Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 343 First Substitute (2023GS)

Sponsor

Rep. Moss, J.

Final action

Governor Signed 3/14/2023

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• permits the Division of Archives and Records Service to require a background check of employees and volunteers who have direct access to vulnerable records;
• modifies the duties of a records officer;
• grants rulemaking authority to the state archivist, the executive director of the Department of Government Operations, and other departments, in relation to government records and the provisions of this bill;
• requires executive branch agencies to:
• make and maintain an inventory of records that contain personal identifying information; and
• prepare and maintain a privacy annotation for each record series collected, maintained, or used by the executive branch agency that discloses whether the record series contains personal identifying information, describes the type of personal identifying information contained in the record series, and provides other information regarding the personal identifying information contained in the record series;
• requires the executive director of the Department of Government Operations to make rules for identifying personal identifying information, inventorying the information, and reporting regarding the information;
• modifies individual rights with respect to records that may be classified as private or controlled or that may contain personal identifying information;
• changes the title of the "government operations privacy officer" to the "chief privacy officer"; and
• makes technical and conforming changes.

Every vote on this bill

Bill text

GOVERNMENT RECORDS MODIFICATIONS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Jefferson Moss
Senate Sponsor: 
Kirk A. Cullimore
LONG TITLE
General Description:
This bill amends provisions relating to government records, including provisions
relating to the Division of Archives and Records Service, the Government Records
Access and Management Act, and a chief privacy officer.
Highlighted Provisions:
This bill:
▸ defines terms;
▸ permits the Division of Archives and Records Service to require a background
check of employees and volunteers who have direct access to vulnerable records;
▸ modifies the duties of a records officer;
▸ grants rulemaking authority to the state archivist, the executive director of the
Department of Government Operations, and other departments, in relation to
government records and the provisions of this bill;
▸ requires executive branch agencies to:
• make and maintain an inventory of records that contain personal identifying
information; and
• prepare and maintain a privacy annotation for each record series collected,
maintained, or used by the executive branch agency that discloses whether the
record series contains personal identifying information, describes the type of
personal identifying information contained in the record series, and provides
other information regarding the personal identifying information contained in
the record series;
▸ requires the executive director of the Department of Government Operations to
make rules for identifying personal identifying information, inventorying the
information, and reporting regarding the information;
▸ modifies individual rights with respect to records that may be classified as private or
controlled or that may contain personal identifying information;
▸ changes the title of the "government operations privacy officer" to the "chief privacy
officer"; and
▸ makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
63A-12-100.5
, as last amended by Laws of Utah 2015, Chapter 322
63A-12-101
, as last amended by Laws of Utah 2022, Chapter 169
63A-12-108
, as renumbered and amended by Laws of Utah 2008, Chapter 382
63C-24-202
, as enacted by Laws of Utah 2021, Chapter 155
63G-2-103
, as last amended by Laws of Utah 2021, Chapters 211, 283
63G-2-107
, as last amended by Laws of Utah 2016, Chapter 380
63G-2-201
, as last amended by Laws of Utah 2019, Chapter 334
63G-2-204
, as last amended by Laws of Utah 2021, Chapter 64
63G-2-307
, as renumbered and amended by Laws of Utah 2008, Chapter 382
63G-2-601
, as renumbered and amended by Laws of Utah 2008, Chapter 382
63G-2-604
, as last amended by Laws of Utah 2019, Chapter 254
67-1-17
, as enacted by Laws of Utah 2021, Chapter 155
67-3-13
, as enacted by Laws of Utah 2021, Chapter 155
77-27-5
, as last amended by Laws of Utah 2021, Chapters 21, 246 and 260 and last
amended by Coordination Clause, Laws of Utah 2021, Chapter 260
ENACTS:
63A-12-115
, Utah Code Annotated 1953
63A-12-116
, Utah Code Annotated 1953
REPEALS AND REENACTS:
63A-12-104
, as last amended by Laws of Utah 2022, Chapter 169
REPEALS:
63A-12-100
, as last amended by Laws of Utah 2021, Chapter 84
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
63A-12-100.5
 is amended to read:
CHAPTER 12. DIVISION OF ARCHIVES AND RECORDS SERVICE AND
MANAGEMENT OF GOVERNMENT RECORDS
63A-12-100.5.
Definitions.
(1) Except as provided under Subsection (2), the definitions in Section 
63G-2-103
apply to this chapter.
(2) As used in this chapter:
(a) [
"division" or "state archives"
] 
"Division"
 means the Division of Archives and
Records Service[
; and
]
.
(b) (i) "Executive branch agency" means the same as that term is defined in Section
63A-16-102
.
(ii) "Executive branch agency" includes a state agency, as defined in Subsection
67-1-17
(1)(d).
(c) (i) "Personal identifying information" means information about an individual that:
(A) identifies, or can be used to identify, an individual;
(B) distinguishes an individual from one or more other individuals; or
(C) is, or can be, logically associated with other information or data, through
technology or otherwise, to identify an individual or distinguish an individual from one or more
other individuals.
(ii) "Personal identifying information" includes information identified as personal
identifying information in accordance with the rules described in Section 
63A-12-104
.
(d) "Privacy annotation" means a summary, described in Subsection 
63A-12-115
(2)
and rules made by the executive director under Subsection 
63A-12-104
(2), that, for each record
series that an executive branch agency collects, maintains, or uses:
(i) discloses whether the record series contains personal identifying information; and
(ii) if the record series contains personal identifying information, includes the
information described in Subsection 
63A-12-115
(2)(b).
[
(b)
] 
(e)
 [
"record"
] 
Record"
 means:
(i) the same as that term is defined in Section 
63G-2-103
; or
(ii) a video or audio recording of an interview, or a transcript of the video or audio
recording, that is conducted at a Children's Justice Center established under Section 
67-5b-102
,
the release of which is governed by Section 
77-37-4
.
(f) "State archives" means the Division of Archives and Records Service.
(g) "Vulnerable adult" means the same as that term is defined in Section 
62A-3-301
.
(h) "Vulnerable record" means a record or data relating to:
(i) national security interests;
(ii) the care, custody, or control of a child;
(iii) a fiduciary trust over money;
(iv) health care of a child; or
(v) the following, in relation to a vulnerable adult:
(A) protection, health care, or other care; or
(B) the provision of food, shelter, clothing, assistance with an activity of daily living,
or assistance with financial resource management.
Section 2. Section 
63A-12-101
 is amended to read:
63A-12-101.
Division of Archives and Records Service created -- Duties.
(1) There is created the Division of Archives and Records Service within the
department.
(2) The state archives shall:
(a) administer the state's archives and records management programs, including storage
of records, central reformatting programs, and quality control;
(b) apply fair, efficient, and economical management methods to the collection,
creation, use, maintenance, retention, preservation, disclosure, and disposal of records and
documents;
(c) establish standards, procedures, and techniques for the effective management and
physical care of records;
(d) conduct surveys of office operations and recommend improvements in current
records management practices, including the use of space, equipment, automation, and supplies
used in creating, maintaining, storing, and servicing records;
(e) establish standards for the preparation of schedules providing for the retention of
records of continuing value and for the prompt and orderly disposal of state records no longer
possessing sufficient administrative, historical, legal, or fiscal value to warrant further
retention;
(f) establish, maintain, and operate centralized reformatting lab facilities and quality
control for the state;
(g) provide staff and support services to the Records Management Committee created
in Section 
63A-12-112
 and the State Records Committee created in Section 
63G-2-501
;
(h) develop training programs to assist records officers and other interested officers and
employees of governmental entities to administer this chapter and Title 63G, Chapter 2,
Government Records Access and Management Act;
(i) provide access to public records deposited in the archives;
(j) administer and maintain the Utah Public Notice Website established under Section
63A-16-601
;
(k) provide assistance to any governmental entity in administering this chapter and
Title 63G, Chapter 2, Government Records Access and Management Act;
(l) prepare forms for use by all governmental entities for a person requesting access to
a record; and
(m) if the department operates the Division of Archives and Records Service as an
internal service fund agency in accordance with Section 
63A-1-109.5
, submit to the Rate
Committee established in Section 
63A-1-114
:
(i) the proposed rate schedule as required by Section 
63A-1-114
; and
(ii) other information or analysis requested by the Rate Committee.
