53-3-109. Records -- Access -- Fees -- Rulemaking.
(1) Except as provided in this section, all records of the division shall be classified and disclosed in accordance with Title 63G, Chapter 2, Government Records Access and Management Act. The division may disclose personal identifying information in accordance with 18 U.S.C. Chapter 123: to a licensed private investigator holding a valid agency license, with a legitimate business need; to an insurer, insurance support organization, or a self-insured entity, or its agents, employees, or contractors that issues any motor vehicle insurance under Title 31A, Chapter 22, Part 3, Motor Vehicle Insurance, for use in connection with claims investigation activities, antifraud activities, rating, or underwriting for any person issued a license certificate under this chapter; to a depository institution as that term is defined in Section; 7-1-103 to the State Tax Commission for the purposes of tax fraud detection and prevention and any other use required by law; subject to Subsection, to the University of Utah for data collection in relation to genetic and epidemiologic research; or (8) to a government entity, including any court or law enforcement agency, to fulfill the government entity's functions; or to a private person acting on behalf of a government entity to fulfill the government entity's functions, if the division determines disclosure of the information is in the interest of public safety.
(2) A person who receives personal identifying information shall be advised by the division that the person may not: disclose the personal identifying information from that record to any other person; or use the personal identifying information from that record for advertising or solicitation purposes. Any use of personal identifying information by an insurer or insurance support organization, or by a self-insured entity or its agents, employees, or contractors not authorized by Subsectionis: (1)(b)(ii) an unfair marketing practice under Section; or 31A-23a-402 an unfair claim settlement practice under Subsection. 31A-26-303(3)
(3) Notwithstanding the provisions of Subsection, the division or the division's designee may disclose portions of a driving record, in accordance with this Subsection, to: (1)(b) (3) an insurer as defined under Section, or a designee of an insurer, for purposes of assessing driving risk on the insurer's current motor vehicle insurance policyholders; 31A-1-301 an employer or a designee of an employer, for purposes of monitoring the driving record and status of current employees who drive as a responsibility of the employee's employment if the requester demonstrates that the requester has obtained the written consent of the individual to whom the information pertains; an employer or the employer's agents to obtain or verify information relating to a holder of a commercial driver license that is required under 49 U.S.C. Chapter 313; and a county assessor for purposes of verifying eligibility for the residential property tax exemption described in Section. 59-2-103 A disclosure under Subsectionshall: (3)(a)(i) include the licensed driver's name, driver license number, date of birth, and an indication of whether the driver has had a moving traffic violation that is a reportable violation, as defined under Sectionduring the previous month; 53-3-102 be limited to the records of drivers who, at the time of the disclosure, are covered under a motor vehicle insurance policy of the insurer; and be made under a contract with the insurer or a designee of an insurer. A disclosure under Subsectionorshall: (3)(a)(ii) (iii) include the licensed driver's name, driver license number, date of birth, and an indication of whether the driver has had a moving traffic violation that is a reportable violation, as defined under Section, during the previous month; 53-3-102 be limited to the records of a current employee of an employer; be made under a contract with the employer or a designee of an employer; and include an indication of whether the driver has had a change reflected in the driver's: driving status; license class; medical self-certification status; or medical examiner's certificate under 49 C.F.R. Sec. 391.45. The contract under Subsectionorshall specify: (3)(b)(iii) (c)(iii) the criteria for searching and compiling the driving records being requested; the frequency of the disclosures; the format of the disclosures, which may be in bulk electronic form; and a reasonable charge for the driving record disclosures under this Subsection. (3) A disclosure under Subsectionshall: (3)(a)(iv) include the licensed driver's name, date of birth, and current residential address; and be made upon request by a county assessor. A county assessor may use information disclosed by the division under Subsectiononly for purposes of verifying a property owner's eligibility to receive the residential property tax exemption authorized under Section. (3)(a)(iv) 59-2-103
(4) Notwithstanding Subsection, the division may provide a "yes" or "no" response to an electronically submitted request to verify information from a driver license or identification card issued by the division if: (1)(a) the request is made by a private entity operating under the Transportation Security Administration Registered Traveler program; the private entity implements the Transportation Security Administration enrollment standards; and the program participant: voluntarily provides the participant's division-issued identification to confirm the participant's identity; and consents to verification of the participant's name, date of birth, and home address. The data described in Subsectionmay only be used to enroll or reenroll the participant in the Transportation Security Administration Registered Traveler program. (4)(a)(iii)(B) The division may not furnish a "yes" response under Subsectionunless all data fields match. (4)(a)
(5) The division may charge fees: in accordance with Sectionfor searching and compiling its files or furnishing a report on the driving record of a person; 53-3-105 for each document prepared under the seal of the division and deliver upon request, a certified copy of any record of the division, and charge a fee set in accordance with Sectionfor each document authenticated; 63J-1-504 established in accordance with Section, for disclosing personal identifying information under Subsection; and 63J-1-504 (1)(b) established in accordance with Section, for each response under Subsection. 63J-1-504 (4)
(6) Each certified copy of a driving record furnished in accordance with this section is admissible in any court proceeding in the same manner as the original.
