the entity is dissolved.
Section 30. Section
67-3-1
is amended to read:
67-3-1
. Functions and duties.
(1)
(a)
The state auditor is the auditor of public accounts and is independent of any
executive or administrative officers of the state.
(b)
The state auditor is not limited in the selection of personnel or in the determination
of the reasonable and necessary expenses of the state auditor's office.
(2)
The state auditor shall examine and certify annually in respect to each fiscal year,
financial statements showing:
(a)
the condition of the state's finances;
(b)
the revenues received or accrued;
(c)
expenditures paid or accrued;
(d)
the amount of unexpended or unencumbered balances of the appropriations to the
agencies, departments, divisions, commissions, and institutions; and
(e)
the cash balances of the funds in the custody of the state treasurer.
(3)
(a)
The state auditor shall:
(i)
audit each permanent fund, each special fund, the General Fund, and the accounts
of any department of state government or any independent agency or public
corporation as the law requires, as the auditor determines is necessary, or upon
request of the governor or the Legislature;
(ii)
perform the audits in accordance with generally accepted auditing standards and
other auditing procedures as promulgated by recognized authoritative bodies; and
(iii)
as the auditor determines is necessary, conduct the audits to determine:
(A)
honesty and integrity in fiscal affairs;
(B)
accuracy and reliability of financial statements;
(C)
effectiveness and adequacy of financial controls; and
(D)
compliance with the law.
(b)
If any state entity receives federal funding, the state auditor shall ensure that the
audit is performed in accordance with federal audit requirements.
(c)
(i)
The costs of the federal compliance portion of the audit may be paid from an
appropriation to the state auditor from the General Fund.
(ii)
If an appropriation is not provided, or if the federal government does not
specifically provide for payment of audit costs, the costs of the federal compliance
portions of the audit shall be allocated on the basis of the percentage that each
state entity's federal funding bears to the total federal funds received by the state.
(iii)
The allocation shall be adjusted to reflect any reduced audit time required to
audit funds passed through the state to local governments and to reflect any
reduction in audit time obtained through the use of internal auditors working
under the direction of the state auditor.
(4)
(a)
Except as provided in Subsection
(4)(b)
, the state auditor shall, in addition to
financial audits, and as the auditor determines is necessary, conduct performance and
special purpose audits, examinations, and reviews of any entity that receives public
funds, including a determination of any or all of the following:
(i)
the honesty and integrity of all the entity's fiscal affairs;
(ii)
whether the entity's administrators have faithfully complied with legislative intent;
(iii)
whether the entity's operations have been conducted in an efficient, effective, and
cost-efficient manner;
(iv)
whether the entity's programs have been effective in accomplishing the intended
objectives; and
(v)
whether the entity's management, control, and information systems are adequate,
effective, and secure.
(b)
The auditor may not conduct performance and special purpose audits, examinations,
and reviews of any entity that receives public funds if the entity:
(i)
has an elected auditor; and
(ii)
has, within the entity's last budget year, had the entity's financial statements or
performance formally reviewed by another outside auditor.
(5)
The state auditor:
(a)
shall administer any oath or affirmation necessary to the performance of the duties of
the auditor's office; and
(b)
may:
(i)
subpoena witnesses and documents, whether electronic or otherwise; and
(ii)
examine into any matter that the auditor considers necessary.
(6)
The state auditor may require all persons who have had the disposition or management
of any property of this state or its political subdivisions to submit statements regarding
the property at the time and in the form that the auditor requires.