(3) The state archives may:
(a) establish a report and directives management program; [
and
]
(b) establish a forms management program[
.
]
; and
(c) in accordance with Section 
63A-12-101
, require that an individual undergo a
background check if the individual:
(i) applies to be, or currently is, an employee or volunteer of the division; and
(ii) will have direct access to a vulnerable record in the capacity described in
Subsection (3)(c)(i).
(4) The executive director may direct the state archives to administer other functions or
services consistent with this chapter and Title 63G, Chapter 2, Government Records Access
and Management Act.
Section 3. Section 
63A-12-104
 is repealed and reenacted to read:
63A-12-104.
Rulemaking authority.
(1) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act:
(a) the state archivist may, for an executive branch agency, make rules establishing
procedures for the collection, storage, designation, classification, access, mediation for records
access, and management of records under this chapter and Title 63G, Chapter 2, Government
Records Access and Management Act; and
(b) a department may make rules specifying at which level within the department the
requirements described in this chapter will be undertaken.
(2) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the
executive director shall, in consultation with the state archivist and the chief privacy officer,
make rules for an executive branch agency that establish:
(a) requirements for making an inventory of each record series that contains personal
identifying information, including:
(i) information collected as part of the inventory;
(ii) regularly reviewing, updating, and maintaining the inventory; and
(iii) reporting the inventory to the chief privacy officer;
(b) a list of information, categories of information, or types of information expressly
designated as personal identifying information, in accordance with the criteria described in
Subsections 
63A-12-100.5
(2)(c)(i) through (iii);
(c) criteria, variables, and principles for determining whether information in a record
series, not expressly designated under Subsection (2)(b), is personal identifying information;
(d) a list and description of categories or types of personal identifying information that
are collected, maintained, or used by executive branch agencies; and
(e) requirements for the form, content, format, review, and update of a privacy
annotation.
(3) The rules described in Subsection (2)(b) may incorporate, by reference, a data
dictionary that a records officer appointed under Subsection 
63A-12-103
(2)(a) shall use in
making the determination described in Subsection (2)(c).
Section 4. Section 
63A-12-108
 is amended to read:
63A-12-108.
Inspection and summary of record series -- Data dictionary.
(1)
 [
The state
] 
State
 archives shall provide for public inspection of
:
(a)
 the title and a summary description of each record series[
.
]
; and
(b) for an executive branch agency, the privacy annotation of each record series.
(2) The department shall:
(a) post the data dictionary described in Subsection 
63A-12-104
(3) on the department's
website; and
(b) maintain and update the data dictionary on a regular basis.
Section 5. Section 
63A-12-115
 is enacted to read:
 63A-12-115.
Privacy annotation for records series -- Requirements -- Content.
(1) (a) Before January 1, 2026, an executive branch agency shall, for each record series
that the executive branch agency collects, maintains, or uses, evaluate the record series and
make a privacy annotation that completely and accurately complies with Subsection (2) and the
rules described in Subsection 
63A-12-104
(2)(e).
(b) Beginning on January 1, 2026, an executive branch agency may not collect,
maintain, or use personal identifying information unless the record series for which the
personal identifying information is collected, maintained, or used includes a privacy annotation
that completely and accurately complies with Subsection (2) and the rules described in
Subsection 
63A-12-104
(2)(e).
(2) A privacy annotation shall include the following:
(a) if the record series does not include personal identifying information, a statement
indicating that the record series does not include personal identifying information;
(b) if the record series includes personal identifying information:
(i) an inventory of the personal identifying information included in the record series;
and
(ii) for the personal identifying information described in Subsection (2)(b)(i):
(A) the purpose for which the executive branch agency collects, keeps, or uses the
personal identifying information;
(B) a citation to the executive branch agency's legal authority for collecting, keeping, or
using the personal identifying information; and
(C) any other information required by state archives by rule under Subsection
63A-12-104
(2)(e).
Section 6. Section 
63A-12-116
 is enacted to read:
 63A-12-116.
Background check for individuals with direct access to a vulnerable
record.
(1) If, under Subsection 
63A-12-101
(3)(c), state archives requires an individual to
undergo a background check:
(a) the individual shall:
(i) submit to state archives, in a form designated by state archives, a fingerprint card
and other information required by state archives for the background check; and
(ii) consent to a criminal background check by the Federal Bureau of Investigation, the
Bureau of Criminal Identification, or any other state entity that performs criminal background
checks; and
(b) state archives shall:
(i) submit the fingerprint card and information described in Subsection (1)(a)(i) to the
Utah Bureau of Criminal Identification; and
(ii) pay all fees required to conduct the background check, including fees described in
Subsection 
53-10-108
(15)(a) and fees required by the Federal Bureau of Investigation.
(2) The Bureau of Criminal Identification shall provide all results of a criminal
background check described in this section to state archives, including results from state,
regional, and nationwide background checks.
(3) State archives may make rules, in accordance with Title 63G, Chapter 3, Utah
Administrative Rulemaking Act, to:
(a) establish procedures for requiring and conducting a background check under this
section; and
(b) specify requirements for the information and fingerprint card required for a
background check under this section.
Section 7. Section 
63C-24-202
 is amended to read:
63C-24-202.
Commission duties.
(1) The commission shall:
(a) develop guiding standards and best practices with respect to government privacy
practices;
(b) develop educational and training materials that include information about:
(i) the privacy implications and civil liberties concerns of the privacy practices of
government entities;
(ii) best practices for government collection and retention policies regarding personal
data; and
(iii) best practices for government personal data security standards; and
(c) review the privacy implications and civil liberties concerns of government privacy
practices.
(2) The commission may:
(a) review specific government privacy practices as referred to the commission by the
[
government operations
] 
chief
 privacy officer described in Section 
67-1-17
 or the state privacy
officer described in Section 
67-3-13
; and
(b) develop recommendations for legislation regarding the guiding standards and best
practices the commission has developed in accordance with Subsection (1)(a).
(3) Annually, on or before October 1, the commission shall report to the Judiciary
Interim Committee:
(a) the results of any reviews the commission has conducted;
(b) the guiding standards and best practices described in Subsection (1)(a); and
(c) any recommendations for legislation the commission has developed in accordance
with Subsection (2)(b).
Section 8. Section 
63G-2-103
 is amended to read:
63G-2-103.
Definitions.
As used in this chapter:
(1) "Audit" means:
(a) a systematic examination of financial, management, program, and related records
for the purpose of determining the fair presentation of financial statements, adequacy of
internal controls, or compliance with laws and regulations; or
(b) a systematic examination of program procedures and operations for the purpose of
determining their effectiveness, economy, efficiency, and compliance with statutes and
regulations.
(2) "Chronological logs" mean the regular and customary summary records of law
enforcement agencies and other public safety agencies that show:
(a) the time and general nature of police, fire, and paramedic calls made to the agency;
and
(b) any arrests or jail bookings made by the agency.
(3) "Classification," "classify," and their derivative forms mean determining whether a
record series, record, or information within a record is public, private, controlled, protected, or
exempt from disclosure under Subsection 
63G-2-201
(3)(b).
