H.B. 450 Data Privacy Amendments: transcript

House Political Subdivisions Committee, Feb 24, 2026

House Political Subdivisions Committee, Feb 18, 2026

1. Committee chair24:42

   Uh, our first bill up is HB four 50 Data Privacy Amendments. We'd like to welcome Representative Shallenberger to the table. Welcome. Are we on? He's on here. Yeah. It's just, Okay. There we go. There we go.

2. Rep. David Shallenberger25:14

   Okay. I'd like to welcome, uh, Chris Ba Bramwell, the director of the Data Privacy Office with me. Uh, wanted to give a little bit of a background with this before we jump into the details. This has come this, this was a part of Representative Jeff Moss's, uh, work the last couple years. And so that came through my committee, which is economic Development. This is the first time this is being held in this committee. So wanted to give a little bit of background before we jump into the details and back up. Uh, if we, if you're paying attention to what's going on out there. Uh, data privacy is a huge deal. The banks are constantly sending out alerts for scams and doing fraud, uh, investigations. 'cause it's a huge problem in our banking system. There's big billboards on the freeway, irs.gov scams or fraud. Right? Uh, I'm getting texts and calls every single day about how I qualify for a new loan that I have not yet applied for. Um, even my Republican donor list is emailing me every day, and I've tried to get off that list like 500 times now, and it still keeps coming every single day. Um, if you've not been down to our, the, um, the data, or not the data, the, the computer, the operations center in Taylorsville, they have an entire data privacy computer center where it's an entire war room where their entire goal is to protect, uh, from data attacks, cyber attacks, uh, all the state agencies trying to work with schools, trying to work with cities, uh, with counties, with the different groups around the state. And they have record over 1 billion cyber attacks every single day on our state systems. And so it's a real battle. It's a real problem. And that's where this office sort of was created. If you go back, it's a fairly new office in our state, but if you go to the state website is privacy dot Utah dot gov. It's the data privacy, uh, office. We also have a commission on our data commission. So the, the, the office is in charge of coming up with templates, reviewing rules, trying to coordinate state agencies, trying to come up with best practices recommendations. And that's where Chris Bramwell is brought in. He has a, a six person office there. Uh, and then, yeah, we have the data privacy, uh, commission that includes five people. Uh, Senator Comore from the Senate. It was Representative Jeff Moss. I've replaced him on there. Uh, we have Dan Burton from the Attorney General's office, and Tina Cannon from the auditor's office, and then Marvin Dodge here with the state. And so they, we meet, uh, once or twice a year reviewing the recommendations, reviewing the different issues, and, um, uh, making rule changes based on that. Uh, so that sort of brings us to where we are today as Chris Bramwell has helped work on this, on this bill every year, the last couple years that we've come with recommendations. Uh, this is not targeting, I know I've talked with my local county sheriff and some of the law enforcement groups. They feel maybe that they're targeted out or, and being targeted in this bill. I wanna recognize that. I've talked with Representative Gwynn on this and he has some concerns. We've continued working through those concerns with, uh, the law enforcement agencies on, we had a sub drop, I think it was yesterday or the day before, over the weekend. But we are continuing to work on this to resolve any concerns and make changes until they feel comfortable. So that in my sheriff down Utah County, Mike Smith, he feels like he's not having to try to catch bad guys with his one arm tied behind his back. And so I would love, like to have, let me find one paper. There we are. So, as a quick overview, I wanna just highlight some of the key points that this bill does, and then I'll turn the time over to, uh, Chris Bramwell to Chris to highlight some of the details. Or maybe if he feels like I didn't cover something, then he can jump in and cover that. And then we'd love to get any comments or questions from, from you. But this is, what this does is we have the governing data privacy, um, act, trying to move any at-risk employees. Oh, I wanted to highlight this. This was one of the things they've done before we jump into the bill. They've created this privacy program framework. One of their tasks is to go from all agencies. And if you start looking at this, this is available on their website, it out outlines. They've created a skill. And I grew up in the, the, my dad worked for Covey Leadership Center, seven Habits. And we grew up with the phrase, good, better, best, never let it rest till the good gets better and the better gets best. And that's where, uh, his office came in. When they were started four years ago, there was no data privacy as sort of on the forefront in any of our offices. Paperwork was laying around, or his grandma's grandma request came in and he's created a scale. Their offices created a scale from zero to five, good, better, best. And he's continued to work and establish a framework as they work through the different offices, trying to get them to from good to better until we get to best. And that's what our bill does, is help, help change some of this as we move along the process and work with the different agencies. Um, do you want me to just turn the time over to you and you can just jump in? Or do you want me to highlight some of this stuff so quick? As it, as it goes through, as part of the privacy commission, it's gonna restructure some of the people in there, update some of the codes. Um, it expands the duties of the data office to expressly authorize it to partner with higher education, which it wasn't before. Uh, to continue to develop data. Government governance models, uh, do guidelines to the different agencies. Uh, and then it's well as create any exemptions that may come up. Uh, there's a complaint process. If, if any citizens or people feel like, uh, their data is being breached or, or violated already on the state website, you can make a complaint. This is gonna simplify that and make it so that instead of going to an ombudsman that's in the data privacy office, it would go to that agency first. Uh, and if they can't resolve it, it then works its way up to their office. Uh, also with reporting it, this is gonna add some clarifying requirements in the reporting as well as training guidelines. Right now, the training guidelines were that the, the data privacy office had their training systems. And every employee across the state would have to take a data privacy training course. Uh, it's also gonna now gonna be optional that it can just be handled with their own training materials in that department. Uh, the reason we may have some law enforcement here is we have a new section in here for, uh, it's called right now, it's called Truth in Surveillance, is just to make sure that technologies that are being used, not just in law enforcement, but in any of our communities in parking garages, uh, as you enter buildings with cameras. So data, facial recognition, uh, that in any of these areas, that if you're using these technologies that, that there's a disclosure that's being used, that you're at least telling the local cities or the counties or the people in those communities, Hey, we're using this technology in this community. Uh, you don't need to give 'em how you're using or the, uh, or the different methods of, uh, how it may be actually implemented. But just that it's being used. And one of the recommendations I've had with Representative Gwynn, I'm pointing to an empty chair 'cause he's not here yet. Um, but he is actually online. Oh, good. Thank you. Representative Gwynn. And, uh, one of the questions he's had is making sure that, uh, with the disclosure stuff, he said, well, we already disclosed some of this and is in our annual budgets. If that's the case, then great, that would count, uh, during the annual budgets as part of the disclosure that maybe a license plate reader or facial recognition or other technologies are just being disclosed. Hey, we're using this in our community. That would be for city council or higher ed, or our counties or different groups. Um, and I wanna recognize he, he, the law enforcement or Representative Gwynn was, he was, uh, a little bit frustrated with the initial draft when it came out. I wanna express my commitment and our commitment to continue to work with law enforcement as we work on the next substitute. Also, uh, to make sure that we get to a place, a balance of this, where they feel like they can still do their job and not be handicapped by these rules or these guidelines. Uh, but we get to a place where, uh, there's a balance there and, but also take a step back and realize that this bill is significantly more than just, uh, a law enforcement or technology thing. It covers data privacy across the state in all agencies and helping to protect citizens and make sure we're using best practices in all of our agencies trying to protect the data breaches and, uh, our information from the bad guys. I would like to have Chris, uh, comment, fill in any details I may have missed. And then, uh, that would conclude our presentation after he is done.