(7)
The state auditor shall:
(a)
except where otherwise provided by law, institute suits in Salt Lake County in
relation to the assessment, collection, and payment of revenues against:
(i)
persons who by any means have become entrusted with public money or property
and have failed to pay over or deliver the money or property; and
(ii)
all debtors of the state;
(b)
collect and pay into the state treasury all fees received by the state auditor;
(c)
perform the duties of a member of all boards of which the state auditor is a member
by the constitution or laws of the state, and any other duties that are prescribed by the
constitution and by law;
(d)
stop the payment of the salary of any state official or state employee who:
(i)
refuses to settle accounts or provide required statements about the custody and
disposition of public funds or other state property;
(ii)
refuses, neglects, or ignores the instruction of the state auditor or any controlling
board or department head with respect to the manner of keeping prescribed
accounts or funds; or
(iii)
fails to correct any delinquencies, improper procedures, and errors brought to the
official's or employee's attention;
(e)
establish accounting systems, methods, and forms for public accounts in all taxing or
fee-assessing units of the state in the interest of uniformity, efficiency, and economy;
(f)
superintend the contractual auditing of all state accounts;
(g)
subject to Subsection
(8)(a)
, withhold state allocated funds or the disbursement of
property taxes from a state or local taxing or fee-assessing unit, if necessary, to
ensure that officials and employees in those taxing units comply with state laws and
procedures in the budgeting, expenditures, and financial reporting of public funds;
(h)
subject to Subsection
(9)
, withhold the disbursement of tax money from any county,
if necessary, to ensure that officials and employees in the county comply with
Section
59-2-303.1
; and
(i)
withhold state allocated funds or the disbursement of property taxes from a local
government entity or a limited purpose entity, as those terms are defined in Section
67-1a-15
if the state auditor finds the withholding necessary to ensure that the entity
registers and maintains the entity's registration with the lieutenant governor, in
accordance with Section
67-1a-15
.
(8)
(a)
Except as otherwise provided by law, the state auditor may not withhold funds
under Subsection
(7)(g)
until a state or local taxing or fee-assessing unit has received
formal written notice of noncompliance from the auditor and has been given 60 days
to make the specified corrections.
(b)
If, after receiving notice under Subsection
(8)(a)
, a state or independent local
fee-assessing unit that exclusively assesses fees has not made corrections to comply
with state laws and procedures in the budgeting, expenditures, and financial reporting
of public funds, the state auditor:
(i)
shall provide a recommended timeline for corrective actions;
(ii)
may prohibit the state or local fee-assessing unit from accessing money held by
the state; and
(iii)
may prohibit a state or local fee-assessing unit from accessing money held in an
account of a financial institution by filing an action in a court with jurisdiction
under Title
78A, Judiciary and Judicial Administration
, requesting an order of the
court to prohibit a financial institution from providing the fee-assessing unit
access to an account.
(c)
The state auditor shall remove a limitation on accessing funds under Subsection
(8)(b)

upon compliance with state laws and procedures in the budgeting, expenditures, and
financial reporting of public funds.
(d)
If a local taxing or fee-assessing unit has not adopted a budget in compliance with
state law, the state auditor:
(i)
shall provide notice to the taxing or fee-assessing unit of the unit's failure to
comply;
(ii)
may prohibit the taxing or fee-assessing unit from accessing money held by the
state; and
(iii)
may prohibit a taxing or fee-assessing unit from accessing money held in an
account of a financial institution by:
(A)
contacting the taxing or fee-assessing unit's financial institution and
requesting that the institution prohibit access to the account; or
(B)
filing an action in a court with jurisdiction under Title
78A, Judiciary and
Judicial Administration
, requesting an order of the court to prohibit a financial
institution from providing the taxing or fee-assessing unit access to an account.
(e)
If the local taxing or fee-assessing unit adopts a budget in compliance with state law,
the state auditor shall eliminate a limitation on accessing funds described in
Subsection
(8)(d)
.
(9)
The state auditor may not withhold funds under Subsection
(7)(h)
until a county has
received formal written notice of noncompliance from the auditor and has been given 60
days to make the specified corrections.
(10)
(a)
The state auditor may not withhold funds under Subsection
(7)(i)
until the state
auditor receives a notice of non-registration, as that term is defined in Section
67-1a-15
.
(b)
If the state auditor receives a notice of non-registration, the state auditor may
prohibit the local government entity or limited purpose entity, as those terms are
defined in Section
67-1a-15
, from accessing:
(i)
money held by the state; and
(ii)
money held in an account of a financial institution by:
(A)
contacting the entity's financial institution and requesting that the institution
prohibit access to the account; or
(B)
filing an action in a court with jurisdiction under Title
78A, Judiciary and
Judicial Administration
, requesting an order of the court to prohibit a financial
institution from providing the entity access to an account.