(4) (a) "Computer program" means:
(i) a series of instructions or statements that permit the functioning of a computer
system in a manner designed to provide storage, retrieval, and manipulation of data from the
computer system; and
(ii) any associated documentation and source material that explain how to operate the
computer program.
(b) "Computer program" does not mean:
(i) the original data, including numbers, text, voice, graphics, and images;
(ii) analysis, compilation, and other manipulated forms of the original data produced by
use of the program; or
(iii) the mathematical or statistical formulas, excluding the underlying mathematical
algorithms contained in the program, that would be used if the manipulated forms of the
original data were to be produced manually.
(5) (a) "Contractor" means:
(i) any person who contracts with a governmental entity to provide goods or services
directly to a governmental entity; or
(ii) any private, nonprofit organization that receives funds from a governmental entity.
(b) "Contractor" does not mean a private provider.
(6) "Controlled record" means a record containing data on individuals that is controlled
as provided by Section 
63G-2-304
.
(7) "Designation," "designate," and their derivative forms mean indicating, based on a
governmental entity's familiarity with a record series or based on a governmental entity's
review of a reasonable sample of a record series, the primary classification that a majority of
records in a record series would be given if classified and the classification that other records
typically present in the record series would be given if classified.
(8) "Elected official" means each person elected to a state office, county office,
municipal office, school board or school district office, local district office, or special service
district office, but does not include judges.
(9) "Explosive" means a chemical compound, device, or mixture:
(a) commonly used or intended for the purpose of producing an explosion; and
(b) that contains oxidizing or combustive units or other ingredients in proportions,
quantities, or packing so that:
(i) an ignition by fire, friction, concussion, percussion, or detonator of any part of the
compound or mixture may cause a sudden generation of highly heated gases; and
(ii) the resultant gaseous pressures are capable of:
(A) producing destructive effects on contiguous objects; or
(B) causing death or serious bodily injury.
(10) "Government audit agency" means any governmental entity that conducts an audit.
(11) (a) "Governmental entity" means:
(i) executive department agencies of the state, the offices of the governor, lieutenant
governor, state auditor, attorney general, and state treasurer, the Board of Pardons and Parole,
the Board of Examiners, the National Guard, the Career Service Review Office, the State
Board of Education, the Utah Board of Higher Education, and the State Archives;
(ii) the Office of the Legislative Auditor General, Office of the Legislative Fiscal
Analyst, Office of Legislative Research and General Counsel, the Legislature, and legislative
committees, except any political party, group, caucus, or rules or sifting committee of the
Legislature;
(iii) courts, the Judicial Council, the Administrative Office of the Courts, and similar
administrative units in the judicial branch;
(iv) any state-funded institution of higher education or public education; or
(v) any political subdivision of the state, but, if a political subdivision has adopted an
ordinance or a policy relating to information practices pursuant to Section 
63G-2-701
, this
chapter shall apply to the political subdivision to the extent specified in Section 
63G-2-701
 or
as specified in any other section of this chapter that specifically refers to political subdivisions.
(b) "Governmental entity" also means:
(i) every office, agency, board, bureau, committee, department, advisory board, or
commission of an entity listed in Subsection (11)(a) that is funded or established by the
government to carry out the public's business;
(ii) as defined in Section 
11-13-103
, an interlocal entity or joint or cooperative
undertaking;
(iii) as defined in Section 
11-13a-102
, a governmental nonprofit corporation;
(iv) an association as defined in Section 
53G-7-1101
;
(v) the Utah Independent Redistricting Commission; and
(vi) a law enforcement agency, as defined in Section 
53-1-102
, that employs one or
more law enforcement officers, as defined in Section 
53-13-103
.
(c) "Governmental entity" does not include the Utah Educational Savings Plan created
in Section 
53B-8a-103
.
(12) "Gross compensation" means every form of remuneration payable for a given
period to an individual for services provided including salaries, commissions, vacation pay,
severance pay, bonuses, and any board, rent, housing, lodging, payments in kind, and any
similar benefit received from the individual's employer.
(13) "Individual" means a human being.
(14) (a) "Initial contact report" means an initial written or recorded report, however
titled, prepared by peace officers engaged in public patrol or response duties describing official
actions initially taken in response to either a public complaint about or the discovery of an
apparent violation of law, which report may describe:
(i) the date, time, location, and nature of the complaint, the incident, or offense;
(ii) names of victims;
(iii) the nature or general scope of the agency's initial actions taken in response to the
incident;
(iv) the general nature of any injuries or estimate of damages sustained in the incident;
(v) the name, address, and other identifying information about any person arrested or
charged in connection with the incident; or
(vi) the identity of the public safety personnel, except undercover personnel, or
prosecuting attorney involved in responding to the initial incident.
(b) Initial contact reports do not include follow-up or investigative reports prepared
after the initial contact report. However, if the information specified in Subsection (14)(a)
appears in follow-up or investigative reports, it may only be treated confidentially if it is
private, controlled, protected, or exempt from disclosure under Subsection 
63G-2-201
(3)(b).
(c) Initial contact reports do not include accident reports, as that term is described in
Title 41, Chapter 6a, Part 4, Accident Responsibilities.
(15) "Legislative body" means the Legislature.
(16) "Notice of compliance" means a statement confirming that a governmental entity
has complied with an order of the State Records Committee.
(17) "Person" means:
(a) an individual;
(b) a nonprofit or profit corporation;
(c) a partnership;
(d) a sole proprietorship;
(e) other type of business organization; or
(f) any combination acting in concert with one another.
(18) "Personal identifying information" means the same as that term is defined in
Section 
63A-12-100.5
.
(19) "Privacy annotation" means the same as that term is defined in Section
63A-12-100.5
.
[
(18)
] 
(20)
 "Private provider" means any person who contracts with a governmental
entity to provide services directly to the public.
[
(19)
] 
(21)
 "Private record" means a record containing data on individuals that is
private as provided by Section 
63G-2-302
.
[
(20)
] 
(22)
 "Protected record" means a record that is classified protected as provided by
Section 
63G-2-305
.
[
(21)
] 
(23)
 "Public record" means a record that is not private, controlled, or protected
and that is not exempt from disclosure as provided in Subsection 
63G-2-201
(3)(b).
[
(22)
] 
(24)
 (a) "Record" means a book, letter, document, paper, map, plan, photograph,
film, card, tape, recording, electronic data, or other documentary material regardless of physical
form or characteristics:
(i) that is prepared, owned, received, or retained by a governmental entity or political
subdivision; and
(ii) where all of the information in the original is reproducible by photocopy or other
mechanical or electronic means.