3. Christopher Bramwell, Chief Privacy Officer34:52

   Uh, Christopher Brownwell, chief Privacy Officer and Director of the Office of Data Privacy. Um, this is obviously a new committee. This bill's coming before in the past, uh, Representative Moss had to, had to go to, to some other committees. So I just wanna make sure, uh, strategy wise, everyone's aware of where are we and, and where are we actually going based off of the, the work previously led by Representative Jefferson Moss and Senator Kirk Kalimore. Um, it was about four and a half years ago when privacy really got going in the state. Uh, after a few incidents from, from different entities, um, that the legislature required, we, we assess how are entities doing statewide. And so if you're not aware, grandma, when it came out in 1991, was actually supposed to be where you balance privacy, transparency and use of data. And what we identified was that for the most part, we focused a lot on transparency, but we actually haven't done the privacy components. And that's why GDPA was created because when you deal with 30 years of what would've been non-compliance, and, and it wasn't intentional, just people didn't realize really what was in grandma. And we built robust processes around transparency. But other aspects of what had been in grandma are examples of disposition of data you're supposed to dispose of all personal data according to retention schedules. That's generally not happening nationwide, not just in Utah. Uh, grandma Part six has privacy requirements where you're supposed to give notice of purpose and use of all data, and then you're restricted to use the, the, the, the data for those purposes and uses. Most entities had never given notice of purposes and uses of data according to grandma. And, uh, other examples, grandma has, uh, requirements for having a process. So individuals can request to amend and correct their data. And most systems hadn't been built to comply with that. Uh, additionally, grandma has requirements. So at risk employees, those who's, if their personal data is made public, they could be targeted for crimes, uh, for law enforcement, for judges, for others who are in these high profile cases, they're supposed to be able to make their data private. So it's not disclosed, not all entities were aware of that. So the GDPA was created to be where these requirements are modernized and then pulled into the GDPA to make them new so that we can start this decade long journey of modernization. So at the end of a decade, we actually do have robust privacy programs across all governmental entities. And all the requirements are consolidated into one act. So members of the public and government entities have one place to go and know, one, what are the individual's privacy interest, but then what are the obligations of government entities, their duties that we need to help mature these practices. And so throughout each year, after each session, we, we work a lot with all the governmental entities. We work with uac, ULCT, um, higher ed K through 12. We have the privacy governing board mentioned. We also have a privacy commission that has representation from the public and from government entities where these complex issues are worked through. Um, I also wanna make sure everyone's aware. Utah is ahead of every other state on this issue. There is no doubt about that. Utah is the only state with comprehensive government data privacy law. So while there's a lot to work through, Utah should be very proud of the progress we're making. And this, the structure of coming back each year to make incremental changes based off of what's working or not, is the right structure, because nobody actually knew how to do privacy before. So it requires this approach because it's very difficult to legislate and say, this is exactly what's gonna work and leave it alone when it's never been done. We don't know if those things in legislation works. So that's why we come back every year based off of feedback from entities to actually, um, you know, make these changes every year. Um, the only two specific things I wanted to highlight in the bill, actually, there's three that are carryovers from previous years. 'cause sometimes one year we start a change in a bill to prepare for a change that's gonna happen in the following year. 'cause it takes time to do these. So you'll notice this year the bill does have a big change where it pulls over almost the entirety of what was previously in, uh, section 3 0 3 in Grandma for, uh, private information concerning cer certain government employees that pulls this entirely into the GDPA. So requesting to make your information private, that that's a direct privacy duty. So this is an example of pulling something into grandma or now we can do better to educate all governmental entities on this duty and help them have processes to come into compliance, which are, our office has already started preparing, coming out with templates and tools. But now entities can for the first time, be made aware of it and we can work through, are there issues in this section and come back next year to clean it up to make sense in the digital age. 'cause most of grammar was written for the paper age, not how we use data now. Um, another example I wanna pro, uh, provide is in the Ombuds process. Um, the Ombuds was created to be a pressure relief valve because we know the current state of non-compliance and citizens have some valid complaints or grievances. Um, this year, the bill, uh, makes, uh, changes so that those complaints first now go to governmental entities to be able to handle and resolves themselves similar to the grammar process. Um, it's not perfect. I anticipate it'll take a few more years to work out what is the proper complaint mediation process. Uh, but this bill does clean that up and we've worked closely with entities on that. And then the, the last section I wanna reference is the section currently titled Truth and Surveillance. Um, last year in the bill we were able to, uh, build in some notice requirements that are specifically for law enforcement. 'cause while law enforcement, uh, ambulatory services, there are other things government entities do where they can't give direct notice of individuals as was previously required. Ingram part six, anytime you collect or request personal data, obviously if there's an emergency and somebody's laying on the ground and an ambulance pulls up, you can't give that. You don't wanna give that person notice. You need to, uh, give them aid. Um, so the truth and surveillance section was part of a building off on that concept of, we know the law already requires to give notice anytime you've request or collect personal data, but there are certain things government does where they have to collect data, where they're authorized to collect data, personal data, but there's no mechanism to give notice. So this was an attempt to say, what is that process by which you can give a general public notice and have input and have that amount of data collection happen when you can't give direct notice directly to the individual. Um, and so that's high level, I think the big changes in the bill and can answer any technical questions.

4. Rep. David Shallenberger41:23

   So, uh, that would conclude our presentation. We'd be welcome. Uh, we'd welcome any comments or questions.

5. Committee chair41:31

   There is a substitute on this building.

6. Rep. David Shallenberger41:32

   Yeah, we, oh, yeah, I forgot to mention we're there, we're, there's been talking towards, uh, the first substitute that's online.

7. Committee chair41:38

   Okay, great. We will go to the committee for clarifying questions. Representative Hansen.

8. Rep. Leah Hansen41:44

   Thank you, Madam Chair. Um, I appreciate, well, I haven't looked at the substitute. I don't know if I have, but, um, subsection 11, A and B where, 'cause I'm not a fan of rulemaking authority, but the fact that you're using rulemaking authority for your own commission members is, um, something I'm really pleased about. So, um, but why remove the auditor? Remove the auditor for support of the commission or,

9. Christopher Bramwell, Chief Privacy Officer42:16

   Yeah. Um, currently our office does, um, a lot of the background work for the commission. So when it comes to education, training materials, other things needing to be done for the commission. Uh, so it's turned into not just be support from a taking minutes perspective, but it's actually helping to facilitate the commission's work and duties. Um, now also with the commission, the commission needs to create standards and best practices. And, uh, you shouldn't be creating the standards and best practices that you're then auditing against. So there's been a big focus on how do we get the right governmental entities on the commission. Um, and keep in mind, most of these are volunteer members. They're not full-time employees. So our hope is with us being able to support them, we can do the back, the backend work with our staff to draft standards and best practices that they want, that they have authority to create, and then we can bring them to them and they can, they can hone them. And then those become a general, that government entities can't be forced to adopt them, adopt them, but those who do want to adopt them, those could then be what could be audited against.

10. Rep. Leah Hansen43:21

    So thank you. I also appreciate your complaint mediation process, so thank you.

11. Committee chair43:27

    Okay. Thank you Representative Gwynn.

12. Rep. Gwynn43:32

    Thank you. And I, uh, appreciate, uh, my discussion I had with Representative Schoenberger yesterday, and I look forward to continuing the conversation. Um, a couple questions I had is, you know, during the opening of the presentation, there wasn't any remarks about potential breaches of privacy as it relates to law enforcement. So, uh, Mr. Bramwell is probably in a better position. I'm just wondering if he can speak to how many breaches as it relates to privacy have been in law enforcement in the state of Utah recently.

13. Christopher Bramwell, Chief Privacy Officer44:01

    Our, our office actually does not receive, um, any breach notifications from any entity. Um, so I actually am not, um, I'm not made aware of when actual breaches occur for any entity. Those actually go to the cyber center and then the attorney general's office.

14. Rep. Gwynn44:19

    Okay. And I don't know if they're here, but maybe we can ask them if they come speak or against the bill. But my next question is, is right now, officers routinely go through training and testing as it relates to privacy through, uh, BCI. Is this gonna move that under the umbrella of your office?

15. Christopher Bramwell, Chief Privacy Officer44:37

    Uh, no. So what is in the bill? Currently, all government entity employees are required to complete annual privacy awareness training. And last year's version, it required our office to create training that all entities could use, or they could get an exception to provide their own training. So what entities requested this year was that they would like to be able to just provide their own training without going through an exception process, while still requiring our office to provide training for those who want to use it. So this bill still requires us to create generally applicable privacy training that entities can use to meet their training obligation. But every entity now has the authority to create their own training program without having to obtain approval from our office that still meets the applicable privacy requirements.

16. Rep. Gwynn45:22

    All right. Thank you. And then one more question, if I may. Madam Chair. Um, high risk surveillance, I have not seen the substitute is high risk surveillance defined in the bill.

17. Christopher Bramwell, Chief Privacy Officer45:35

    High risk surveillance is actually, uh, taken out In the sub Of the sub. I don't believe that term is used anymore, and it should be removed from the definitions. Um, the strategy that's been at play is using, uh, there's high risk things government must do, and only a small subset of them are things that would even be law enforcement related. Um, so the attempt is, should I say, what are they high risk things that government does that you want to ensure there's the proper rules and guardrails around whereas other, there's lots of other common things where government does just business and processing data. Almost every government service requires collection of data. But that, that term high risk surveillance, I believe has been removed from the bill.

18. Rep. Gwynn46:21

    Okay. So I will, I will say that, um, you know, law enforcement agencies are pretty good guardians as it relates to privacy data. We acknowledge that a lot of the data that we collect we're responsible for securing. We also acknowledge that a lot of the data that we collect or could potentially release doesn't actually belong to us. And law enforcement goes through a, a, a pretty significant redaction process before anything leaves their offices. And so I just want the committee to be aware of that. I don't know how this would impact that. Um, I'm also just getting information that there's information in the bills in the sub currently that still relates to high risk stuff. I'm still not in a position to actually read it right now, but I'm being told light in 10, and, you know, we are going to guard adamantly and vehemently operational tactics. Um, and so I'm concerned that there's gonna be information as it relates to operations and tactics that could put lives of not only officers at risk, but lives of those that we seek to protect and or detain at risk. And I don't know how the bill currently is going to impact that. Lastly, um, I appreciate, again, Representative Chew Berger's comments about what a city council may or may not know what they should know and what an administrator should have to go through. Uh, you know, as it relates to, um, surveillance equipment. Um, you know, is the council in a position to understand the role and responsibilities of law enforcement as it relates to surveillance? Um, is a, is an administrator gonna have to go get permission anytime they wanna do surveillance or is just asking to purchase the surveillance equipment good enough? So these are all questions I have. There's a lot of impact on law enforcement here. Um, I know that there's other bills coming down the pipeline as it relates to surveillance equipment. And so I'm a little concerned that there's a multitude of bills that are being used as vehicles to get into this space, and it's really hard to keep, uh, keep tabs on 'em. So those are just my comments.