(c)
The state auditor shall remove the prohibition on accessing funds described in
Subsection
(10)(b)
if the state auditor received a notice of registration, as that term is
defined in Section
67-1a-15
, from the lieutenant governor.
(11)
Notwithstanding Subsection
(7)(g)
,
(7)(h)
,
(7)(i
),
(8)(b)
,
(8)(d)
, or
(10)(b
), the state
auditor:
(a)
shall authorize a disbursement by a local government entity or limited purpose entity,
as those terms are defined in Section
67-1a-15
, or a state or local taxing or
fee-assessing unit if the disbursement is necessary to:
(i)
avoid a major disruption in the operations of the local government entity, limited
purpose entity, or state or local taxing or fee-assessing unit; or
(ii)
meet debt service obligations; and
(b)
may authorize a disbursement by a local government entity, limited purpose entity,
or state or local taxing or fee-assessing unit as the state auditor determines is
appropriate.
(12)
(a)
The state auditor may seek relief under the Utah Rules of Civil Procedure to take
temporary custody of public funds if an action is necessary to protect public funds
from being improperly diverted from their intended public purpose.
(b)
If the state auditor seeks relief under Subsection
(12)(a)
:
(i)
the state auditor is not required to exhaust the procedures in Subsection
(7)
or
(8)
;
and
(ii)
the state treasurer may hold the public funds in accordance with Section
67-4-1
if
a court orders the public funds to be protected from improper diversion from their
public purpose.
(13)
The state auditor shall:
(a)
establish audit guidelines and procedures for audits of local mental health and
substance abuse authorities and their contract providers, conducted pursuant to Title
17, Chapter 77
, Local Health and Human Services, Title
26B, Chapter 5
, Health Care
- Substance Use and Mental Health, and Title
51, Chapter 2a
, Accounting Reports
from Political Subdivisions, Interlocal Organizations, and Other Local Entities Act;
and
(b)
ensure that those guidelines and procedures provide assurances to the state that:
(i)
state and federal funds appropriated to local mental health authorities are used for
mental health purposes;
(ii)
a private provider under an annual or otherwise ongoing contract to provide
comprehensive mental health programs or services for a local mental health
authority is in compliance with state and local contract requirements and state and
federal law;
(iii)
state and federal funds appropriated to local substance abuse authorities are used
for substance abuse programs and services; and
(iv)
a private provider under an annual or otherwise ongoing contract to provide
comprehensive substance abuse programs or services for a local substance abuse
authority is in compliance with state and local contract requirements, and state and
federal law.
(14)
(a)
The state auditor may, in accordance with the auditor's responsibilities for
political subdivisions of the state as provided in Title
51, Chapter 2a
, Accounting
Reports from Political Subdivisions, Interlocal Organizations, and Other Local
Entities Act, initiate audits or investigations of any political subdivision that are
necessary to determine honesty and integrity in fiscal affairs, accuracy and reliability
of financial statements, effectiveness, and adequacy of financial controls and
compliance with the law.
(b)
If the state auditor receives notice under Subsection
11-41-104(7)
from the
Governor's Office of Economic Opportunity on or after July 1, 2024, the state auditor
may initiate an audit or investigation of the public entity subject to the notice to
determine compliance with Section
11-41-103
.
(15)
(a)
The state auditor may not audit work that the state auditor performed before
becoming state auditor.
(b)
If the state auditor has previously been a responsible official in state government
whose work has not yet been audited, the Legislature shall:
(i)
designate how that work shall be audited; and
(ii)
provide additional funding for those audits, if necessary.