(b) "Record" does not mean:
(i) a personal note or personal communication prepared or received by an employee or
officer of a governmental entity:
(A) in a capacity other than the employee's or officer's governmental capacity; or
(B) that is unrelated to the conduct of the public's business;
(ii) a temporary draft or similar material prepared for the originator's personal use or
prepared by the originator for the personal use of an individual for whom the originator is
working;
(iii) material that is legally owned by an individual in the individual's private capacity;
(iv) material to which access is limited by the laws of copyright or patent unless the
copyright or patent is owned by a governmental entity or political subdivision;
(v) proprietary software;
(vi) junk mail or a commercial publication received by a governmental entity or an
official or employee of a governmental entity;
(vii) a book that is cataloged, indexed, or inventoried and contained in the collections
of a library open to the public;
(viii) material that is cataloged, indexed, or inventoried and contained in the collections
of a library open to the public, regardless of physical form or characteristics of the material;
(ix) a daily calendar or other personal note prepared by the originator for the
originator's personal use or for the personal use of an individual for whom the originator is
working;
(x) a computer program that is developed or purchased by or for any governmental
entity for its own use;
(xi) a note or internal memorandum prepared as part of the deliberative process by:
(A) a member of the judiciary;
(B) an administrative law judge;
(C) a member of the Board of Pardons and Parole; or
(D) a member of any other body, other than an association or appeals panel as defined
in Section 
53G-7-1101
, charged by law with performing a quasi-judicial function;
(xii) a telephone number or similar code used to access a mobile communication
device that is used by an employee or officer of a governmental entity, provided that the
employee or officer of the governmental entity has designated at least one business telephone
number that is a public record as provided in Section 
63G-2-301
;
(xiii) information provided by the Public Employees' Benefit and Insurance Program,
created in Section 
49-20-103
, to a county to enable the county to calculate the amount to be
paid to a health care provider under Subsection 
17-50-319
(2)(e)(ii);
(xiv) information that an owner of unimproved property provides to a local entity as
provided in Section 
11-42-205
;
(xv) a video or audio recording of an interview, or a transcript of the video or audio
recording, that is conducted at a Children's Justice Center established under Section 
67-5b-102
;
(xvi) child pornography, as defined by Section 
76-5b-103
;
(xvii) before final disposition of an ethics complaint occurs, a video or audio recording
of the closed portion of a meeting or hearing of:
(A) a Senate or House Ethics Committee;
(B) the Independent Legislative Ethics Commission;
(C) the Independent Executive Branch Ethics Commission, created in Section
63A-14-202
; or
(D) the Political Subdivisions Ethics Review Commission established in Section
63A-15-201
; or
(xviii) confidential communication described in Section 
58-60-102
, 
58-61-102
, or
58-61-702
.
[
(23)
] 
(25)
 "Record series" means a group of records that may be treated as a unit for
purposes of designation, description, management, or disposition.
[
(24)
] 
(26)
 "Records officer" means the individual appointed by the chief
administrative officer of each governmental entity, or the political subdivision to work with
state archives in the care, maintenance, scheduling, designation, classification, disposal, and
preservation of records.
[
(25)
] 
(27)
 "Schedule," "scheduling," and their derivative forms mean the process of
specifying the length of time each record series should be retained by a governmental entity for
administrative, legal, fiscal, or historical purposes and when each record series should be
transferred to the state archives or destroyed.
[
(26)
] 
(28)
 "Sponsored research" means research, training, and other sponsored
activities as defined by the federal Executive Office of the President, Office of Management
and Budget:
(a) conducted:
(i) by an institution within the state system of higher education defined in Section
53B-1-102
; and
(ii) through an office responsible for sponsored projects or programs; and
(b) funded or otherwise supported by an external:
(i) person that is not created or controlled by the institution within the state system of
higher education; or
(ii) federal, state, or local governmental entity.
[
(27)
] 
(29)
 "State archives" means the Division of Archives and Records Service
created in Section 
63A-12-101
.
[
(28)
] 
(30)
 "State archivist" means the director of the state archives.
[
(29)
] 
(31)
 "State Records Committee" means the State Records Committee created in
Section 
63G-2-501
.
[
(30)
] 
(32)
 "Summary data" means statistical records and compilations that contain
data derived from private, controlled, or protected information but that do not disclose private,
controlled, or protected information.
Section 9. Section 
63G-2-107
 is amended to read:
63G-2-107.
Disclosure of records subject to federal law or other provisions of
state law.
(1) (a) The disclosure of a record to which access is governed or limited pursuant to
court rule, another state statute, federal statute, or federal regulation, including a record for
which access is governed or limited as a condition of participation in a state or federal program
or for receiving state or federal funds, is governed by the specific provisions of that statute,
rule, or regulation.
(b) Except as provided in Subsection (2), this chapter applies to records described in
Subsection (1)(a) to the extent that this chapter is not inconsistent with the statute, rule, or
regulation.
[
(1)
] 
(2)
 [
Notwithstanding Subsection 
63G-2-201
(6), this
] 
Except as provided in
Subsection (3), this
 chapter does not apply to a record containing protected health information
as defined in 45 C.F.R., Part 164, Standards for Privacy of Individually Identifiable Health
Information, if the record is:
(a) controlled or maintained by a governmental entity; and
(b) governed by 45 C.F.R., Parts 160 and 164, Standards for Privacy of Individually
Identifiable Health Information.
[
(2)
] 
(c)
 The disclosure of an education record as defined in the Family Educational
Rights and Privacy Act, 34 C.F.R. Part 99, that is controlled or maintained by a governmental
entity shall be governed by the Family Educational Rights and Privacy Act, 34 C.F.R. Part 99.
(3) This section does not exempt any record or record series from the provisions of
Subsection 
63G-2-601
(1).
Section 10. Section 
63G-2-201
 is amended to read:
63G-2-201.
Provisions relating to records -- Public records -- Private, controlled,
protected, and other restricted records -- Disclosure and nondisclosure of records --
Certified copy of record -- Limits on obligation to respond to a record request.
(1) (a) Except as provided in Subsection (1)(b), a person has the right to inspect a
public record free of charge, and the right to take a copy of a public record during normal
working hours, subject to Sections 
63G-2-203
 and 
63G-2-204
.
(b) A right under Subsection (1)(a) does not apply with respect to a record:
(i) a copy of which the governmental entity has already provided to the person;
(ii) that is the subject of a records request that the governmental entity is not required
to fill under Subsection [
(8)(e)
] 
(7)(e)
; or
(iii) (A) that is accessible only by a computer or other electronic device owned or
controlled by the governmental entity;
(B) that is part of an electronic file that also contains a record that is private,
controlled, or protected; and
(C) that the governmental entity cannot readily segregate from the part of the electronic
file that contains a private, controlled, or protected record.
(2) A record is public unless otherwise expressly provided by statute.
(3) The following records are not public:
(a) a record that is private, controlled, or protected under Sections 
63G-2-302
,
63G-2-303
, 
63G-2-304
, and 
63G-2-305
; and
(b) a record to which access is restricted pursuant to court rule, another state statute,
federal statute, or federal regulation, including records for which access is governed or
restricted as a condition of participation in a state or federal program or for receiving state or
federal funds.
(4) Only a record specified in Section 
63G-2-302
, 
63G-2-303
, 
63G-2-304
, or
63G-2-305
 may be classified private, controlled, or protected.
(5) (a) A governmental entity may not disclose a record that is private, controlled, or
protected to any person except as provided in Subsection (5)(b), Subsection (5)(c), Section
63G-2-202
, 
63G-2-206
, or 
63G-2-303
.
(b) A governmental entity may disclose a record that is private under Subsection
63G-2-302
(2) or protected under Section 
63G-2-305
 to persons other than those specified in
Section 
63G-2-202
 or 
63G-2-206
 if the head of a governmental entity, or a designee,
determines that:
(i) there is no interest in restricting access to the record; or
(ii) the interests favoring access are greater than or equal to the interest favoring
restriction of access.
(c) In addition to the disclosure under Subsection (5)(b), a governmental entity may
disclose a record that is protected under Subsection 
63G-2-305
(51) if:
(i) the head of the governmental entity, or a designee, determines that the disclosure:
(A) is mutually beneficial to:
(I) the subject of the record;
(II) the governmental entity; and
(III) the public; and
(B) serves a public purpose related to:
(I) public safety; or
(II) consumer protection; and
(ii) the person who receives the record from the governmental entity agrees not to use
or allow the use of the record for advertising or solicitation purposes.
[
(6) (a) The disclosure of a record to which access is governed or limited pursuant to
court rule, another state statute, federal statute, or federal regulation, including a record for
which access is governed or limited as a condition of participation in a state or federal program
or for receiving state or federal funds, is governed by the specific provisions of that statute,
rule, or regulation.
]
[
(b) This chapter applies to records described in Subsection (6)(a) insofar as this
chapter is not inconsistent with the statute, rule, or regulation.