19. Committee chair48:33

    Hey, thank you Representative Arthur

20. Rep. Gwynn48:37

    Need, uh, would, uh, Christopher be able to respond to Yes, go ahead. Question. If that's okay.

21. Christopher Bramwell, Chief Privacy Officer48:44

    We, we have talked to stakeholders to, um, to discuss that balance of operational and tactics versus what is meant to be encompassed within privacy. And so the, uh, the strategy here is ensuring one, no data should ever be made public that would be private or protected. So already you have in grandma, uh, you can have, um, make data protected when it relates to security and, and other aspects of safety. Um, there's been discussion of ensuring that any transparency process around these activities where you collect data and you can't give notice, um, it should be on a categorical basis. So it's not a every time an instance happens, but it's if you're generally collecting data on people and it's not individual individuals who are, uh, under investigation or there's some reasonable su su suspicion, but it's just generally on the community, are you collecting this? And this is not just law enforcement. Uh, there's k to 12 districts that implement facial recognition. It's been implemented on buses for students. So it's, um, the goal is categorical. What is the process by which the right pupil at least authorized or there's notice given, but it should no time delve into the actual details of information that should either be protected or would be some sort of trade secret or something that, that should not be made public because it would negatively impact public safety or some other aspect of government services that shouldn't be public.

22. Committee chair50:13

    Okay. We'll go to Representative Arthur now.

23. Rep. John Arthur50:16

    Thank you Madam Chair. Um, I'm curious about the, you know, within the truth and surveillance section, you know, when when there is a grammar request, there's usually a notification that, you know, information has been sought. Is there any process by which, let's say someone has been surveilled in some way, that they are notified that they have been surveilled? I know that in here it talks about, um, public notice of implementation of technology by a state agency, but is that ever communicated to those who have been surveilled?

24. Rep. David Shallenberger50:55

    Um, Well, as Christopher mentioned, if it's a, through a warrant process or the law enforcement process that's handled on their end, and this is not gonna meddle with that, especially as, uh, representative go questioned in their operational tactics, that's in their realm and they handle that separately. This is meant to disclose if these types of technologies are being used and, and to the point. I, I don't know if it's still in there, I can't find anything that mentions high risk activities. Now we're continuing to work on the next version. And so if it is in there, we'll work on that. Um, but any of these technologies that are gonna be used in our communities or our schools or parking lots or any of these areas, uh, having at least a disclosure coming up, whether it's through a budgetary process in their annual budget review or just a reporting process, just saying, Hey, these are the things we're gonna be using in our community or in this area. Um,

25. Rep. John Arthur51:57

    Do you mind if I ask a follow up? Madam Chair? Go ahead. So just to, just to clarify, government agency wants to, to use this surveillance technology, they have to have a public meeting at which they inform the public that we are considering the use of this technology. Am I correct? And then they vote on it, it's the governing body, like the legislative body, like a city council, whatever. And then once the technology is actually implemented though, um, is the public informed of the, both the data collection as well as the usage of the, of the data,

26. Christopher Bramwell, Chief Privacy Officer52:32

    Um, is it okay if I respond partially to the first question and that Yeah. So you'll notice in line four 10, uh, Utah is unique in our strategy in that, um, that whole section is the Utah pri, uh, data privacy policy for the state. So this outlines, what is it we're trying to move toward? This doesn't have, uh, any, uh, enforcement that entities comply with, but this is the vision. And so you'll notice that it acknowledge, acknowledges there that there are activities that entities may collect personal data for which notice can't be given. Grandma currently requires notice be given for any, uh, information you request or collect. Not just that you request, but if you're collecting it. So the truth and surveillance section is meant to provide a mechanism for those situations where the legislatures authorize the use of technologies that are not capable of providing direct notice. I mean, you could maybe say, put signs on every street and on every bus and in every facility, but that's not rea really a reasonable notice. So that lays out the vision of some other process by which, at least in a public meeting, just like you do with Truth in taxation or, or any public meeting, it's meant to be there to allow the community to engage and community involvement. So that's the vision for it, and acknowledging we've moved forward with technology that can collect data, but it can't actually comply with what was in grandma and now GDPA. And then this is building out that process of what we think is a reasonable government process to still allow acute community involvement, allow comments, but ensure there's actual local control. So if the legislature said this technology can be used, then locally, they would decide in their community do they want to actually then use it? And that meeting should act as the, the mechanism for which there is, is notice given and there's input provided, and then it would be in each community they decide what's the culture of their community when it comes to different types of technologies.

27. Rep. John Arthur54:21

    Okay. So just to clarify, with this new section starting about four 10, right? In the, in the sub, it's about four 10, currently, the state shall incur the ability of the government entity provide clear notice to an individual regarding the government till entities processing of the individual's personal data. But now we're adding in for the processing activities for which an individual's personal data may be collected without the ability to provide direct notes. So we're, we're going from there will be clear notice provided to, uh, where possible. Is that correct?

28. Christopher Bramwell, Chief Privacy Officer54:59

    No. Okay. Uh, so keep in mind that's just the policy statement, guiding them the duties of governmental entities. Okay. So if you go into, uh, uh, part four that outlines the duties of governmental entities, you'll have 4 0 4 0 1 through through 4 0 8. So in 4 0 2, there is a specific notice section. So, uh, a requirements to give notice. And so that's where we've modernized what's already in grammar for giving notice to individuals. When you request or collect personal data, you'll notice in that section, we've already billed out last year some allowances for those services that you can actually give direct notice. So I already gave the example of ambulatory services. There's no way that you're gonna say, well, let me give you notice first, or in law enforcement, there's an exigent circumstance and an emergency happening and they need to engage. It may do more harm to give notice in those situations. Mm-hmm. So what we're trying to, to acknowledge is those, there are situations where you can't give notice. And in some cases, even in state law, the legislature has required some of these processes to be in place, and there's no way to give notice to every individual. So what we're trying to build out in GDPA is what is this process then of the right ways to give notice given the current state of law. So what this, what we're doing here in Truth and Surveillance is further building out that process for technology that that's already been authorized by the legislature for use, but provide a mechanism for all government entities, whether it's law enforcement or K through 12, that's using them to still have a reasonable process to give notice and then allow public participation when it's, it's not actually practical to say to every individual. Here's notice.

29. Committee chair56:38

    Thank you. Yep. I am representative Fati Manu.

30. Rep. Jake Fitisemanu56:45

    Thank you. Uh, the fiscal no-shows of modest cost, um, impact on local governments. It's a cost nonetheless. I mean, can you help us understand what activities or, um, expenses then would be taken on by local governments under the bill that aren't currently being incurred?

31. Christopher Bramwell, Chief Privacy Officer57:02

    Yeah. You, you'd have to provide notice. So facilitation of any public meetings and discussion, you have to do notice, you have to do minute taking. So that's part of any transparency process that you'd have to facilitate that government entities are already required to include. Um, as part of our multi-year strategy, every entity has to now start preparing annual privacy program reports to track the maturity of their program so we can start tracking over time are our strategies actually working? So they do already have to track these type of activities, high risk processing activities in the report, so we can inform the legislature of what is actually being used statewide. So that's already something they would have to do. It's not an extra cost to occur, but some entities weren't aware that that was already required in code. Um, they would have to identify in, in the current state of truth and surveillance, you know, what's the purpose and use of these systems, um, how are they gonna govern these systems? But these are, again, actually things that are required in code. When you give notice under grammar, you're supposed to give notice of what your purpose is. And use is, we'd assume government is gonna plan for any new system, how they're gonna govern the system. But documenting that does, uh, require some resources to do so. Compliance with this, of course, there's gonna be a time cost, uh, hopefully it would be able to be absorbed, but some entities we are aware are very proactively hiring. If you're a large enough entity, they're hiring full-time privacy managers. I know Salt Lake City's done that. Utah County has worked on that. Uh, Salt Lake County has processes in place. So there are entities that when they're more complex, are incurring costs to comply with these requirements.

32. Committee chair58:38

    Okay. We will go to the public now for comment. Is there anyone here from the public that wishes to speak to this bill? Okay. We've got four people. We'll just have you come up. If we can get one going and one on deck, that would be great. Just be sure to, uh, state your name and the organization you represent. We also have four online. Okay.

33. Jared Tingey, Utah League of Cities and Towns58:59

    Thank you Chair Members of the committee ing with the League of Cities and Towns. And first and foremost, we want to thank, uh, Chris Bramwell as well as, uh, Representative Shallenberger for, uh, working with us and, uh, being willing to take our, uh, changes and, um, continue to work with us on that language. Uh, conceptually we've worked over the interim well, uh, more than just the interim, uh, two or three years working on a process. And I, and we've always, uh, found the office of data privacy to be, uh, responsive and, and helpful in there, um, guidance of that, uh, language and, uh, hope to continue to work on that language moving forward. Thank you.