(16)
The state auditor shall:
(a)
with the assistance, advice, and recommendations of an advisory committee
appointed by the state auditor from among special district boards of trustees, officers,
and employees and special service district boards, officers, and employees:
(i)
prepare a Uniform Accounting Manual for Special Districts that:
(A)
prescribes a uniform system of accounting and uniform budgeting and
reporting procedures for special districts under Title
17B, Limited Purpose
Local Government Entities - Special Districts
, and special service districts
under Title
17D, Chapter 1
, Special Service District Act;
(B)
conforms with generally accepted accounting principles; and
(C)
prescribes reasonable exceptions and modifications for smaller districts to the
uniform system of accounting, budgeting, and reporting;
(ii)
maintain the manual under this Subsection
(16)(a)
so that the manual continues to
reflect generally accepted accounting principles;
(iii)
conduct a continuing review and modification of procedures in order to improve
them;
(iv)
prepare and supply each district with suitable budget and reporting forms; and
(v)
(A)
prepare instructional materials, conduct training programs, and render other
services considered necessary to assist special districts and special service
districts in implementing the uniform accounting, budgeting, and reporting
procedures; and
(B)
ensure that any training described in Subsection
(16)(a)(v)(A)
complies with
Title
63G, Chapter 22
, State Training and Certification Requirements; and
(b)
continually analyze and evaluate the accounting, budgeting, and reporting practices
and experiences of specific special districts and special service districts selected by
the state auditor and make the information available to all districts.
(17)
(a)
The following records in the custody or control of the state auditor are protected
records under Title
63G, Chapter 2
, Government Records Access and Management
Act:
(i)
records that would disclose information relating to allegations of personal
misconduct, gross mismanagement, or illegal activity of a past or present
governmental employee if the information or allegation cannot be corroborated by
the state auditor through other documents or evidence, and the records relating to
the allegation are not relied upon by the state auditor in preparing a final audit
report;
(ii)
records and audit workpapers to the extent the workpapers would disclose the
identity of an individual who during the course of an audit, communicated the
existence of any waste of public funds, property, or manpower, or a violation or
suspected violation of a law, rule, or regulation adopted under the laws of this
state, a political subdivision of the state, or any recognized entity of the United
States, if the information was disclosed on the condition that the identity of the
individual be protected;
(iii)
before an audit is completed and the final audit report is released, records or
drafts circulated to an individual who is not an employee or head of a
governmental entity for the individual's response or information;
(iv)
records that would disclose an outline or part of any audit survey plans or audit
program; and
(v)
requests for audits, if disclosure would risk circumvention of an audit.
(b)
The provisions of Subsections
(17)(a)(i)
,
(ii)
, and
(iii)
do not prohibit the disclosure
of records or information that relate to a violation of the law by a governmental entity
or employee to a government prosecutor or peace officer.
(c)
The provisions of this Subsection
(17)
do not limit the authority otherwise given to
the state auditor to classify a document as public, private, controlled, or protected
under Title
63G, Chapter 2
, Government Records Access and Management Act.
(d)
(i)
As used in this Subsection
(17)(d)
, "record dispute" means a dispute between
the state auditor and the subject of an audit performed by the state auditor as to
whether the state auditor may release a record, as defined in Section
63G-2-103
,
to the public that the state auditor gained access to in the course of the state
auditor's audit but which the subject of the audit claims is not subject to disclosure
under Title
63G, Chapter 2
, Government Records Access and Management Act.
(ii)
The state auditor may submit a record dispute to the director of the Government
Records Office, created in Section
63A-12-202
, for a determination of whether the
state auditor may, in conjunction with the state auditor's release of an audit report,
release to the public the record that is the subject of the record dispute.
(iii)
The state auditor or the subject of the audit may seek judicial review of the
director's determination, described in Subsection
(17)(d)(ii)
, as provided in
Section
63G-2-404
.
(18)
If the state auditor conducts an audit of an entity that the state auditor has previously
audited and finds that the entity has not implemented a recommendation made by the
state auditor in a previous audit, the state auditor shall notify the Legislative
Management Committee through the Legislative Management Committee's Audit
Subcommittee that the entity has not implemented that recommendation.
(19)
The state auditor shall, with the advice and consent of the Senate, appoint the state
privacy auditor described in Section
67-3-13
.
(20)
(19)
Except as provided in Subsection
(21)
(20)
, the state auditor shall report, or
ensure that another government entity reports, on the financial, operational, and
performance metrics for the state system of higher education and the state system of
public education, including metrics in relation to students, programs, and schools within
those systems.
