Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 183 Sixth Substitute (2020GS)

Sponsor

Rep. Lisonbee, K.

Final action

Governor Signed 3/31/2020

Outcome

Became law — signed by Gov. Gary R. Herbert

Summary

What it does

• This bill:
• requires the Driver License Division to provide on each application for a driver license or an identification card information regarding the disclosure of personal identifying information;
• provides means for an individual to opt out of certain disclosures to the University of Utah for data collection in relation to genetic and epidemiologic research;
• provides means for an individual to remove certain personal identifying information from the database controlled by the University of Utah;
• requires reports to the Transportation Interim Committee;
• requires auditing of the security of the University of Utah database; and
• makes technical changes.

Every vote on this bill

Bill text

DRIVER LICENSE RECORD AMENDMENTS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Karianne Lisonbee
Senate Sponsor: 
Daniel McCay
LONG TITLE
General Description:
This bill requires the Driver License Division to provide notification to each applicant
for a driver license or an identification card regarding the disclosure of certain
information.
Highlighted Provisions:
This bill:
▸ requires the Driver License Division to provide on each application for a driver
license or an identification card information regarding the disclosure of personal
identifying information;
▸ provides means for an individual to opt out of certain disclosures to the University
of Utah for data collection in relation to genetic and epidemiologic research;
▸ provides means for an individual to remove certain personal identifying information
from the database controlled by the University of Utah;
▸ requires reports to the Transportation Interim Committee;
▸ requires auditing of the security of the University of Utah database; and
▸ makes technical changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
53-3-109
, as last amended by Laws of Utah 2019, Chapter 380
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
53-3-109
 is amended to read:
53-3-109.
Records -- Access -- Fees -- Rulemaking.
(1) (a) Except as provided in this section, all records of the division shall be classified
and disclosed in accordance with Title 63G, Chapter 2, Government Records Access and
Management Act.
(b) The division may disclose personal identifying information in accordance with 18
U.S.C. Chapter 123:
(i) to a licensed private investigator holding a valid agency license, with a legitimate
business need;
(ii) to an insurer, insurance support organization, or a self-insured entity, or its agents,
employees, or contractors that issues any motor vehicle insurance under Title 31A, Chapter 22,
Part 3, Motor Vehicle Insurance, for use in connection with claims investigation activities,
antifraud activities, rating, or underwriting for any person issued a license certificate under this
chapter;
(iii) to a depository institution as that term is defined in Section 
7-1-103
;
(iv) to the State Tax Commission for the purposes of tax fraud detection and
prevention and any other use required by law;
(v) 
subject to Subsection (7),
 to the University of Utah for data collection in relation to
genetic and epidemiologic research; or
(vi) 
(A)
 to a government entity, including any court or law enforcement agency, to
fulfill the government entity's functions[
,
]
;
 or
(B)
 to a private person acting on behalf of a government entity to fulfill the government
entity's functions, if the division determines disclosure of the information is in the interest of
public safety.
(2) (a) A person who receives personal identifying information shall be advised by the
division that the person may not:
(i) disclose the personal identifying information from that record to any other person;
or
(ii) use the personal identifying information from that record for advertising or
solicitation purposes.
(b) Any use of personal identifying information by an insurer or insurance support
organization, or by a self-insured entity or its agents, employees, or contractors not authorized
by Subsection (1)(b)(ii) is:
(i) an unfair marketing practice under Section 
31A-23a-402
; or
(ii) an unfair claim settlement practice under Subsection 
31A-26-303
(3).
(3) (a) Notwithstanding the provisions of Subsection (1)(b), the division or its designee
may disclose portions of a driving record, in accordance with this Subsection (3), to:
(i) an insurer as defined under Section 
31A-1-301
, or a designee of an insurer, for
purposes of assessing driving risk on the insurer's current motor vehicle insurance
policyholders;
(ii) an employer or a designee of an employer, for purposes of monitoring the driving
record and status of current employees who drive as a responsibility of the employee's
employment if the requester demonstrates that the requester has obtained the written consent of
the individual to whom the information pertains; and
(iii) an employer or the employer's agents to obtain or verify information relating to a
holder of a commercial driver license that is required under 49 U.S.C. Chapter 313.
(b) A disclosure under Subsection (3)(a)(i) shall:
(i) include the licensed driver's name, driver license number, date of birth, and an
indication of whether the driver has had a moving traffic violation that is a reportable violation,
as defined under Section 
53-3-102
 during the previous month;
(ii) be limited to the records of drivers who, at the time of the disclosure, are covered
under a motor vehicle insurance policy of the insurer; and
(iii) be made under a contract with the insurer or a designee of an insurer.
(c) A disclosure under Subsection (3)(a)(ii) or (iii) shall:
(i) include the licensed driver's name, driver license number, date of birth, and an
indication of whether the driver has had a moving traffic violation that is a reportable violation,
as defined under Section 
53-3-102
, during the previous month;
(ii) be limited to the records of a current employee of an employer;
(iii) be made under a contract with the employer or a designee of an employer; and
(iv) include an indication of whether the driver has had a change reflected in the
driver's:
(A) driving status;
(B) license class;
(C) medical self-certification status; or
(D) medical examiner's certificate under 49 C.F.R. Sec. 391.45.
(d) The contract under Subsection (3)(b)(iii) or (c)(iii) shall specify:
(i) the criteria for searching and compiling the driving records being requested;
(ii) the frequency of the disclosures;
(iii) the format of the disclosures, which may be in bulk electronic form; and
(iv) a reasonable charge for the driving record disclosures under this Subsection (3).
(4) The division may charge fees:
(a) in accordance with Section 
53-3-105
 for searching and compiling its files or