34. Ashley Spatafore Mirabelli, Utah Chiefs of Police59:47

    Thank you. Hi, uh, Ashley Spa Mirabelli, uh, representing the Utah Chiefs of Police. Uh, I, first of all, I wanna thank Representative Shallenberger. There's, there's been a lot of, uh, work from where the bill started and, and, and where we're moving. Um, but I will say that, that we do still have some concerns. And I think representative, uh, Gwen outlined a lot of our concerns. Uh, I just wanna, I wanna touch on a, a few of the bigger points. Um, the, the Truth in surveillance section I is problematic for a couple of reasons. And I think the title is very concerning, right? Because it, in, it, it in it infers that law enforcement is surveilling and that is not how we are using these technologies. We are using them, uh, in, in law enforcement and criminal situations. And so I think that kind of colors that whole section and, and I think really causes a lot of consternation. The, the legislative process. You know, I think this should be more of a administrative process or a reporting process, because there should be acknowledgement that these, these, these technologies are being used. But like Representative Gwen Notif, uh, said, uh, if you have, as it's drafted, the requirements that are put there in code in a public and open process, you're gonna, you're gonna reveal operational tactics of how you are using these technologies. And so I think that's concerning. Um, the other big pieces are, are the definitions. Uh, high risk, uh, high risk is still in there. It's in the current definitions, high risk use, um, as well as persistent. Uh, so high, high risk use is still in the, in the draft, high risk processing, I'm sorry, is still in the draft. I think that is concerning as well as definitions like, uh, persistent, persistent aerial surveillance, right? And I think this is referring to drones, but drones are not used to persistently surveil. Uh, if you, if you go to, uh, section in code seventy two, ten eight oh two, there are already very clear outlines how we can use, uh, drones for law enforcement purposes. So, and it'll sum up by saying we appreciate the direction that we're going, we still have a lot of concerns, and we hope working with Representative Shallenberger that we can answer some of these questions and, and resolve some of our concerns. Thank you.

35. Committee chair1:01:50

    Okay. Thank you. Representative Ward had a question.

36. Rep. Raymond P. Ward1:01:54

    Thank you, Madam Chair. My question actually was for the League of Cities and Towns, just the last thing that you come back up, if you would for just a second. Thanks. Just the last thing you said was that you continued to, you hoped to continue to work with Representative Shallenberger on the process going forward. Did that mean that there are particular issues that you think need to still be resolved? And if there are, just could you say what they were?

37. Jared Tingey, Utah League of Cities and Towns1:02:18

    Yes. There, there are. Um, I would need to go back to my actual, uh, red line of the edits, but, um, mainly just language tweaks as well as some of the things that have been brought up already by Representative Gwynn and, and the law enforcement agencies. Um, mostly the law enforcement, mostly the law enforcement. There are other, uh, there are other, but mainly just language, uh, tweaks that need to be made.

38. Committee chair1:02:45

    Okay. Thanks. Yeah, Thank you. Go ahead.

39. Jason Chipman, Libertas Institute1:02:48

    Thank you, Madam Chair, members of the committee. My name is Jason Chipman. I'm the policy director for the Libertas Institute, uh, here to testify in support of House Bill four 50. Uh, we're in support of the whole bill, but I would, I just especially wanna sp speak to the part about truth and surveillance. Uh, facial rec systems, license plate readers, cell site simulators and aerial surveillance are powerful tools that are used to assist in investigations and help solve cases. But that's not in question. The question is, who authorizes this use? Under what limits? With what transparency and accountability? Uh, this provision simply requires that before these tools are implemented, the decision is made in an open public meeting by elected officials. The intended uses must be disclosed, disclosed, the categories of data sharing must be disclosed, and the continued use must be reviewed periodically. This is not anti law enforcement. This is proac accountability and pro-public trust, and the public actually agrees. Uh, recent polling by Overton Insights asked this specific question, do you support or oppose requiring state or local governments to hold public hearings before implementing or expanding surveillance technology such as facial rec or license plate readers? And it showed more than 80% of Utahans across every demographic and every political party agreed with this question. So it's not, uh, it, it's not a question of if it's, it's a question of yes, it's not really a question. They want it, uh, in a time when trust and institutions are fragile. Uh, transparency strengthens legitimacy. When people know these decisions are debated openly and approved by their elected representatives, it reinforces both public safety and constitutional guardrails, even if they don't agree with the policy. Uh, there's lots of things government does that I don't agree with, but I appreciate the process that they do it openly, and I can live with that. As we approach the 250th anniversary of our nation's birth certificate, we're reminded of a core American principle. Government derives its authority from the consent of the governed. This provision ensures that powerful surveillance tools are used with that consent and not in spite of it. Thank you.

40. Committee chair1:04:53

    Okay. Thank you. Is that, uh, one more? Go ahead.

41. Carl Hollan, Statewide Association of Prosecutors1:04:56

    Yes. Thank you. Uh, Madam Chair, members of the committee. My name is Carl Holland. I'm the Executive Director of the Statewide Association of Prosecutors. Uh, we haven't met directly with Representative Shallenberger. We've, uh, been monitoring this bill, uh, as our law enforcement partners have been working with him. Uh, but I did think that it was appropriate to get up today and to express some of maybe the concerns that we have as well with the truth and surveillance portion of this bill. I think that it's apt to recognize that the 250th anniversary of our nation is coming up and our nation is founded on a series of checks and balances, uh, that balance the way that government operates and the different branches operate with each other. I'm not familiar of any other portion of law that would inject the legislative branch into this sort of law enforcement activity the way that this does. And that's, that's one of the things that we're concerned about as prosecutors when we look at this from the back end, uh, where this would end up in court if we were using some of the evidence that might be obtained through these technologies. And it was challenged by defense counsel. The injection of local legislative bodies into this process really confounds our ability to address this issue in court. Do we have to subpoena the local legislature, the city recorder, the people to make sure that the Open and Public Meetings Act was properly complied with? This is a requirement that we don't see in any other area of law enforcement use of technology. Indeed, prosecutors kind of have an interesting perspective because from time to time, we do review law enforcement requests to use certain technology or certain tactics in their search warrants. So they'll draft a search warrant, and for instance, they will ask for permission from a judge that that search warrant can be served at nighttime and without knocking and announcing first law state law requires that a prosecutor review that for legal sufficiency before that can be presented to a judge who then reviews that also for legal sufficiency. But the question of legal sufficiency is not one of appropriate use of the tactic. It is whether or not the legal requirements that are set forth in the legislature, uh, have been met before that tactic is employed. And that's our concern here. The insertion of local legislature into the process doesn't seem to be one about whether or not the legal requirements that are established by the state legislature have been met. It appears to be one of whether or not it's appropriate to use this technology on a tactical level. This is just something we don't see. And it really upsets sort of this balance, this checks and balances process. Uh, I think that it creates confusion, uh, about the admissibility and it's going to create confusion about how to address suppression. So we would look forward to working with Representative Shallenberger and having him work with law enforcement partners, but we are concerned about sort of the legal framework that this creates, uh, through his creative approach to try and resolve the issue.

42. Committee chair1:08:12

    Hey, thank you. Thank you.

43. Ronald Mortensen, resident1:08:16

    Uh, Dr. Ronald Mortenson PhD and I'm speaking on behalf of myself. Uh, as you know, Utah State and local governments collect tons of our most sensitive, personal identifiable information, often without even letting us be aware of it. For example, the state collects all of our medical insurance claims complete with our social security numbers and diagnostic codes, but they don't tell us that they're collecting it. They then give a copy of our insurance claims to the University of Utah. And our most sensitive medical information is then used without our informed consent for everything from medical research to furthering economic growth. So that brings me to a problem in HB four 50, and I'm looking at the first sub and on lines 8 26 2 8 30, it makes the entire privacy program report a protected record. Now, a good argument could be made for protecting the information on lines eight 11 and 8 23 to 8 25. Since the public releases, this information could threaten da, uh, data security. However, the information on lines eight 12 to eight 18 should be public since it lets us know what government is collecting on us, who our information is being shared with or sold to, and the legal basis for doing that. Therefore, I'd hope that maybe the bill could be amended to make at least that portion of the inform, uh, the report available to us. After all, we have a right to know what government collects on us and what it is doing with our most sensitive information once it has it. Thank you.

44. Committee chair1:10:03

    Thank you, representative Gwen, did you have a question for one of the witnesses?

45. Rep. Gwynn1:10:10

    Uh, no. I believe that was from earlier. Sorry.

46. Committee chair1:10:13

    Okay. Uh, Representative Ward does Go ahead.

47. Rep. Raymond P. Ward1:10:17

    Thank you, Madam Chair. So the points that you brought up that this is a different process and, and create some other troubles for you. Is there a way still in your mind that the underlying objective of the bill that the public can know in general, which surveillance technologies the government is choosing to use, and where, is there a way that you feel that that objective could still be reached, uh, even using something different than this process? Or do you think that those two objectives of what law enforcement needs to do are just incompatible with the public knowing even what kinds of surveillance technologies are being used? Does that make sense?

48. Carl Hollan, Statewide Association of Prosecutors1:10:56

    It does make sense. Thank you for the question. Uh, I think that this hearing and this setting is exactly the type of place where those decisions are made and where the public has the opportunity to hear about what is happening and to participate in that process. The Setting, setting evening this room or the city Council in this, in this room right here, uh, where the state legislature can set, uh, proper guidelines and guardrails. So maybe going back to the example I had previously used of nighttime, no-knock warrants. There were legislative hearings and state laws that were passed at this level that said, this is, these are the boundaries where we are going to allow these, uh, tactics to be used. And in the same way, it would be appropriate for the legislature to say, these are the boundaries and the guidelines that we are going to give for law enforcement to use certain technologies that would be appropriate. The odd part about this is that the legislature now is considering the issue, but then it's also injecting local legislature not to address the legality of what is happening or to establish statute about that, but to really address whether or not specific implementation is appropriate in that community. And that is different from setting perhaps constitutional guardrails on it, like might happen at this legislature. Does that make sense? Representative? Yes.