(21)
(20)
(a)
Notwithstanding Subsection
(20)
(19)
, the state auditor shall conduct
regular audits of:
(i)
the scholarship granting organization for the Carson Smith Opportunity
Scholarship Program, created in Section
53E-7-402
;
(ii)
the State Board of Education for the Carson Smith Scholarship Program, created
in Section
53F-4-302
; and
(iii)
the scholarship program manager for the Utah Fits All Scholarship Program,
created in Section
53F-6-402
, including an analysis of the cost effectiveness of the
program, taking into consideration the amount of the scholarship and the amount
of state and local funds dedicated on a per-student basis within the traditional
public education system.
(b)
Nothing in this subsection limits or impairs the authority of the State Board of
Education to administer the programs described in Subsection
(21)(a)
(20)(a)
.
(22)
(21)
The state auditor shall, based on the information posted by the Office of
Legislative Research and General Counsel under Subsection
36-12-12.1(2)
, for each
policy, track and post the following information on the state auditor's website:
(a)
the information posted under Subsections
36-12-12.1(2)(a)
through
(e)
;
(b)
an indication regarding whether the policy is timely adopted, adopted late, or not
adopted;
(c)
an indication regarding whether the policy complies with the requirements
established by law for the policy; and
(d)
a link to the policy.
(23)
(22)
(a)
A legislator may request that the state auditor conduct an inquiry to
determine whether a government entity, government official, or government
employee has complied with a legal obligation directly imposed, by statute, on the
government entity, government official, or government employee.
(b)
The state auditor may, upon receiving a request under Subsection
(23)(a)
(22)(a)
,
conduct the inquiry requested.
(c)
If the state auditor conducts the inquiry described in Subsection
(23)(b)
(22)(b)
, the
state auditor shall post the results of the inquiry on the state auditor's website.
(d)
The state auditor may limit the inquiry described in this Subsection
(23)
(22)
to a
simple determination, without conducting an audit, regarding whether the obligation
was fulfilled.
(24)
(23)
The state auditor shall:
(a)
ensure compliance with Title
63G, Chapter 31
, Distinctions on the Basis of Sex, in
accordance with Section
63G-31-401
; and
(b)
report to the Legislative Management Committee, upon request, regarding the state
auditor's actions under this Subsection
(24)
(23)
.
(25)
(24)
The state auditor shall report compliance with Sections
67-27-107
,
67-27-108
,
and
67-27-109
by:
(a)
establishing a process to receive and audit each alleged violation; and
(b)
reporting to the Legislative Management Committee, upon request, regarding the
state auditor's findings and recommendations under this Subsection
(25)
(24)
.
(26)
(25)
The state auditor shall ensure compliance with Section
63G-1-704
regarding the
display of flags in or on government property.
(27)
(26)
(a)
On or before January 31 each year, the state auditor shall prepare a report
that states, for each entity that holds public funds as defined in Section
51-7-3
, the
entity's total balance, as of the last day of the immediately preceding fiscal year, of
cash, cash equivalents, and investments, as those terms are defined under the
standards established by the Governmental Accounting Standards Board.
(b)
The state auditor shall make the report described in Subsection
(27)(a)

(26)(a)
publicly available on a website that the state auditor maintains.
(27)
The state auditor may audit the privacy practices of governmental entities.
Section 31. Section
67-3-13
is amended to read:
67-3-13
. State auditor data privacy responsibilities.
(1)
As used in this section:
(a)
"Governmental entity" means the same as that term is defined in Section
63G-2-103
.
(b)
"Personal data" means the same as that term is defined in Section
63A-19-101
.
(c)
"Privacy practice" means the same as that term is defined in Section
63A-19-101
.
(d)
"State agency" means the same as that term is defined in Section
63A-19-101
.
(e)
"State privacy auditor" means the individual appointed as state privacy auditor by
the state auditor under Section
67-3-1
.