]
[
(7)
] 
(6)
 A governmental entity shall provide a person with a certified copy of a record
if:
(a) the person requesting the record has a right to inspect it;
(b) the person identifies the record with reasonable specificity; and
(c) the person pays the lawful fees.
[
(8)
] 
(7)
 In response to a request, a governmental entity is not required to:
(a) create a record;
(b) compile, format, manipulate, package, summarize, or tailor information;
(c) provide a record in a particular format, medium, or program not currently
maintained by the governmental entity;
(d) fulfill a person's records request if the request unreasonably duplicates prior records
requests from that person; or
(e) fill a person's records request if:
(i) the record requested is:
(A) publicly accessible online; or
(B) included in a public publication or product produced by the governmental entity
receiving the request; and
(ii) the governmental entity:
(A) specifies to the person requesting the record where the record is accessible online;
or
(B) provides the person requesting the record with the public publication or product
and specifies where the record can be found in the public publication or product.
[
(9)
] 
(8)
 (a) Although not required to do so, a governmental entity may, upon request
from the person who submitted the records request, compile, format, manipulate, package,
summarize, or tailor information or provide a record in a format, medium, or program not
currently maintained by the governmental entity.
(b) In determining whether to fulfill a request described in Subsection [
(9)(a)
] 
(8)(a)
, a
governmental entity may consider whether the governmental entity is able to fulfill the request
without unreasonably interfering with the governmental entity's duties and responsibilities.
(c) A governmental entity may require a person who makes a request under Subsection
[
(9)(a)
] 
(8)(a)
 to pay the governmental entity, in accordance with Section 
63G-2-203
, for
providing the information or record as requested.
[
(10)
] 
(9)
 (a) Notwithstanding any other provision of this chapter, and subject to
Subsection [
(10)(b)
] 
(9)(b)
, a governmental entity is not required to respond to, or provide a
record in response to, a record request if the request is submitted by or in behalf of an
individual who is confined in a jail or other correctional facility following the individual's
conviction.
(b) Subsection [
(10)(a)
] 
(9)(a)
 does not apply to:
(i) the first five record requests submitted to the governmental entity by or in behalf of
an individual described in Subsection [
(10)(a)
] 
(9)(a)
 during any calendar year requesting only
a record that contains a specific reference to the individual; or
(ii) a record request that is submitted by an attorney of an individual described in
Subsection [
(10)(a)
] 
(9)(a)
.
[
(11)
] 
(10)
 (a) A governmental entity may allow a person requesting more than 50
pages of records to copy the records if:
(i) the records are contained in files that do not contain records that are exempt from
disclosure, or the records may be segregated to remove private, protected, or controlled
information from disclosure; and
(ii) the governmental entity provides reasonable safeguards to protect the public from
the potential for loss of a public record.
(b) If the requirements of Subsection [
(11)(a)
] 
(10)(a)
 are met, the governmental entity
may:
(i) provide the requester with the facilities for copying the requested records and
require that the requester make the copies; or
(ii) allow the requester to provide the requester's own copying facilities and personnel
to make the copies at the governmental entity's offices and waive the fees for copying the
records.
[
(12)
] 
(11)
 (a) A governmental entity that owns an intellectual property right and that
offers the intellectual property right for sale or license may control by ordinance or policy the
duplication and distribution of the material based on terms the governmental entity considers to
be in the public interest.
(b) Nothing in this chapter shall be construed to limit or impair the rights or protections
granted to the governmental entity under federal copyright or patent law as a result of its
ownership of the intellectual property right.
[
(13)
] 
(12)
 A governmental entity may not use the physical form, electronic or
otherwise, in which a record is stored to deny, or unreasonably hinder the rights of a person to
inspect and receive a copy of a record under this chapter.
[
(14)
] 
(13)
 Subject to the requirements of Subsection [
(8)
] 
(7)
, a governmental entity
shall provide access to an electronic copy of a record in lieu of providing access to its paper
equivalent if:
(a) the person making the request requests or states a preference for an electronic copy;
(b) the governmental entity currently maintains the record in an electronic format that
is reproducible and may be provided without reformatting or conversion; and
(c) the electronic copy of the record:
(i) does not disclose other records that are exempt from disclosure; or
(ii) may be segregated to protect private, protected, or controlled information from
disclosure without the undue expenditure of public resources or funds.
[
(15)
] 
(14)
 In determining whether a record is properly classified as private under
Subsection 
63G-2-302
(2)(d), the governmental entity, State Records Committee, local appeals
board, or court shall consider and weigh:
(a) any personal privacy interests, including those in images, that would be affected by
disclosure of the records in question; and
(b) any public interests served by disclosure. 
Section 11. Section 
63G-2-204
 is amended to read:
63G-2-204.
Record request -- Response -- Time for responding.
(1) (a) A person making a request for a record shall submit to the governmental entity
that retains the record a written request containing:
(i) the person's:
(A) name;
(B) mailing address;
(C) email address, if the person has an email address and is willing to accept
communications by email relating to the person's records request; and
(D) daytime telephone number; and
(ii) a description of the record requested that identifies the record with reasonable
specificity.
(b) (i) A single record request may not be submitted to multiple governmental entities.
(ii) Subsection (1)(b)(i) may not be construed to prevent a person from submitting a
separate record request to each of multiple governmental entities, even if each of the separate
requests seeks access to the same record.
(2) (a) In response to a request for a record, a governmental entity may not provide a
record that it has received under Section 
63G-2-206
 as a shared record.
(b) If a governmental entity is prohibited from providing a record under Subsection
(2)(a), the governmental entity shall:
(i) deny the records request; and
(ii) inform the person making the request of the identity of the governmental entity
from which the shared record was received.
(3) A governmental entity may make rules in accordance with Title 63G, Chapter 3,
Utah Administrative Rulemaking Act, specifying where and to whom requests for access shall
be directed.
(4) After receiving a request for a record, a governmental entity shall:
(a) review each request that seeks an expedited response and notify, within five
business days after receiving the request, each requester that has not demonstrated that their
record request benefits the public rather than the person that their response will not be
expedited; and
(b) as soon as reasonably possible, but no later than 10 business days after receiving a
written request, or five business days after receiving a written request if the requester
demonstrates that expedited response to the record request benefits the public rather than the
person:
(i) approve the request and provide a copy of the record;
(ii) deny the request in accordance with the procedures and requirements of Section
63G-2-205
;
(iii) notify the requester that it does not maintain the record requested and provide, if
known, the name and address of the governmental entity that does maintain the record; or
(iv) notify the requester that because of one of the extraordinary circumstances listed in
Subsection (6), it cannot immediately approve or deny the request, and include with the notice:
(A) a description of the circumstances that constitute the extraordinary circumstances;
and
(B) the date when the records will be available, consistent with the requirements of
Subsection (7).
(5) Any person who requests a record to obtain information for a story or report for
publication or broadcast to the general public is presumed to be acting to benefit the public
rather than a person.
(6) The following circumstances constitute "extraordinary circumstances" that allow a
governmental entity to delay approval or denial by an additional period of time as specified in
Subsection (7) if the governmental entity determines that due to the extraordinary
circumstances it cannot respond within the time limits provided in Subsection (4):
(a) another governmental entity is using the record, in which case the originating
governmental entity shall promptly request that the governmental entity currently in possession
return the record;
(b) another governmental entity is using the record as part of an audit, and returning the
record before the completion of the audit would impair the conduct of the audit;
(c) (i) the request is for a voluminous quantity of records or a record series containing a
substantial number of records; or
(ii) the requester seeks a substantial number of records or records series in requests
filed within five working days of each other;
(d) the governmental entity is currently processing a large number of records requests;
(e) the request requires the governmental entity to review a large number of records to
locate the records requested;
(f) the decision to release a record involves legal issues that require the governmental
entity to seek legal counsel for the analysis of statutes, rules, ordinances, regulations, or case
law;
(g) segregating information that the requester is entitled to inspect from information
that the requester is not entitled to inspect requires extensive editing; or
(h) segregating information that the requester is entitled to inspect from information
that the requester is not entitled to inspect requires computer programming.