49. Committee chair1:12:26

    Thank you. Okay. Thank you. We're gonna go to online comments. We have six people now that are commenting. So I'm gonna set the timer for a minute and a half. Minute and a half. Ask that you keep your comments brief and, um, and not repeat things we've already heard. So we'll go with, uh, Steve Mc McCann first.

50. Steven McCown, resident1:12:51

    Yes, thank you. My name is Steve McCann and I work in the digital identity industry and I'm re representing myself today. I'm also one of the volunteer commissioners on the Utah Privacy Commission, and I'm speaking in favor of this bill. Thank you for putting individual privacy First. U Utah has become the most proactive state in protecting individual privacy, and it gets global attention. One of the most impressive things I saw a few years ago when I joined the commission was Utah's willingness to self-reflect. And there was a report put out where all the, uh, data that was collected by state websites was, um, it highlighted how that data was being, um, tracked and sold to data aggregators in order to help pay for those websites. And seeing that problem, Utah started fixing it. There's a number of other problems like this and, uh, the state, um, has the opportunity to protect those. A few years ago, or a year ago, a few of us, um, privately started the No Phone Home Petition website where we looked at how Utah and, um, other states and nations were collecting usage data on the mobile driver's license, and, um, how that could be used for international or state surveillance. A as we highlighted that am VA, the association, um, uh, overseeing driver's license policy went about changing that. And could you please wrap up? 'cause we brought light to that. It was able to be changed.

51. Committee chair1:14:28

    Thank you. Um, next we'll go to Timothy Ruff. And just as a note, when you hear the first time, you've got 15 seconds to wrap up. Go ahead, Timothy.

52. Timothy Ruff, Digital Trust Venture Partners1:14:40

    Yes. Thank you very much. Timothy Ruff. I live in Bluffdale. I'm a partner in, uh, digital Trust Venture Partners for Venture Studio. We focus on cybersecurity and digital identity technologies. And in my role, I get to see technologies that are adopted all over the world for digital identity. And every one of them have the ability to track and surveil except for one that happens to now be advancing through the, um, through the Senate committee for the state of Utah. But every other one has this ability. And what I've noticed as I'm interacting with people around the world is that, um, tracking and surveillance is actually not inherently bad. It's not inherently evil. It can be very useful. And even for the citizen citizenry, it's really a cultural thing where some cultures are totally fine with it. Um, they actually expect it in some places. The problem, however, that I've run into is when a society's about to get it and they don't realize it. And this is what's happening in the digital identity space. And so, uh, as Steve Mcow just mentioned, uh, he and I actually collaborated on a, uh, a campaign to help notify some of these, uh, organizations, some of these societies around the world that the technology they're about to adopt has this, uh, capability. What I see in HB four 50 is really important because it helps shine a light, uh, on what's coming. And so that the citizenry actually has a voice and can make that choice. Um, one of the worst things that can Happen keeps, I think of Western Society is that they get a technology that has surveillance and tracking cap capability, and they don't have a way to have their voice inserted in that process. They don't know what's happening if they know what's happening and it's sold to them by the those that are, uh, enforcing it or using it, and they're okay with it. Totally fine.

53. Committee chair1:16:36

    Okay, thank you. Next we'll go to Nate Metter.

54. Nate Mutter, Law Enforcement Legislative Committee1:16:45

    All right. Uh, thank you chair committee. Uh, Nate Mutter coming to you as the chair of the Law Enforcement Legislative Committee, uh, for this committee's education. Uh, the voting members are, are eight major, uh, law enforcement entities, uh, within the state. Uh, you've already heard some concerns, uh, communicated about the, the truth and surveillance section of this bill. And, and mainly because of those concerns, the law enforcement legislative Committee is, uh, opposing the bill, um, to Utah Law enforcement is, is not afraid of transparency, uh, guardrails, um, and, and direction. Uh, the, the concern here is the potential for this to impact our ability to provide, uh, public safety services to our communities throughout the state. Um, I, I would imagine before we severely impact that we'd wanna work closely, uh, with stakeholders in order to, to ensure that this doesn't interfere with, with our duties. Um, we have a specific working group within our, our LELC that focuses on technology. We welcome the, uh, ability to work with this, uh, data privacy group, um, to, to overcome the concerns and, and bring good legislation forward, uh, that, that doesn't impact, uh, uh, negatively, uh, our ability. So, uh, appreciate it. And again, we oppose the bill. Thank you.

55. Committee chair1:18:17

    Okay. Thank you Will Sagos.

56. Will Seggos, resident1:18:22

    Thank you. Thank you. Um, my name's Will Sagos. I am here as a private citizen. I, uh, live in Park City, Utah. Uh, first of all, I'd really like to, uh, extend my appreciation for law enforcement and all that they do to keep Utah as pretty much one of the safest states in the United States of America. Uh, I am heavily in support of this bill. I think that there is a lot that will come from this that will enhance our ability as citizens to really give our voice earlier in the process. I think we all saw that backlash that that ring ad had during the Super Bowl. They pulled it immediately. I think it's pretty clear that people do not like, uh, you know, how the ideas of how something as simple as helping your dog get found, uh, can be abused in the future. I think we've seen, there's an article in the New York Times about one surveillance company that has collected everyone's income information and has been jacking up the rates and, um, kind of create a monopoly out of housing that, where they kind of go down to the local level to get this information and collect it via teleme, um, tele telemetry. And they'll basically go resell it at huge marked up rates to the states, the federal government. Um, you know, so I think this actually ends up as a massive cost savings. I think part of the way the process on how it's designed to work would actually allow the public to, uh, create the exceptions for the things that are genuinely great for public safety. I think one of my main concerns is really, you know, when these tools and devices end up in law enforcement's hands, um, making sure that the vendors that they they're using are being responsible with how they process that data, that the law enforcement please wrap up. Um, they just might not know, uh, in every scenario. And there's a lot, lot of little minute details. So I'm heavily in support this building. I think Christopher has done a, an incredible job.

57. Committee chair1:20:12

    Thank you Nathan. Curtis? Yes. Can you hear me? Yes, go ahead.

58. Nathan Curtis, Sevier County Sheriff1:20:20

    Thank you. Madam Chair. My name is Nathan Curtis. I'm the sheriff of Sevier County, uh, here in Richfield, Utah. I appreciate the opportunity to speak to this. I I also appreciate the fact that there's been a lot of good work done, but I do want to bring up a couple points that haven't been brought up. Uh, line 9 81 that says that a government entity that is not a state agency, this basically exempts state agencies from complying with this truth in surveillance as well. At least that's the way it reads to me. Um, and then there's one other issue that I have also that I wanted to bring up. Uh, in 2018, legislature put forth an amendment that allowed the legislature to convene without the govern governor's permission. In this bill, it specifically states that I have to get permission from other electeds. I'm an elected official in my county. I'm elected by the people to represent them. If I don't do the job they want me to do, they boot me out every couple of years. So the question is, if the legislature doesn't have to get permission from the governor to do their job, why do I need to go get permission from another elected official to do my job? I do appreciate the fact in this. I think there's some really good things on this. It appears to me there's two bills within the other. I'd like the law enforcement piece to have a little more, maybe we hold it for a little bit. Thank you for your time.

59. Committee chair1:21:41

    Okay. Thank you. Michael Smith.

60. Michael Smith, Utah County Sheriff1:21:46

    Hi. Good morning, Madam Chair. Mike Smith, Utah County Sheriff. Uh, I wanna thank Representative Shallenberger. He did take my call on this bill, and as you've heard, we have many, uh, concerns, especially with the truth and surveillance portion of it. Unfortunately, you know, I spoke to him several weeks ago and, uh, we we're here in committee and there was never a real opportunity to talk about these concerns. Um, we, uh, so that's, you know, you're hearing them today. Much of my concerns have already been spoken, so I won't go over those. Um, I do have concerns, um, that this place is blanket restrictions when we talk about big cases. Uh, we already have a US constitution. We already have the fourth Amendment that we operate under as law enforcement. Uh, recently in Utah County, we had a very large high profile case that I'm sure everybody's aware of, that, uh, these type of restrictions really concern me, uh, as we move forward. And I will tell you, some of the largest leaks that we had in this were actually other elected officials trying to glean data and not respecting, uh, the, the privacy of that data. So, you know, as Nate Curtis, sheriff Curtis has just stated, that is a big concern of mine. I also have a concern that it appears that, um, I was on the Personal Privacy Commission. I was a member of that commission, and now the commission's trying to, um, move away from an elected official into more of a rule making organization, which really, uh, worries me that we're looking at everybody else's checks and balances. Yet this commission is moving out on their own. Thank you. And we look forward to working further with Representative Shallenberger, but we have major concerns. And as written right now, I oppose this bill.

61. Committee chair1:23:30

    Okay. Thank you. Alright, that concludes our, our public comment section. We'll come back to the committee for, um, further questions and actions. Just as a reminder, there is a substitute to adopt, and we also have three more bills to discuss. Uh, Representative Ward.