(2)
The state
privacy
auditor shall:
(a)
compile information about the privacy practices of governmental entities;
(b)
make public and maintain information about the privacy practices of governmental
entities on the state auditor's website;
(c)
provide governmental entities with guidance and training regarding the data privacy
auditing standards developed by the state
privacy
auditor;
(d)
implement a process to analyze and respond to requests from individuals for the state
privacy
auditor to audit a governmental entity's privacy practice;
(e)
identify annually which governmental entities' privacy practices pose the greatest
risk to individual privacy and prioritize those privacy practices to be audited;
(f)
audit each year, in as timely a manner as possible, the privacy practices that the state
privacy
auditor identifies under Subsection
(2)(d)
or
(2)(e)
as posing the greatest risk
to individuals' privacy;
(g)
when auditing a governmental entity's privacy practice under Subsection
(2)(f)
,
analyze:
(i)
details about the technology or the policy and the technology's or the policy's
application;
(ii)
information about the type of personal data being used;
(iii)
information about how the personal data is obtained, stored, shared, secured, and
disposed;
(iv)
information about the governmental entity's sharing or selling of personal data;
(v)
information about whether an individual can or should be able to opt out of the
retention, selling, and sharing of the individual's personal data;
(vi)
information about how the governmental entity de-identifies or anonymizes
personal data;
(vii)
a determination about the existence of alternative technology or improved
practices to protect privacy; and
(viii)
a finding of whether the governmental entity's current privacy practices
adequately protect individual privacy; and
(h)
after completing an audit described in Subsections
(2)(f)
and
(g)
, determine:
(i)
each governmental entity's use of personal data, including the governmental
entity's privacy practices regarding personal data:
(A)
acquisition;
(B)
storage;
(C)
disposal;
(D)
protection; and
(E)
sharing;
(ii)
the adequacy of the governmental entity's practices in each of the areas described
in Subsection
(2)(h)(i)
; and
(iii)
for each of the areas described in Subsection
(2)(h)(i)
that the state
privacy
auditor determines to require reform, provide recommendations for reform to the
governmental entity and the legislative body charged with regulating the
governmental entity.
(3)
(a)
The legislative body charged with regulating a governmental entity that receives a
recommendation described in Subsection
(2)(h)(iii)
shall hold a public hearing on the
proposed reforms:
(i)
with a quorum of the legislative body present; and
(ii)
within 90 days after the day on which the legislative body receives the
recommendation.
(b)
(i)
The legislative body shall provide notice of the hearing described in Subsection
(3)(a)
.
(ii)
Notice of the public hearing and the recommendations to be discussed shall be
posted for the jurisdiction of the governmental entity, as a class A notice under
Section
63G-30-102
, for at least 30 days before the day on which the legislative
body will hold the public hearing.
(iii)
Each notice required under Subsection
(3)(b)(i)
shall:
(A)
identify the recommendations to be discussed; and
(B)
state the date, time, and location of the public hearing.
(c)
During the hearing described in Subsection
(3)(a)
, the legislative body shall:
(i)
provide the public the opportunity to ask questions and obtain further information
about the recommendations; and
(ii)
provide any interested person an opportunity to address the legislative body with
concerns about the recommendations.
(d)
At the conclusion of the hearing, the legislative body shall determine whether the
legislative body shall adopt reforms to address the recommendations and any
concerns raised during the public hearing.
(4)
Subsection
(3)
does not apply to:
(a)
a state agency;
(b)
the legislative branch;
(c)
the judicial branch;
(d)
an executive branch agency within the Office of the Attorney General, the state
auditor, the state treasurer, or the State Board of Education; or
(e)
an independent entity.
(5)
The state
privacy
auditor shall:
(a)
quarterly report, to the Utah Privacy Commission:
(i)
recommendations for privacy practices for the commission to review; and
(ii)
the information provided in Subsection
(2)(h)
; and
(b)
annually, on or before October 1, report to the Judiciary Interim Committee:
(i)
the results of any audits described in Subsection
(2)(f)
, if any audits have been
completed;
(ii)
reforms, to the extent that the state
privacy
auditor is aware of any reforms, that
the governmental entity made in response to any audits described in Subsection
(2)(f)
;
(iii)
the information described in Subsection
(2)(h)
; and
(iv)
recommendations for legislation based on any results of an audit described in
Subsection
(2)(f)
.
Section 32.
Effective Date.
This bill takes effect on
May 6, 2026
.
3-12-26 2:39 PM