(7) If one of the extraordinary circumstances listed in Subsection (6) precludes
approval or denial within the time specified in Subsection (4), the following time limits apply
to the extraordinary circumstances:
(a) for claims under Subsection (6)(a), the governmental entity currently in possession
of the record shall return the record to the originating entity within five business days of the
request for the return unless returning the record would impair the holder's work;
(b) for claims under Subsection (6)(b), the originating governmental entity shall notify
the requester when the record is available for inspection and copying;
(c) for claims under Subsections (6)(c), (d), and (e), the governmental entity shall:
(i) disclose the records that it has located which the requester is entitled to inspect;
(ii) provide the requester with an estimate of the amount of time it will take to finish
the work required to respond to the request;
(iii) complete the work and disclose those records that the requester is entitled to
inspect as soon as reasonably possible; and
(iv) for any person that does not establish a right to an expedited response as
authorized by Subsection (4), a governmental entity may choose to:
(A) require the person to provide for copying of the records as provided in Subsection
[
63G-2-201
(11)
] 
63G-2-201
(10)
; or
(B) treat a request for multiple records as separate record requests, and respond
sequentially to each request;
(d) for claims under Subsection (6)(f), the governmental entity shall either approve or
deny the request within five business days after the response time specified for the original
request has expired;
(e) for claims under Subsection (6)(g), the governmental entity shall fulfill the request
within 15 business days from the date of the original request; or
(f) for claims under Subsection (6)(h), the governmental entity shall complete its
programming and disclose the requested records as soon as reasonably possible.
(8) (a) If a request for access is submitted to an office of a governmental entity other
than that specified by rule in accordance with Subsection (3), the office shall promptly forward
the request to the appropriate office.
(b) If the request is forwarded promptly, the time limit for response begins when the
request is received by the office specified by rule.
(9) If the governmental entity fails to provide the requested records or issue a denial
within the specified time period, that failure is considered the equivalent of a determination
denying access to the record.
Section 12. Section 
63G-2-307
 is amended to read:
63G-2-307.
Duty to evaluate records and make designations, classifications, and
annotations.
(1) A governmental entity shall
, for each record series that the governmental entity
keeps, uses, or creates
:
(a) evaluate all record series [
that it uses or creates
];
(b) designate [
those
] 
each
 record series as provided by this chapter and Title 63A,
Chapter 12, Division of Archives and Records Service; and
(c) report [
the designations of its record series
] to the state archives
:
(i) the designation described in Subsection (1)(b); and
(ii) if the governmental entity is an executive branch agency, as defined in Section
63A-12-100.5, the privacy annotation
.
(2) A governmental entity may classify a particular record, record series, or
information within a record at any time, but is not required to classify a particular record,
record series, or information until access to the record is requested.
(3) A governmental entity may redesignate a record series or reclassify a record or
record series, or information within a record at any time.
Section 13. Section 
63G-2-601
 is amended to read:
63G-2-601.
Rights of individuals on whom data is maintained -- Classification
and personal identifying information statement -- Notice to provider of information.
(1) (a) Each governmental entity shall file with the state archivist a statement
explaining
, for each record series collected, maintained, or used by the governmental entity,
 the
purposes for which [
a record series that is designated as private or controlled is collected and
]
each private or controlled record in the record series is collected, maintained, or
 used by that
governmental entity.
(b) Each executive branch agency, as defined in Section 
63A-12-100.5
, shall file with
the state archivist a statement explaining, for each record series collected, maintained, or used
by the executive branch agency, the purposes for which the personal identifying information in
the record series is collected, maintained, or used by the executive branch agency.
[
(b)
] 
(c)
 The statement filed under Subsection (1)(a) 
or (b):
(i) shall, for each purpose described in Subsection (1)(a) or (b), identify the authority
under which the governmental entity or executive branch agency collects the records or
information included in the statement described in Subsection (1)(a) or (b); and
(ii)
 is a public record.
(2) (a) A governmental entity shall provide [
notice of the following
] 
the notice
described in this Subsection (2)
 to a person that is asked to furnish information that could be
classified as a private or controlled record[
:
]
.
(b) An executive branch agency, as defined in Section 
63A-12-100.5
, shall provide the
notice described in this Subsection (2) to a person that is asked to furnish personal identifying
information.
(c) The notice required under Subsection (2)(a) or (b) shall:
(i) identify the record series that includes the information described in Subsection
(2)(a) or (b);
[
(i)
] 
(ii) state
 the reasons the person is asked to furnish the information;
[
(ii)
] 
(iii) state
 the intended uses of the information;
[
(iii)
] 
(iv) state
 the consequences for refusing to provide the information; and
[
(iv)
] 
(v) disclose
 the classes of persons and the governmental entities that currently:
(A) share the information with the governmental entity; or
(B) receive the information from the governmental entity on a regular or contractual
basis.
[
(b)
] 
(d)
 The [
notice shall be
] 
governmental entity shall
:
(i) [
posted
] 
post the notice required under this Subsection (2)
 in a prominent place at
all locations where the governmental entity collects the information; or
(ii) [
included
] 
include the notice required under this Subsection (2)
 as part of the
documents or forms that are used by the governmental entity to collect the information.
(3) Upon request, each governmental entity shall
, in relation to the information
described in Subsection (2)(a) or (b), as applicable,
 explain to a person:
(a) the reasons the person is asked to furnish information [
that could be classified as a
private or controlled record
];
(b) the intended uses of the information [
referred to in Subsection (3)(a)
];
(c) the consequences for refusing to provide the information [
referred to in Subsection
(3)(a)
]; and
(d) the reasons and circumstances under which the information [
referred to in
Subsection (3)(a)
] may be shared with
,
 or provided to
,
 other persons or governmental entities.
(4) A governmental entity may use [
private or controlled records
] 
the information that
the governmental entity is required to disclose under Subsection (2)(a) or (b)
 only for those
purposes:
(a) given in the statement filed with the state archivist under Subsection (1); or
(b) for which another governmental entity may use the record under Section
63G-2-206
.
Section 14. Section 
63G-2-604
 is amended to read:
63G-2-604.
Retention and disposition of records.
(1) (a) Except for a governmental entity that is permitted to maintain the governmental
entity's own retention schedules under Part 7, Applicability to Political Subdivisions, the
Judiciary, and the Legislature, each governmental entity shall file with the Records
Management Committee created in Section 
63A-12-112
 a proposed schedule for the retention
and disposition of each type of material that is defined as a record under this chapter.
(b) After a retention schedule is reviewed and approved by the Records Management
Committee under Subsection 
63A-12-113
(1)(b), the governmental entity shall maintain and
destroy records in accordance with the retention schedule.
(c) If a governmental entity subject to the provisions of this section has not received an
approved retention schedule from the Records Management Committee for a specific type of
material that is [
classified
] 
defined
 as a record under this chapter, the [
model
] 
general
 retention
schedule maintained by the state archivist shall govern the retention and destruction of that type
of material.
(2) A retention schedule that is filed with or approved by the Records Management
Committee under the requirements of this section is a public record.
Section 15. Section 
67-1-17
 is amended to read:
67-1-17.
 Chief privacy officer.
(1) As used in this section:
(a) "Independent entity" means the same as that term is defined in Section 
63E-1-102
.
(b) (i) "Personal data" means any information relating to an identified or identifiable
individual.
(ii) "Personal data" includes personally identifying information.
(c) (i) "Privacy practice" means the acquisition, use, storage, or disposal of personal
data.