62. Rep. Raymond P. Ward1:23:48

    Thank you, Madam Chair. I do have one other question to the bill sponsor. So this part about what has to be disclosed in the open and public meeting, right? Uh,

63. Rep. David Shallenberger1:23:58

    I'm sorry, say that again. This

64. Rep. Raymond P. Ward1:23:59

    Portion of the bill that talks about the open and public meeting, about, about what has to be disclosed here, um, about these different technology is, um, how detailed does that have to be? I mean, it seems to me that if you took those exact words on the page, um, at a pretty general sense, you could get through the meeting and meet the requirements when, and no one would be the wiser about what was happening. I mean, a description of the technology to be implemented, you say, well, we have some cameras that could do facial recognition, uh, somewhere somehow. And I mean, do you have to say which buildings you're gonna put them on, which cars you're gonna put them on? Do I, how detailed is this report?

65. Rep. David Shallenberger1:24:38

    No, uh, just the disclosure notice and like with Representative Gwen, in my discussions with him, he mentioned just in their annual budget, this is where it would naturally come up. Like, we're gonna be buying these stuff, it's gonna be used in our communities, uh, and we'd wanna avoid getting into their operational tactics. It was his word. And, uh, and sort of giving away their, their trade secrets, their secret sausage, or how they're actually using it in the day to day. So just a, a disclosure that it's being used in the community would be enough.

66. Rep. Raymond P. Ward1:25:08

    So you could say the intended purpose is for law enforcement to do criminal investigations, and we'll use personal data as needed for criminal investigations. I could say that on every purchase of this equipment. And that would satisfy that subsection. Yep. How would the public be the wiser for having that put in every time they,

67. Rep. David Shallenberger1:25:29

    They'd highlight the, the license plate readers or facial recognition or the whatever technology they may be implementing is going to be used in, in that community.

68. Committee chair1:25:38

    Alright. Uh, Representative Hansen,

69. Rep. Leah Hansen1:25:42

    Thank you. Thank you, Madam Chair. I'm grateful for the conversations that are ongoing outside of this committee. Um, outside of this committee meeting, I think of this not being, um, restrictive of law enforcement or distrusting of them, but rather, um, knowing and approving the methods and standing behind them in, in, in the decisions that are going forward. So I approve this bill.

70. Committee chair1:26:09

    Okay. Committee fraction. Uh, representative Arthur?

71. Rep. John Arthur1:26:23

    Um, again, we need to adopt the first sub, right? Yeah. Motion to adopt the first sub.

72. Committee chair1:26:28

    Okay. The motion is to adopt the first sub. Would you like to speak to that? Um, I'll waive. Okay. And do the sponsor, Um, I'll waive on the Any committee discussion. Okay. Um, um, back to the maker of the motion I waive. Okay. The motion is to adopt the first substitute. All in favor, please say aye. Aye. Aye. Anyone opposed? That? Motion passes unanimously. Uh, representative, Representative Walter.

73. Rep. R. Neil Walter1:27:03

    Thank you, Madam Chair. Um, I move that we hold the bill.

74. Committee chair1:27:07

    Okay. The motion is to hold the bill. Would you like to speak to that motion? Yeah,

75. Rep. R. Neil Walter1:27:10

    I think there's a lot of good work here. I think there's a lot of effort that's gone into this. Um, there's, there are some significant remaining concerns, um, specifically related to law enforcement and, but I'd like to give the sponsor time to work on those issues.

76. Rep. David Shallenberger1:27:23

    Okay. To the sponsor. Uh, I'd appreciate that We, uh, we've committed to continuing to work with the, uh, law enforcement community, and I wanted to zoom out also that, uh, the law enforcement and the use of these technologies we're working with them, making sure there's wording in there. But that's one small portion of the entire use of these technologies across the state, across the different agencies. And as we zoom out even more with this bill, that, that, uh, surveillance those technologies is a small portion of the entire data privacy bill. And that overall it would be, um, a significant efforts for the data privacy bill. So I, I am committed to working with the law enforcement agencies. Either way, whether we pass this out or hold it, we'll keep working with them to make sure we get to a, a, a better spot.

77. Committee chair1:28:11

    Okay. To the committee for discussion, to the motion to hold Representative Gwynn,

78. Rep. Gwynn1:28:17

    You, uh, I support the motion to hold and I actually appreciate representative Embargo's remarks because I agree the law enforcement component is, but a small component of much larger bill, but look at the attention it's drawn. Um, you know, I just wanna reiterate right? A lot, a lot of agencies, policy manuals are published on their website. We signed agreements with BCI about how private information is handled. Law enforcement employees get terminated and decertify when they mishandle this information. And so, to my earlier question, you know, whether or not the Office of Privacy was aware of any breaches as it relates to privacy data, you know, whether or or not they're informed of any, it doesn't sound like they are, but I can tell you that that is not a significant problem in this state. We are excellent stewards of privacy, and in the event that stewardship and that trust is negated, uh, those employees are dealt with, uh, to swaps comments, right? We have checks and balances. We write search warrants, we write investigative subpoenas. That stuff is turned over as part of discovery requests when arrests are made and trials are had. Uh, we've talked about checks and balances, and I'm a little concerned that the executive is encroaching a little bit into our territories as it relates to negotiating these bills. And so, uh, I agree the law enforcement component's a small component. We need to focus on the remaining portions of the bill as it stands. My opinion right now when it comes to privacy, law enforcement in the state of Utah is in a much better position to protect that information then any of these other entities we've been discussing. So, thank you, Madam Chair.

79. Committee chair1:30:02

    Okay. Thank you. Uh, back to the sponsor to respond.

80. Rep. David Shallenberger1:30:07

    I'll wave. I'm excited to, I, I'm grateful for Representative Gwynn's passion and, uh, I'm excited to work with the law enforcement agencies, uh, no matter what happens.

81. Committee chair1:30:18

    Okay. Representative Arthur?

82. Rep. John Arthur1:30:20

    Yeah. Thank you, Madam Chair. Just very quickly, I'm curious with the, the other portions of the bill, the creation of the ombudsman and the, the inclusion of education on the, um, Utah Privacy Commission. Are, is there anything that's time sensitive in the, the rest of this bill that we need to be considerate of in, in the work that's gonna go forward with this?

83. Christopher Bramwell, Chief Privacy Officer1:30:40

    There are quite a few components in here that, that have consensus, uh, support for it and are carryovers from previous sessions. So the complaint process, the ombuds already exists, but that new part to allow entities to respond to complaints first, um, that is something there's consensus on. Uh, there are many entities that do just wanna provide their own privacy awareness training, education. Um, so a lot of components in the bill are, are not, uh, areas where there's a lot of concern.

84. Rep. John Arthur1:31:09

    Uh, are they time sensitive? Like do they need, like do we need this bill to pass sooner rather than later so that work can be done around data privacy. That's, that's important right now. Uh,

85. Christopher Bramwell, Chief Privacy Officer1:31:20

    I mean this session, the goal is, yes, there are some parts of this bill that lay strategy to allow us to comply. So one example is in the bill, it allows our office to create data governance models. So privacy, um, there's many duties of entities. So like breach is just one example. If you breach data that that's really a confidentiality. If confidentiality was breached, privacy very much becomes about what's the purposes and uses of data in grammar. And part six, it's was noticed given. And so there are all these other duties that encompass privacy. And so that data governance model piece is meant to allow us to provide models to entities that they may adopt, that fulfill some of these requirements of what are the purposes and uses of data, what's the retention schedules, what are these rules around it? Because for every entity to go and create their own, um, you'd be looking at millions of dollars just to comply actually, just what's, what's Ingram tens of millions to try to come into compliance. So there are aspects and strategies in this that are meant to start scaling some of the privacy compliance that without it do make it more difficult to actually help entities mature their programs. Thank you.

86. Committee chair1:32:22

    Okay. Back to the maker of the motion Representative Walter,

87. Rep. R. Neil Walter1:32:25

    I'll wa Okay.

88. Committee chair1:32:27

    The motion is to hold HB four 50 sub one data privacy amendments. We'll do a roll call vote. Thank you representatives. Arthur? Yes. Fit Gwen? Yes. Hansen? No. Kohler? Yes. Lee. Okay. Peterson? Yes. Tesser? No. Walter? Yes. Ward? Yes. Vice chair. Millard? Yes. Chair. Dunnigan? Yes. Okay. That, uh, motion passes. Oh, alright. Representative Lee is an aye. So that motion passes 10 to two, but the no votes are Hansen and Tuscher. Okay. Thank you. Representative Shallenberger. Thank you committee, uh, Representative Owens. Thank you for your patience. Welcome.

Senate Judiciary, Law Enforcement, and Criminal Justice Committee, Mar 4, 2026

1. Committee chair1:45:06speaker not certain

   Keep it really brief.

2. Rep. David Shallenberger1:45:11

   Thank you. Committee. This is the annual, uh, data privacy bill. This is a relatively new office, three years old from the Office of Data Privacy. Uh, I have up here with me, uh, the Chief Data Privacy Officer. He's just to answer questions. Right? Yeah. Okay.

3. Committee chair1:45:25

   Is there any opposition that you know to your bill? No. Okay. Uh, does that conclude your presentation?

4. Rep. David Shallenberger1:45:30speaker not certain

   Yeah, it's a great, this is a great bill.