(7) A driving record furnished under this section may only report on the driving record of a person for a period of 10 years. Subsectiondoes not apply to court or law enforcement reports, reports of commercial driver license violations, or reports for commercial driver license holders. (7)(a)
(8) The division shall include on each application for or renewal of a license or identification card under this chapter: the following notice: "The Driver License Division may disclose the information provided on this form to an entity described in Utah Code Ann. Subsection."; 53-3-109(1)(b)(v) a reference to the website described in Subsection; and (8)(b) a link to the division website for: information provided by the division, after consultation with the University of Utah, containing the explanation and description described in Subsection; and (8)(b) an online form for the individual to opt out of the disclosure of personal identifying information described in Subsection. (1)(b)(v) In consultation with the division, the University of Utah shall create a website that provides an explanation and description of: what information may be disclosed by the division to the University of Utah under Subsection; (1)(b)(v) the methods and timing of anonymizing the information; for situations where the information is not anonymized: how the information is used; how the information is secured; how long the information is retained; and who has access to the information; research and statistical purposes for which the information is used; and other relevant details regarding the information. The website created by the University of Utah described in Subsectionshall include the following: (8)(b) a link to the division website for an online form for the individual to opt out of the disclosure of personal identifying information as described in Subsection; and (1)(b)(v) a link to an online form for the individual to affirmatively choose to remove, subject to Subsection, personal identifying information from the database controlled by the University of Utah that was disclosed in accordance with Subsection. (8)(e)(ii) (1)(b)(v) In the course of business, the division shall provide information regarding the disclosure of personal identifying information, including providing on the division website: a link to the website created under Subsectionto provide individuals with information regarding the disclosure of personal identifying information under Subsection; and (8)(b) (1)(b)(v) a link to the division website for: information provided by the division, after consultation with the University of Utah, containing the explanation and description described in Subsection; and (8)(b) an online form for the individual to opt out of the disclosure of personal identifying information as described in Subsection. (1)(b)(v) The division may not disclose the personal identifying information under Subsectionif an individual opts out of the disclosure as described in Subsectionor. (1)(b)(v) (8)(a)(iii)(B) (8)(c)(i) Except as provided in Subsection, if an individual makes a request as described in Subsection, the University of Utah shall, within 90 days of receiving the request, remove and destroy the individual's personal identifying information received under Subsectionfrom a database controlled by the University of Utah. (8)(e)(ii)(B) (8)(c)(ii) (1)(b)(v) The University of Utah is not required to remove an individual's personal identifying information as described in Subsectionfrom data released to a research study before the date of the request described in Subsection. (8)(e)(ii)(A) (8)(c)(ii) The University of Utah shall conduct a biennial internal information security audit of the information systems that store the data received in accordance with Subsection, and, beginning in the year 2023, provide a biennial report of the findings of the internal audit to the Transportation Interim Committee. (1)(b)(v)
(9) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules to designate: what information shall be included in a report on the driving record of a person; the form of a report or copy of the report which may include electronic format; the form of a certified copy, as required under Section, which may include electronic format; 53-3-216 the form of a signature required under this chapter which may include electronic format; the form of written request to the division required under this chapter which may include electronic format; the procedures, requirements, and formats for disclosing personal identifying information under Subsection; and (1)(b) the procedures, requirements, and formats necessary for the implementation of Subsection. (3)
(10) It is a class B misdemeanor for a person to knowingly or intentionally access, use, disclose, or disseminate a record created or maintained by the division or any information contained in a record created or maintained by the division for a purpose prohibited or not permitted by statute, rule, regulation, or policy of a governmental entity. A person who discovers or becomes aware of any unauthorized use of records created or maintained by the division shall inform the commissioner and the division director of the unauthorized use.