Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 87 (2021GS)

Sponsor

Rep. Hall, C.

Final action

Governor Signed 3/11/2021

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• requires, with certain exceptions, law enforcement agencies to obtain a warrant for electronic data or information transmitted through an electronic communication service;
• provides that law enforcement agencies are not required to obtain a warrant or subpoena to obtain or use data from the National Center for Missing and Exploited Children;
• requires law enforcement agencies to notify an owner within 90 days of a search warrant for an electronic device or electronic information or data;
• requires law enforcement agencies to notify an owner of an electronic device or electronic information or data that is the subject of a search warrant within three days after an investigation is concluded;
• repeals language related to an extension for a delayed notification;
• allows law enforcement agencies to delay notification of a search warrant to an owner of an electronic device or electronic information or data, which is the subject of the search warrant, if the purpose of the delayed notification is to apprehend a fugitive of justice;
• allows a law enforcement agency to obtain, use, copy, or disclose, without a subpoena, certain information about subscribers and customers; and
• makes technical and conforming changes.

Every vote on this bill

Bill text

ELECTRONIC INFORMATION AND DATA PRIVACY
AMENDMENTS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Craig Hall
Senate Sponsor: 
Todd D. Weiler
LONG TITLE
General Description:
This bill amends provisions related to the privacy of electronic data and information.
Highlighted Provisions:
This bill:
▸ requires, with certain exceptions, law enforcement agencies to obtain a warrant for
electronic data or information transmitted through an electronic communication
service;
▸ provides that law enforcement agencies are not required to obtain a warrant or
subpoena to obtain or use data from the National Center for Missing and Exploited
Children;
▸ requires law enforcement agencies to notify an owner within 90 days of a search
warrant for an electronic device or electronic information or data;
▸ requires law enforcement agencies to notify an owner of an electronic device or
electronic information or data that is the subject of a search warrant within three
days after an investigation is concluded;
▸ repeals language related to an extension for a delayed notification;
▸ allows law enforcement agencies to delay notification of a search warrant to an
owner of an electronic device or electronic information or data, which is the subject
of the search warrant, if the purpose of the delayed notification is to apprehend a
fugitive of justice;
▸ allows a law enforcement agency to obtain, use, copy, or disclose, without a
subpoena, certain information about subscribers and customers; and
▸ makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
77-23c-102
, as last amended by Laws of Utah 2019, Chapters 362, 479 and last
amended by Coordination Clause, Laws of Utah 2019, Chapter 479
77-23c-103
, as last amended by Laws of Utah 2019, Chapter 362
77-23c-104
, as enacted by Laws of Utah 2019, Chapter 362
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
77-23c-102
 is amended to read:
77-23c-102.
Electronic information or data privacy -- Warrant required for
disclosure.
(1) (a) Except as provided in Subsection (2), for a criminal investigation or
prosecution, a law enforcement agency may not obtain, without a search warrant issued by a
court upon probable cause:
(i) the location information, stored data, or transmitted data of an electronic device; or
(ii) electronic information or data transmitted by the owner of the electronic
information or data
:
(A)
 to a 
provider of a
 remote computing service [
provider.
]
; or
(B) through a provider of an electronic communication service.
(b) Except as provided in Subsection (1)(c), a law enforcement agency may not use,
copy, or disclose, for any purpose, the location information, stored data, 
or
 transmitted data of
an electronic device, or electronic information or data provided by a 
provider of a
 remote
computing service [
provider
] 
or an electronic communication service
, that:
(i) is not the subject of the warrant; and
(ii) is collected as part of an effort to obtain the location information, stored data, 
or
transmitted data of an electronic device, or electronic information or data provided by 
a
provider of
 a remote computing service [
provider
] 
or an electronic communication service
 that
is the subject of the warrant in Subsection (1)(a).
(c) A law enforcement agency may use, copy, or disclose the transmitted data of an
electronic device used to communicate with the electronic device that is the subject of the
warrant if the law enforcement agency reasonably believes that the transmitted data is
necessary to achieve the objective of the warrant.
(d) The electronic information or data described in Subsection (1)(b) shall be destroyed
in an unrecoverable manner by the law enforcement agency as soon as reasonably possible after
the electronic information or data is collected.
(2) (a) A law enforcement agency may obtain location information without a warrant
for an electronic device:
(i) in accordance with Section 
53-10-104.5
;
(ii) if the device is reported stolen by the owner;
(iii) with the informed, affirmative consent of the owner or user of the electronic