5. Committee chair1:45:32

   Are there any questions for the representative? Seeing none, anybody here to testify on this bill? We're gonna close it back. Uh, we're gonna close the hearing and bring it back to Senator Brammer for a motion.

6. Sen. Brady Brammer1:45:42

   Yeah, I move to recommend favorably HB four 50. Alright.

7. Committee chair1:45:47

   Okay. Uh, discussion to that motion.

8. Unknown speaker1:45:49speaker not certain

   See, will you waive? This Is the best committee I've Ever been in.

9. Committee chair1:45:52

   Will you waive? I'll waive. All right. All in favor say aye.

10. Unknown speaker1:45:55

    Aye. Aye. Aye. Aye. Any opposed?

11. Committee chair1:45:58

    Chair of that passes six to zero. Congratulations, Representative Shallenberger. It should come back Next session.

House floor, Feb 27, 2026

1. Speaker (presiding)21:45

   The bill's been circled. Madam Reading Clerk

2. Reading Clerk21:47

   Second Substitute house bill four 50. Date of privacy amendments by Representative Shallenberger. This bill was heard in political subdivisions with the vote of 7 1 4

3. Speaker (presiding)21:57

   Representatives. Can we get, bring the volume down please. Representative Shallenberger Motion to circle That motion is in order. Would you like to speak to that?

4. Rep. David Shallenberger22:12

   We are waiting on a sub as we just work on a couple tweaks.

5. Speaker (presiding)22:15

   Thank you, Representative Shallenberger. The motion before is the House circle second substitute HB four 50. All in favor, say aye. Aye. Any opposed? Will that motion passes? The bills been circled. Madam Reading Clerk

6. Reading Clerk22:28

   First substitute House bill 4 57.

House floor, Mar 2, 2026

1. Speaker (presiding)35:21

   The motion before us the house encircle. Second substitute HB four 50. All in favor, say aye. Any opposed? Will that motion passes the bills uncircled before the body for its consideration. Back to your Representative Shallenberger.

2. Rep. David Shallenberger35:35

   Uh, motion to adopt fifth substitute.

3. Speaker (presiding)35:38

   Thank you representative. That motion is in order. Would you like to speak to it?

4. Rep. David Shallenberger35:42

   Uh, I'll waive

5. Unknown speaker35:46speaker not certain

   You to explain the differences between the fifth substitute And second substitute.

6. Rep. David Shallenberger35:50

   We've been, uh, yeah, we've been talking with the state auditor's office and the State Attorney General, working over some of the, uh, differences and the gaps where we were trying to fill in and make sure that we are all on the same page together as we move forward.

7. Speaker (presiding)36:06

   Thank you, Representative Shallenberger. Discussion to the Motion to Adopt fifth substitute on HP four 50 under Representative Shallenberger's. Name Representative Cutler.

8. Rep. Paul A. Cutler36:18

   Thank you Mr. Speaker. I wanna speak in favor of this, uh, uh, fifth substitute and explain. We've been working carefully with our good state auditor with the State Attorney General to make some improvements to the date of privacy. Bill, one of the key issues was we took out a, uh, portion of the code and that inadvertently removed the funding for privacy auditors. So this fifth sub puts the code back in, uh, it, it changes the state. What we previously had a state, uh, data privacy auditor we're putting, they are keeping the audit function in the state auditor's office, but there is no longer the position called the State Data Privacy auditor. Uh, so there won't be any confusion on who is setting the policy around privacy. The policy will come from the Data Privacy office. The auditor's office will do the auditing of privacy. Uh, we think this is a, a good compromise and strengthens the bill and have the support of both offices and of the Attorney General to move forward. Thank you Mr. Speaker.

9. Speaker (presiding)37:29

   Thank you Representative Cutler. Further discussion to the motion to this is on the motion to adopt fifth substitute Representative Clancy.

10. Rep. Clancy37:38

    Thank you Mr. Speaker. Will the sponsor yield to one question? Representative Shallenberger, will you yield to a question? Yes. Yes. Representative Clancy. Thank you Mr. Speaker and the fifth substitute. Does this impact law enforcement, uh, and public safety activities?

11. Rep. David Shallenberger37:54

    No. We dealt with that way back in third substitute where we put that out.

12. Rep. Clancy37:59

    I'm behind the times. Mr. Speaker, thank you.

13. Speaker (presiding)38:06

    Thank you, Representative Clancy. Uh, kay. Representative Shallenberger, would you like to sum on the motion to adopt fifth substitute

14. Rep. David Shallenberger38:14

    Now? I'll waive.

15. Speaker (presiding)38:15

    Okay. We'll go ahead and place the motion. The motion before is the House Adopt fifth Substitute on HB four 50. All in favor say aye. Aye. Aye. Any opposed? Will that motion passes. The bill has been substituted before the body for further consideration to you. Representative Shallenberger for presentation.

16. Rep. David Shallenberger38:32

    Thank you. This is the annual, uh, data privacy amendment as it comes out. This Office of Data Privacy is a relatively new offices as we look across the state. Uh, the Office of Data Privacy was created about three years ago, and Representative Jeff Moss rest in peace, uh, he would run this bill the last three years. And, uh, as this office matures, we continue to look at how we can, uh, use best practices across the state in all agencies, in our public education, in our cities, and go from using where there's piles of information of people's of sensitive records, uh, on desks or in our offices or in our computers, to how do we use best practices and protect people's privacy, protect people's records. And that's the task that is assigned to the Office of Data Privacy is how do we go from, uh, maybe nothing being implemented to the best practices and best standards. And Utah is really leading the way, uh, out in front of all 50 states and implementing these best practices. And it's, uh, really an attribute to, uh, this body and the Office of Data privacy and the great stakeholders that have been involved. The changes that we're making this year is we have an ombudsman that any complaints will eventually make, make their way to, and in past years, if you go to the Office of Data Privacy, you can make a complaint and it would go straight to the ombudsman. This actually removes that and makes it a step back where a complaint will actually go to the agency first, and they'll have a chance to deal with it internally before it goes to the ombudsman to be resolved. Uh, another change would be, uh, as the other good representative from Provo mentioned with law enforcement agencies, instead of making changes to certain technologies about data collection or, uh, other technologies in this bill, we've moved that over to the interim where we'll, uh, work with stakeholders and everybody to look at this and discuss and, uh, come up with good solutions for next year's, uh, data privacy bill. And as good the good representative from Centerville mentioned. We've also removed the office, the state data privacy auditor. As this office continues to grow, that office is, uh, is duplicative of over in the, now that we have an office of data privacy. So the auditor's office will still maintain auditor's duties, but guidelines and, uh, standards will be coming from the Office of Data Privacy. So the auditor's budget will stay the same as we move forward and work with these different agencies. And that is the bill I'd be open to. Any questions?

17. Speaker (presiding)41:13

    Thank you Representative Shallenberger discussion to the bill representative ch

18. Unknown speaker41:18speaker not certain

    Thank you Mr. Speaker. I just wanted to thank two of my colleagues to my right for hours and hours of work that they put into making this bill work and I would encourage my colleagues to support it.

19. Speaker (presiding)41:34

    Thank you, representative ch further discussion to the bill. Seeing none. Back to your Representative.

20. Rep. David Shallenberger41:41

    Shallenberger I'll waive. Thank you.

21. Speaker (presiding)41:43

    Summation has been waived. Voting now be open on fifth substitute P four 50 all present. Having voted voting is now closed. Fist substitute HB four 50 passed this body with 72 yes votes and zero no votes will be sent to the Senate for its consideration. Representative Thompson.

House floor, Mar 2, 2026

1. Speaker (presiding)35:35

   Uh, motion to adopt fifth substitute. Thank you representative. That motion is in order. Would you like to speak to it?

2. Rep. David Shallenberger35:42speaker not certain

   Uh, I'll waive You to explain the differences between the fifth substitute And second substitute. We've been, uh, yeah, we've been talking with the state auditor's office and the State Attorney General, working over some of the, uh, differences and the gaps where we were trying to fill in and make sure that we are all on the same page together as we move forward.

3. Speaker (presiding)36:06

   Thank you, Representative Shallenberger. Discussion to the Motion to Adopt fifth substitute on HP four 50 under Representative Shallenberger's. Name Representative Cutler.

4. Rep. Paul A. Cutler36:18

   Thank you Mr. Speaker. I wanna speak in favor of this, uh, uh, fifth substitute and explain. We've been working carefully with our good state auditor with the State Attorney General to make some improvements to the date of privacy. Bill, one of the key issues was we took out a, uh, portion of the code and that inadvertently removed the funding for privacy auditors. So this fifth sub puts the code back in, uh, it, it changes the state. What we previously had a state, uh, data privacy auditor we're putting, they are keeping the audit function in the state auditor's office, but there is no longer the position called the State Data Privacy auditor. Uh, so there won't be any confusion on who is setting the policy around privacy. The policy will come from the Data Privacy office. The auditor's office will do the auditing of privacy. Uh, we think this is a, a good compromise and strengthens the bill and have the support of both offices and of the Attorney General to move forward. Thank you Mr. Speaker.

5. Speaker (presiding)37:29

   Thank you Representative Cutler. Further discussion to the motion to this is on the motion to adopt fifth substitute Representative Clancy.