(ii) "Privacy practice" includes:
(A) a technology use related to personal data; and
(B) policies related to the protection, storage, sharing, and retention of personal data.
(d) (i) "State agency" means the following entities that are under the direct supervision
and control of the governor or the lieutenant governor:
(A) a department;
(B) a commission;
(C) a board;
(D) a council;
(E) an institution;
(F) an officer;
(G) a corporation;
(H) a fund;
(I) a division;
(J) an office;
(K) a committee;
(L) an authority;
(M) a laboratory;
(N) a library;
(O) a bureau;
(P) a panel;
(Q) another administrative unit of the state; or
(R) an agent of an entity described in Subsections (A) through (Q).
(ii) "State agency" does not include:
(A) the legislative branch;
(B) the judicial branch;
(C) an executive branch agency within the Office of the Attorney General, the state
auditor, the state treasurer, or the State Board of Education; or
(D) an independent entity.
(2) The governor [
may
] 
shall
, with the advice and consent of the Senate, appoint a
[
government operations
] 
chief
 privacy officer.
(3) The [
government operations
] 
chief
 privacy officer shall:
(a) compile information about the privacy practices of state agencies;
(b) make public and maintain information about the privacy practices of state agencies
on the governor's website;
(c) provide state agencies with educational and training materials developed by the
Personal Privacy Oversight Commission established in Section 
63C-24-201
 that include the
information described in Subsection 
63C-24-202
(1)(b);
(d) implement a process to analyze and respond to requests from individuals for the
[
government operations
] 
chief
 privacy officer to review a state agency's privacy practice;
(e) identify annually which state agencies' privacy practices pose the greatest risk to
individual privacy and prioritize those privacy practices for review;
(f) review each year, in as timely a manner as possible, the privacy practices that the
[
government operations
] 
chief
 privacy officer identifies under Subsection (3)(d) or (e) as
posing the greatest risk to individuals' privacy;
(g) when reviewing a state agency's privacy practice under Subsection (3)(f), analyze:
(i) details about the privacy practice;
(ii) information about the type of data being used;
(iii) information about how the data is obtained, shared, secured, stored, and disposed;
(iv) information about with which persons the state agency shares the information;
(v) information about whether an individual can or should be able to opt out of the
retention and sharing of the individual's data;
(vi) information about how the state agency de-identifies or anonymizes data;
(vii) a determination about the existence of alternative technology or improved
practices to protect privacy; and
(viii) a finding of whether the state agency's current privacy practice adequately
protects individual privacy; and
(h) after completing a review described in Subsections (3)(f) and (g), determine:
(i) each state agency's use of personal data, including the state agency's practices
regarding data:
(A) acquisition;
(B) storage;
(C) disposal;
(D) protection; and
(E) sharing;
(ii) the adequacy of the state agency's practices in each of the areas described in
Subsection (3)(h)(i); and
(iii) for each of the areas described in Subsection (3)(h)(i) that the [
government
operations
] 
chief
 privacy officer determines require reform, provide recommendations to the
state agency for reform.
(4) The [
government operations
] 
chief
 privacy officer shall:
(a) quarterly report, to the Personal Privacy Oversight Commission:
(i) recommendations for privacy practices for the commission to review; and
(ii) the information described in Subsection (3)(h); and
(b) annually, on or before October 1, report to the Judiciary Interim Committee:
(i) the results of any reviews described in Subsection (3)(g), if any reviews have been
completed;
(ii) reforms, to the extent that the [
government operations
] 
chief
 privacy officer is
aware of any reforms, that the state agency made in response to any reviews described in
Subsection (3)(g);
(iii) the information described in Subsection (3)(h); and
(iv) recommendations for legislation based on the results of any reviews described in
Subsection (3)(g).
(5) The chief privacy officer may make rules, in accordance with Title 63G, Chapter 3,
Utah Administrative Rulemaking Act, that establish requirements and standards for
determining whether a state agency's privacy practice, in relation to the areas described in
Subsection (3)(h)(i), is adequate or requires reform.
Section 16. Section 
67-3-13
 is amended to read:
67-3-13.
State privacy officer.
(1) As used in this section:
(a) "Designated government entity" means a government entity that is not a state
agency.
(b) "Independent entity" means the same as that term is defined in Section 
63E-1-102
.
(c) (i) "Government entity" means the state, a county, a municipality, a higher
education institution, a local district, a special service district, a school district, an independent
entity, or any other political subdivision of the state or an administrative subunit of any
political subdivision, including a law enforcement entity.
(ii) "Government entity" includes an agent of an entity described in Subsection
(1)(c)(i).
(d) (i) "Personal data" means any information relating to an identified or identifiable
individual.
(ii) "Personal data" includes personally identifying information.
(e) (i) "Privacy practice" means the acquisition, use, storage, or disposal of personal
data.
(ii) "Privacy practice" includes:
(A) a technology use related to personal data; and
(B) policies related to the protection, storage, sharing, and retention of personal data.
(f) (i) "State agency" means the following entities that are under the direct supervision
and control of the governor or the lieutenant governor:
(A) a department;
(B) a commission;
(C) a board;
(D) a council;
(E) an institution;
(F) an officer;
(G) a corporation;
(H) a fund;
(I) a division;
(J) an office;
(K) a committee;
(L) an authority;
(M) a laboratory;
(N) a library;
(O) a bureau;
(P) a panel;
(Q) another administrative unit of the state; or
(R) an agent of an entity described in Subsections (A) through (Q).
(ii) "State agency" does not include:
(A) the legislative branch;
(B) the judicial branch;
(C) an executive branch agency within the Office of the Attorney General, the state
auditor, the state treasurer, or the State Board of Education; or
(D) an independent entity.
(2) The state privacy officer shall:
(a) when completing the duties of this Subsection (2), focus on the privacy practices of
designated government entities;
(b) compile information about government privacy practices of designated government
entities;
(c) make public and maintain information about government privacy practices on the
state auditor's website;
(d) provide designated government entities with educational and training materials
developed by the Personal Privacy Oversight Commission established in Section 
63C-24-201
that include the information described in Subsection 
63C-24-202
(1)(b);
(e) implement a process to analyze and respond to requests from individuals for the
state privacy officer to review a designated government entity's privacy practice;
(f) identify annually which designated government entities' privacy practices pose the
greatest risk to individual privacy and prioritize those privacy practices for review;
(g) review each year, in as timely a manner as possible, the privacy practices that the
privacy officer identifies under Subsection (2)(e) or (2)(f) as posing the greatest risk to
individuals' privacy;
(h) when reviewing a designated government entity's privacy practice under Subsection
(2)(g), analyze:
(i) details about the technology or the policy and the technology's or the policy's
application;
(ii) information about the type of data being used;
(iii) information about how the data is obtained, stored, shared, secured, and disposed;
(iv) information about with which persons the designated government entity shares the
information;
(v) information about whether an individual can or should be able to opt out of the
retention and sharing of the individual's data;
(vi) information about how the designated government entity de-identifies or
anonymizes data;
(vii) a determination about the existence of alternative technology or improved
practices to protect privacy; and
(viii) a finding of whether the designated government entity's current privacy practice
adequately protects individual privacy; and
(i) after completing a review described in Subsections (2)(g) and (h), determine:
(i) each designated government entity's use of personal data, including the designated
government entity's practices regarding data:
(A) acquisition;
(B) storage;
(C) disposal;
(D) protection; and
(E) sharing;
(ii) the adequacy of the designated government entity's practices in each of the areas
described in Subsection (2)(i)(i); and
(iii) for each of the areas described in Subsection (2)(i)(i) that the state privacy officer
determines to require reform, provide recommendations for reform to the designated
government entity and the legislative body charged with regulating the designated government
entity.