furnishing a report on the driving record of a person;
(b) for each document prepared under the seal of the division and deliver upon request,
a certified copy of any record of the division, and charge a fee set in accordance with Section
63J-1-504
 for each document authenticated; and
(c) established in accordance with the procedures and requirements of Section
63J-1-504
 for disclosing personal identifying information under Subsection (1)(b).
(5) Each certified copy of a driving record furnished in accordance with this section is
admissible in any court proceeding in the same manner as the original.
(6) (a) A driving record furnished under this section may only report on the driving
record of a person for a period of 10 years.
(b) Subsection (6)(a) does not apply to court or law enforcement reports, reports of
commercial driver license violations, or reports for commercial driver license holders.
(7) (a) The division shall include on each application for or renewal of a license or
identification card under this chapter:
(i) the following notice: "The Driver License Division may disclose the information
provided on this form to an entity described in Utah Code Ann. Subsection
53-3-109
(1)(b)(v).";
(ii) a reference to the website described in Subsection (7)(b); and
(iii) a link to the division website for:
(A) information provided by the division, after consultation with the University of
Utah, containing the explanation and description described in Subsection (7)(b); and
(B) an online form for the individual to opt out of the disclosure of personal identifying
information as described in Subsection (1)(b)(v).
(b) On or before July 1, 2020, and in consultation with the division, the University of
Utah shall create a website that provides an explanation and description of:
(i) what information may be disclosed by the division to the University of Utah under
Subsection (1)(b)(v);
(ii) the methods and timing of anonymizing the information;
(iii) for situations where the information is not anonymized:
(A) how the information is used;
(B) how the information is secured;
(C) how long the information is retained; and
(D) who has access to the information;
(iv) research and statistical purposes for which the information is used; and
(v) other relevant details regarding the information.
(c) The website created by the University of Utah described in Subsection (7)(b) shall
include the following:
(i) a link to the division website for an online form for the individual to opt out of the
disclosure of personal identifying information as described in Subsection (1)(b)(v); and
(ii) a link to an online form for the individual to affirmatively choose to remove,
subject to Subsection (7)(e)(ii), personal identifying information from the database controlled
by the University of Utah that was disclosed pursuant to Subsection (1)(b)(v).
(d) In the course of business, the division shall provide information regarding the
disclosure of personal identifying information, including providing on the division website:
(i) a link to the website created under Subsection (7)(b) to provide individuals with
information regarding the disclosure of personal identifying information under Subsection
(1)(b)(v); and
(ii) a link to the division website for:
(A) information provided by the division, after consultation with the University of
Utah, containing the explanation and description described in Subsection (7)(b); and
(B) an online form for the individual to opt out of the disclosure of personal identifying
information as described in Subsection (1)(b)(v).
(e) (i) The division may not disclose the personal identifying information under
Subsection (1)(b)(v) if an individual opts out of the disclosure as described in Subsection
(7)(a)(iii)(B) or (7)(c)(i).
(ii) (A) Except as provided in Subsection (7)(e)(ii)(B), if an individual makes a request
as described in Subsection (7)(c)(ii), the University of Utah shall, within 90 days of receiving
the request, remove and destroy the individual's personal identifying information received
under Subsection (1)(b)(v) from a database controlled by the University of Utah.
(B) The University of Utah is not required to remove an individual's personal
identifying information as described in Subsection (7)(e)(ii)(A) from data released to a research
study before the date of the request described in Subsection (7)(c)(ii).
(f) (i) Subject to prioritization of the Audit Subcommittee created in Section 
36-12-8
,
the Office of the Legislative Auditor General shall conduct an audit and issue a report on:
(A) procedures and safeguards utilized by the University of Utah related to the security
of personal identifying information disclosed pursuant to Subsection (1)(b)(v); and
(B) potential risks of disclosure or breaches in the security of personal identifying
information disclosed pursuant to Subsection (1)(b)(v).
(ii) The Office of the Legislative Auditor General shall provide the report described in
Subsection (7)(f)(i) to the Transportation Interim Committee before October 31, 2021.
(g) (i) The University of Utah shall report to the Transportation Interim Committee
before October 31, 2020, regarding the information described in Subsection (7)(b).
(ii) The University of Utah shall conduct a biennial internal information security audit
of the information systems that store the data received pursuant to Subsection (1)(b)(v), and,
beginning in the year 2023, provide a biennial report of the findings of the internal audit to the
Transportation Interim Committee.
[
(7)
] 
(8)
 In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking
Act, the division may make rules to designate:
(a) what information shall be included in a report on the driving record of a person;
(b) the form of a report or copy of the report which may include electronic format;
(c) the form of a certified copy, as required under Section 
53-3-216
, which may include
electronic format;
(d) the form of a signature required under this chapter which may include electronic
format;
(e) the form of written request to the division required under this chapter which may
include electronic format;
(f) the procedures, requirements, and formats for disclosing personal identifying
information under Subsection (1)(b); and
(g) the procedures, requirements, and formats necessary for the implementation of
Subsection (3).
[
(8)
] 
(9)
 (a) It is a class B misdemeanor for a person to knowingly or intentionally
access, use, disclose, or disseminate a record created or maintained by the division or any
information contained in a record created or maintained by the division for a purpose
prohibited or not permitted by statute, rule, regulation, or policy of a governmental entity.
(b) A person who discovers or becomes aware of any unauthorized use of records
created or maintained by the division shall inform the commissioner and the division director
of the unauthorized use.