device;
(iv) in accordance with a judicially recognized exception to warrant requirements;
(v) if the owner has voluntarily and publicly disclosed the location information; or
(vi) from [
the
] 
a provider of a
 remote computing service [
provider if the remote
computing service
] 
or an electronic communications service if the
 provider voluntarily
discloses the location information:
(A) under a belief that an emergency exists involving an imminent risk to an individual
of death, serious physical injury, sexual abuse, live-streamed sexual exploitation, kidnapping,
or human trafficking; or
(B) that is inadvertently discovered by the [
remote computing service
] provider and
appears to pertain to the commission of a felony, or of a misdemeanor involving physical
violence, sexual abuse, or dishonesty.
(b) A law enforcement agency may obtain stored 
data
 or transmitted data from an
electronic device[
,
] or electronic information or data transmitted by the owner of the electronic
information or data to a 
provider of a
 remote computing service [
provider
] 
or through a
provider of an electronic communication service
, without a warrant:
(i) with the informed consent of the owner of the electronic device or electronic
information or data;
(ii) in accordance with a judicially recognized exception to warrant requirements; 
or
[
(iii) in connection with a report forwarded by the National Center for Missing and
Exploited Children under 18 U.S.C. Sec. 2258A; or
]
[
(iv)
] 
(iii)
 subject to Subsection 
77-23c-102
(2)(a)(vi)(B), from a 
provider of a
 remote
computing service [
provider if the remote computing service
] 
or an electronic communication
service if the
 provider voluntarily discloses the stored or transmitted data as otherwise
permitted under 18 U.S.C. Sec. 2702.
(c) A prosecutor may obtain a judicial order as described in Section 
77-22-2.5
 for the
purposes [
enumerated
] 
described
 in Section 
77-22-2.5
.
(3) [
An
] 
A provider of an
 electronic communication service [
provider
] or 
a
 remote
computing service [
provider
], the provider's officers, employees, 
or
 agents, or other specified
persons may not be held liable for providing information, facilities, or assistance in good faith
reliance on the terms of the warrant issued under this section or without a warrant in
accordance with Subsection (2).
(4) Nothing in this chapter
:
(a)
 limits or affects the disclosure of public records under Title 63G, Chapter 2,
Government Records Access and Management Act[
.
]
;
[
(5)
] 
(b)
 [
Nothing in this chapter
] affects the rights of an employer under Subsection
34-48-202
(1)(e) or an administrative rule adopted under Section 
63F-1-206
[
.
]
; or
(c) limits the ability of a law enforcement agency to receive or use information, without
a warrant or subpoena, from the National Center for Missing and Exploited Children under 18
U.S.C. Sec. 2258A.
Section 2. Section 
77-23c-103
 is amended to read:
77-23c-103.
Notification required -- Delayed notification.
[
(1) (a) Except as provided in Subsection (2), a law enforcement agency that executes a
warrant pursuant to Subsection 
77-23c-102
(1)(a) or 
77-23c-104
(3) shall, within 14 days after
the day on which the electronic information or data that is the subject of the warrant is obtained
by the law enforcement agency, issue a notification to the owner of the electronic device or
electronic information or data specified in the warrant that states:
]
(1) (a) Except as provided in Subsection (2), if a law enforcement agency executes a
warrant in accordance with Subsection 
77-23c-102
(1) or 
77-23c-104
(3), the law enforcement
agency shall notify the owner of the electronic device or electronic information or data
specified in the warrant within 90 days after the day on which the electronic device or the
electronic data or information is obtained by the law enforcement agency but in no case shall
the law enforcement agency notify the owner more than three days after the day on which the
investigation is concluded.
(b) The notification described in Subsection (1)(a) shall state:
(i) that a warrant was applied for and granted;
(ii) the kind of warrant issued;
(iii) the period of time during which the collection of the electronic information or data
was authorized;
(iv) the offense specified in the application for the warrant;
(v) the identity of the law enforcement agency that filed the application; and
(vi) the identity of the judge who issued the warrant.
[
(b)
] 
(c)
 [
The notification requirement under Subsection (1)(a) is not triggered until
]
For the notification requirement described in Subsection (1)(a), the time period under
Subsection (1)(a) begins on the day after the day on which
 the owner of the electronic device or
electronic information or data specified in the warrant is known, or could be reasonably
identified, by the law enforcement agency.
(2) A law enforcement agency seeking a warrant [
pursuant to
] 
in accordance with
Subsection 
77-23c-102
(1)(a) or 
77-23c-104
(3) may submit a request, and the court may grant
permission, to delay the notification required by Subsection (1) for a period not to exceed 30
days, if the court determines that there is reasonable cause to believe that the notification may:
(a) endanger the life or physical safety of an individual;
(b) cause a person to flee from prosecution;
(c) lead to the destruction of or tampering with evidence;
(d) intimidate a potential witness; or