(3) (a) The legislative body charged with regulating a designated government entity
that receives a recommendation described in Subsection (2)(i)(iii) shall hold a public hearing
on the proposed reforms:
(i) with a quorum of the legislative body present; and
(ii) within 90 days after the day on which the legislative body receives the
recommendation.
(b) (i) The legislative body shall provide notice of the hearing described in Subsection
(3)(a).
(ii) Notice of the public hearing and the recommendations to be discussed shall be
posted on:
(A) the Utah Public Notice Website created in Section 
63A-16-601
 for 30 days before
the day on which the legislative body will hold the public hearing; and
(B) the website of the designated government entity that received a recommendation, if
the designated government entity has a website, for 30 days before the day on which the
legislative body will hold the public hearing.
(iii) Each notice required under Subsection (3)(b)(i) shall:
(A) identify the recommendations to be discussed; and
(B) state the date, time, and location of the public hearing.
(c) During the hearing described in Subsection (3)(a), the legislative body shall:
(i) provide the public the opportunity to ask questions and obtain further information
about the recommendations; and
(ii) provide any interested person an opportunity to address the legislative body with
concerns about the recommendations.
(d) At the conclusion of the hearing, the legislative body shall determine whether the
legislative body shall adopt reforms to address the recommendations and any concerns raised
during the public hearing.
(4) (a) Except as provided in Subsection (4)(b), if the [
government operations
] 
chief
privacy officer described in Section 
67-1-17
 is not conducting reviews of the privacy practices
of state agencies, the state privacy officer may review the privacy practices of a state agency in
accordance with the processes described in this section.
(b) Subsection (3) does not apply to a state agency.
(5) The state privacy officer shall:
(a) quarterly report, to the Personal Privacy Oversight Commission:
(i) recommendations for privacy practices for the commission to review; and
(ii) the information provided in Subsection (2)(i); and
(b) annually, on or before October 1, report to the Judiciary Interim Committee:
(i) the results of any reviews described in Subsection (2)(g), if any reviews have been
completed;
(ii) reforms, to the extent that the state privacy officer is aware of any reforms, that the
designated government entity made in response to any reviews described in Subsection (2)(g);
(iii) the information described in Subsection (2)(i); and
(iv) recommendations for legislation based on any results of a review described in
Subsection (2)(g).
Section 17. Section 
77-27-5
 is amended to read:
77-27-5.
Board of Pardons and Parole authority.
(1) (a) Subject to this chapter and other laws of the state, and except for a conviction
for treason or impeachment, the board shall determine by majority decision when and under
what conditions an offender's conviction may be pardoned or commuted.
(b) The Board of Pardons and Parole shall determine by majority decision when and
under what conditions an offender committed to serve a sentence at a penal or correctional
facility, which is under the jurisdiction of the department, may:
(i) be released upon parole;
(ii) have a fine or forfeiture remitted;
(iii) have the offender's criminal accounts receivable remitted in accordance with
Section 
77-32b-105
 or 
77-32b-106
;
(iv) have the offender's payment schedule modified in accordance with Section
77-32b-103
; or
(v) have the offender's sentence terminated.
(c) (i) The board may sit together or in panels to conduct hearings.
(ii) The chair shall appoint members to the panels in any combination and in
accordance with rules made in accordance with Title 63G, Chapter 3, Utah Administrative
Rulemaking Act, by the board.
(iii) The chair may participate on any panel and when doing so is chair of the panel.
(iv) The chair of the board may designate the chair for any other panel.
(d) (i) Except after a hearing before the board, or the board's appointed examiner, in an
open session, the board may not:
(A) remit a fine or forfeiture for an offender or the offender's criminal accounts
receivable;
(B) release the offender on parole; or
(C) commute, pardon, or terminate an offender's sentence.
(ii) An action taken under this Subsection (1) other than by a majority of the board
shall be affirmed by a majority of the board.
(e) A commutation or pardon may be granted only after a full hearing before the board.
(2) (a) In the case of any hearings, timely prior notice of the time and location of the
hearing shall be given to the offender.
(b) The county or district attorney's office responsible for prosecution of the case, the
sentencing court, and law enforcement officials responsible for the defendant's arrest and
conviction shall be notified of any board hearings through the board's website.
(c) Whenever possible, the victim or the victim's representative, if designated, shall be
notified of original hearings and any hearing after that if notification is requested and current
contact information has been provided to the board.
(d) (i) Notice to the victim or the victim's representative shall include information
provided in Section 
77-27-9.5
, and any related rules made by the board under that section.
(ii) The information under Subsection (2)(d)(i) shall be provided in terms that are
reasonable for the lay person to understand.
(3) (a) A decision by the board is final and not subject for judicial review if the
decision is regarding:
(i) a pardon, parole, commutation, or termination of an offender's sentence;
(ii) the modification of an offender's payment schedule for restitution; or
(iii) the remission of an offender's criminal accounts receivable or a fine or forfeiture.
(b) Deliberative processes are not public and the board is exempt from Title 52,
Chapter 4, Open and Public Meetings Act, when the board is engaged in the board's
deliberative process.
(c) Pursuant to Subsection [
63G-2-103
(22)(b)(xi)
] 
63G-2-103
(24)(b)(xi)
, records of
the deliberative process are exempt from Title 63G, Chapter 2, Government Records Access
and Management Act.
(d) Unless it will interfere with a constitutional right, deliberative processes are not
subject to disclosure, including discovery.
(e) Nothing in this section prevents the obtaining or enforcement of a civil judgment.
(4) (a) This chapter may not be construed as a denial of or limitation of the governor's
power to grant respite or reprieves in all cases of convictions for offenses against the state,
except treason or conviction on impeachment.
(b) Notwithstanding Subsection (4)(a), respites or reprieves may not extend beyond the
next session of the Board of Pardons and Parole.
(c) At the next session of the board, the board:
(i) shall continue or terminate the respite or reprieve; or
(ii) may commute the punishment or pardon the offense as provided.
(d) In the case of conviction for treason, the governor may suspend execution of the
sentence until the case is reported to the Legislature at the Legislature's next session.
(e) The Legislature shall pardon or commute the sentence or direct the sentence's
execution.
(5) (a) In determining when, where, and under what conditions an offender serving a
sentence may be paroled or pardoned, have a fine or forfeiture remitted, have the offender's
criminal accounts receivable remitted, or have the offender's sentence commuted or terminated,
the board shall:
(i) consider whether the offender has made restitution ordered by the court under
Section 
77-38b-205
, or is prepared to pay restitution as a condition of any parole, pardon,
remission of a criminal accounts receivable or a fine or forfeiture, or a commutation or
termination of the offender's sentence;
(ii) except as provided in Subsection (5)(b), develop and use a list of criteria for
making determinations under this Subsection (5);
(iii) consider information provided by the Department of Corrections regarding an
offender's individual case action plan; and
(iv) review an offender's status within 60 days after the day on which the board
receives notice from the Department of Corrections that the offender has completed all of the
offender's case action plan components that relate to activities that can be accomplished while
the offender is imprisoned.
(b) The board shall determine whether to remit an offender's criminal accounts
receivable under this Subsection (5) in accordance with Section 
77-32b-105
 or 
77-32b-106
.
(6) In determining whether parole may be terminated, the board shall consider:
(a) the offense committed by the parolee; and
(b) the parole period under Section 
76-3-202
, and in accordance with Section
77-27-13
.
(7) For an offender placed on parole after December 31, 2018, the board shall
terminate parole in accordance with the supervision length guidelines established by the Utah
Sentencing Commission under Section 
63M-7-404
, to the extent the guidelines are consistent
with the requirements of the law.
Section 18. 
Repealer.
This bill repeals:
Section 
63A-12-100
,
Title.