6. Rep. Clancy37:38

   Thank you Mr. Speaker. Will the sponsor yield to one question? Representative Shallenberger, will you yield to a question?

7. Rep. David Shallenberger37:44

   Yes. Yes. Representative Clancy.

8. Rep. Clancy37:46

   Thank you Mr. Speaker and the fifth substitute. Does this impact law enforcement, uh, and public safety activities?

9. Rep. David Shallenberger37:54

   No. We dealt with that way back in third substitute where we put that out.

10. Rep. Clancy37:59

    I'm behind the times. Mr. Speaker, thank you.

11. Speaker (presiding)38:06

    Thank you, Representative Clancy. Uh, kay. Representative Shallenberger, would you like to sum on the motion to adopt fifth substitute

12. Rep. David Shallenberger38:14

    Now? I'll waive.

13. Speaker (presiding)38:15

    Okay. We'll go ahead and place the motion. The motion before is the House Adopt fifth Substitute on HB four 50. All in favor say aye. Aye. Aye. Any opposed? Will that motion passes. The bill has been substituted before the body for further consideration to you. Representative Shallenberger for presentation.

14. Rep. David Shallenberger38:32

    Thank you. This is the annual, uh, data privacy amendment as it comes out. This Office of Data Privacy is a relatively new offices as we look across the state. Uh, the Office of Data Privacy was created about three years ago, and Representative Jeff Moss rest in peace, uh, he would run this bill the last three years. And, uh, as this office matures, we continue to look at how we can, uh, use best practices across the state in all agencies, in our public education, in our cities, and go from using where there's piles of information of people's of sensitive records, uh, on desks or in our offices or in our computers, to how do we use best practices and protect people's privacy, protect people's records. And that's the task that is assigned to the Office of Data Privacy is how do we go from, uh, maybe nothing being implemented to the best practices and best standards. And Utah is really leading the way, uh, out in front of all 50 states and implementing these best practices. And it's, uh, really an attribute to, uh, this body and the Office of Data privacy and the great stakeholders that have been involved. The changes that we're making this year is we have an ombudsman that any complaints will eventually make, make their way to, and in past years, if you go to the Office of Data Privacy, you can make a complaint and it would go straight to the ombudsman. This actually removes that and makes it a step back where a complaint will actually go to the agency first, and they'll have a chance to deal with it internally before it goes to the ombudsman to be resolved. Uh, another change would be, uh, as the other good representative from Provo mentioned with law enforcement agencies, instead of making changes to certain technologies about data collection or, uh, other technologies in this bill, we've moved that over to the interim where we'll, uh, work with stakeholders and everybody to look at this and discuss and, uh, come up with good solutions for next year's, uh, data privacy bill. And as good the good representative from Centerville mentioned. We've also removed the office, the state data privacy auditor. As this office continues to grow, that office is, uh, is duplicative of over in the, now that we have an office of data privacy. So the auditor's office will still maintain auditor's duties, but guidelines and, uh, standards will be coming from the Office of Data Privacy. So the auditor's budget will stay the same as we move forward and work with these different agencies. And that is the bill I'd be open to. Any questions?

15. Speaker (presiding)41:13

    Thank you Representative Shallenberger discussion to the bill representative ch

16. Unknown speaker41:18speaker not certain

    Thank you Mr. Speaker. I just wanted to thank two of my colleagues to my right for hours and hours of work that they put into making this bill work and I would encourage my colleagues to support it.

17. Speaker (presiding)41:34

    Thank you, representative ch further discussion to the bill. Seeing none. Back to your Representative.

18. Rep. David Shallenberger41:41

    Shallenberger I'll waive. Thank you.

19. Speaker (presiding)41:43

    Summation has been waived. Voting now be open on fifth substitute P four 50 all present. Having voted voting is now closed. Fist substitute HB four 50 passed this body with 72 yes votes and zero no votes will be sent to the Senate for its consideration. Representative Thompson.

Senate floor, Mar 4, 2026

1. Unknown speaker4:25:52speaker not certain

   Yeah, this, this talks about, this is a data privacy bill and this, this edition would protect addresses and phone numbers for donors and of campaigns and PAC committees. The name and zip code is still dec still disclosed so that people can get it, but it would prevent potential of, of doxing for, uh, um, anybody who wants to donate to a particular campaign or pick.

2. Presiding officer4:26:15

   Thank you. I'm gonna go ahead and place the motion. Those in favor substitute say aye. Aye. Any opposed? Rule That motion passes. The bill is substituted now. Any we heard the bill before. Any further explanation? Senator CU Moore?

3. Sen. Kirk A. Cullimore4:26:30

   Yeah, so that's a small portion of the bill. The, the big bill is this is an annual update bill for the Government Data Privacy Act In previous years, uh, I've run this bill with, uh, Representative Moss and it continues the legislature's efforts to refine and strengthen our statewide PRI privacy framework. It clarifies the roles of the Office of Data Privacy and the Office of the State auditor. The Office of Data Privacy will focus on statewide privacy strategy, policy, standards, guidance, and training. While the office of the state auditor will focus on auditing governmental entities, uh, against those standards, uh, it to support that the bill moves the duties currently assigned to the privacy audit, uh, direct to the privacy auditor directly under the state auditor, allowing the auditor's existing privacy and security audit team to perform those responsibilities. It also strengthens straight statewide coordination with the Chief Privacy Officer and higher ed and, and government, uh, departments. It implo improves implementation of the Government Data Privacy Act by directing the privacy office to develop privacy training materials, compliance assessment tools. Um, it's, we, we've been working on a data privacy plan with all state entities and it's supposed to be developed over 10 years. So we take little baby steps each year. This would require these, uh, all departments and political subdivisions to provide their privacy program report to the office so that they can identify those and updates Privacy ombudsman complainant process. And so with that, uh, that was my explanation.

4. Presiding officer4:27:59

   Looking for questions. I think again, we've, we heard the battle earlier. Did not, not saying any questions. I'm going to you for a motion

5. Unknown speaker4:28:08speaker not certain

   Remove that we under suspension of the rules passed. Six. Substitute HB four 50.

6. Presiding officer4:28:13

   Thank. Thank you. And the, the question is, under suspension, the role shall six. Substitute house bill. Four 50 pass. Roll call vote.

7. Senate clerk (roll call)4:28:22

   Senator Ipson. Baldy Lewin Bramer Bus. Aye. Fillmore Aye. Escamilla Fillmore Aye. Grover. Aye. Harper. Kins. Ipson Johnson. Juab McKay. Mikel Milner. Musselman Owens Pitcher Thumb Rebi. Rebi. Aye. Sandal. Stevenson. Stevenson. Stratton. Aye. Vickers. Weiler. Aye. Wilson. Aye. Winterton. President Adams,

8. Senate President Adams (presiding)4:29:25

   Where to go? Okay. Well, let's just go. We'll, we'll wait for the morning. Okay. Aye. Six. Substitute house Bill four 50. Having received 28 yay votes. Zero na votes, one being absent passes this body and will be returned to the house for further consideration. Senator Cullimore, I think that con completes our work for today. For tonight. So I'm gonna go to you for a motion. Hold on. Let me make sure your mic's on. Okay. Uh,

House floor, Mar 5, 2026

1. Reading Clerk1:55:25

   Mad reading Clerk Sixth Substitute House bill four 50. Date of privacy amendments by Representative Shallenberger.

2. Presiding officer1:55:34

   Representative gracious. Motion

3. Rep. David Shallenberger1:55:36

   To circle Thank you representative.

4. Presiding officer1:55:37

   That motion is an order of the sponsors off the floor. All in favor say aye. Aye. Any opposed? While that motion passes, the bill's been circled. Madam Marine Clerk

5. Reading Clerk1:55:47

   Fourth Substitute House Bill 4 75.

House floor, Mar 5, 2026

1. Speaker (presiding)2:19:44

   Motion to circle, uh, house bill four 50. Motion is done. ENC Circle House Bill four 50. Any discussion of that motion? Seeing none. All those in favor, please say aye. Aye. Any opposed? That motion passes. The bill is Uncircled Representative Schoenberg. Uh, we concur with, uh, the Senate Motion is concur with the Senate amendments. Any discussion to the motion? Seeing none. All those in favor, please say aye. Aye. Aye. Any opposed? The motion passes the the bill is concurred with, we'll go to final. Oh yeah, good point. Thank you for your point. Representative Shallenberger, would you tell us what, uh, the Senate amendments are?

2. Rep. David Shallenberger2:20:28

   Yep. So this is the date of privacy bill. They added a tiny bit of language in there for, uh, small donors on campaigns five, 10, $20 or less. Uh, if a grandma, grandma Bill is requested trying to get donors of all things, uh, the address and personal contact information for those donors is redacted.

3. Speaker (presiding)2:20:49

   Any discussion of that motion? Seeing none. Final, I'll go ahead and place the motion again for passage of six. Substitute hospital four 50 on the concurrence calendar. All is in favor, please say aye. Any opposed? I've Voting is now open on final passage of sixth substitute house Bill four 50. Seeing all present have voted, the voting will be closed. Seeing all present have voted, the voting will be closed. Six. Substitute house bill four 50 passes this body with 60 66 yays and one nay and will be returned to the Senate for signature of the president. Representative Bolinder.