Panel advances data privacy bill after sponsor removes law-enforcement language

The House Political Subdivisions Committee on Thursday advanced a reworked data privacy bill after the sponsor removed contentious law‑enforcement language and substituted a stakeholder technology study.

Representative Shallenberger, sponsor of HB450, told the committee the new sub removes previously drafted law-enforcement restrictions and replaces prescriptive rules with a one‑year study that will include law enforcement, prosecutors, defense attorneys and other stakeholders. The committee adopted the second substitute and later voted to advance the bill.

Shallenberger said the substitute also consolidates roles: the newly created Data Privacy Office will take on functions previously assigned to a separate data privacy auditor, and the ombudsman role will remain as a backstop for escalated complaints. Under the revised complaint process, individual complaints are routed to the relevant agency first; unresolved matters may then be escalated to the ombudsman.

Stuart Young, criminal deputy attorney general, expressed appreciation for the sponsor’s engagement with law‑enforcement stakeholders and welcomed the removal of law‑enforcement‑specific language. Young also noted the sub defines a reportable data breach threshold at more than 500 individuals and said the office’s training materials should be easily accessible to agencies.

Public commenters — including representatives of the League of Cities and Towns, the attorney general’s office, and the Utah Media Coalition — generally praised the sponsor for collaborative work to address concerns and for strengthening the role of the privacy office in training and stakeholder outreach.

The committee adopted the second substitute and then recorded a favorable recommendation. The clerk read the committee tally into the record as “8 to 7 to 1.” The transcript identifies Representative Ward as having voted ‘no’ on the recommendation; the committee record transcribes the overall tally as noted.

The sponsor said the changes reflect a maturation of the new Data Privacy Office and an effort to avoid duplicative processes while preserving individual complaint remedies.