(e) otherwise seriously jeopardize an investigation or unduly delay a trial.
(3) [
(a)
] When a delay of notification is granted under Subsection (2) and upon
application by the law enforcement agency, the court may grant additional extensions of up to
30 days each.
[
(b) Notwithstanding Subsection (3)(a), when a delay of notification is granted under
Subsection (2), and upon application by a law enforcement agency, the court may grant an
additional extension of up to 60 days if the court determines that a delayed notification is
justified because the investigation involving the warrant:
]
[
(i) is interstate in nature and sufficiently complex; or
]
[
(ii) is likely to extend up to or beyond an additional 60 days.
]
(4) (a) A law enforcement agency that seeks a warrant for an electronic device or
electronic information or data in accordance with Subsection 
77-23c-102
(1)(a) or
77-23c-104
(3) may submit a request to the court to delay a notification under Subsection (2) if
the purpose of delaying the notification is to apprehend an individual:
(i) who is a fugitive from justice under Section 
77-30-13
; and
(ii) for whom an arrest warrant has been issued for a violent felony offense as defined
in Section 
76-3-203.5
.
(b) The court may grant the request under Subsection (4)(a) to delay notification until
the individual who is a fugitive from justice under Section 
77-30-13
 is apprehended by the law
enforcement agency.
(c) A law enforcement agency shall issue a notification described in Subsection (5) to
the owner of the electronic device or electronic information or data within 14 days after the day
on which the law enforcement agency apprehends the individual described in Subsection (4)(a).
[
(4)
] 
(5)
 Upon expiration of the period of delayed notification granted under
Subsection (2) or (3), 
or upon the apprehension of an individual described in Subsection (4)(a),
the law enforcement agency shall serve upon or deliver by first-class mail, or by other means if
delivery is impracticable, to the owner of the electronic device or electronic information or data
a copy of the warrant together with notice that:
(a) states with reasonable specificity the nature of the law enforcement inquiry; and
(b) contains:
(i) the information described in [
Subsections (1)(a)(i) through (vi)
] 
Subsection (1)(b)
;
(ii) a statement that notification of the search was delayed;
(iii) the name of the court that authorized the delay of notification; and
(iv) a reference to the provision of this chapter that allowed the delay of notification.
[
(5)
] 
(6)
 A law enforcement agency is not required to notify the owner of the electronic
device or electronic information or data if the owner is located outside of the United States.
Section 3. Section 
77-23c-104
 is amended to read:
77-23c-104.
Third-party electronic information or data.
(1) As used in this section, "subscriber record" means a record or information of a
provider of an electronic communication service or remote computing service that reveals the
subscriber's or customer's:
(a) name;
(b) address;
(c) local and long distance telephone connection record, or record of session time and
duration;
(d) length of service, including the start date;
(e) type of service used;
(f) telephone number, instrument number, or other subscriber or customer number or
identification, including a temporarily assigned network address; and
(g) means and source of payment for the service, including a credit card or bank
account number.
(2) Except as provided in Chapter 22, Subpoena Powers for Aid of Criminal
Investigation and Grants of Immunity, a law enforcement agency may not obtain, use, copy, or
disclose a subscriber record.
(3) A law enforcement agency may not obtain, use, copy, or disclose, for a criminal
investigation or prosecution, any record or information, other than a subscriber record, of a
provider of an electronic communication service or remote computing service related to a
subscriber or customer without a warrant.
(4) Notwithstanding Subsections (2) and (3), a law enforcement agency may obtain,
use, copy, or disclose a subscriber record, or other record or information related to a subscriber
or customer, without [
a
] 
an investigative subpoena or a
 warrant:
(a) with the informed, affirmed consent of the subscriber or customer;
(b) in accordance with a judicially recognized exception to warrant requirements;
(c) if the subscriber or customer voluntarily discloses the record in a manner that is
publicly accessible; or
(d) if the provider of an electronic communication service or remote computing service
voluntarily discloses the record:
(i) under a belief that an emergency exists involving the imminent risk to an individual
of:
(A) death;
(B) serious physical injury;
(C) sexual abuse;
(D) live-streamed sexual exploitation;
(E) kidnapping; or
(F) human trafficking;
(ii) that is inadvertently discovered by the provider, if the record appears to pertain to
the commission of:
(A) a felony; or
(B) a misdemeanor involving physical violence, sexual abuse, or dishonesty; or
(iii) subject to Subsection 
77-23c-104
(4)(d)(ii), as otherwise permitted under 18 U.S.C.
Sec. 2702.
(5) A provider of an electronic communication service or remote computing service, or
the provider's officers, employees, agents, or other specified persons may not be held liable for
providing information, facilities, or assistance in good faith reliance on the terms of a warrant
issued under this section, or without a warrant in accordance with Subsection (3).