1. (1) As used in this section:

   1. (a) "Clone" means to copy a subscription or subscription data from a rap back system, including associated criminal history record information, from a qualified entity to another qualified entity.
   2. (b) "FBI Rap Back System" means the rap back system maintained by the Federal Bureau of Investigation.
   3. (c) "Rap back system" means a system that enables authorized entities to receive ongoing status notifications of any criminal history reported on individuals whose fingerprints are registered in the system.
   4. (d) "Volunteer Employee Criminal History System" or "VECHS" means a system that allows the bureau and the Federal Bureau of Investigation to provide criminal history record information to a qualifying entity, including a non-governmental qualifying entity.
   5. (e) "WIN Database" means the Western Identification Network Database that consists of eight western states sharing one electronic fingerprint database.

2. (2) Except as provided in Subsection (17), dissemination of information from a criminal history record, including information obtained from a fingerprint background check, name check, warrant of arrest information, or information from division files, is limited to:

   1. (a) criminal justice agencies for purposes of administration of criminal justice and for employment screening by criminal justice agencies;

   2. (b)

      1. (i) agencies or individuals pursuant to a specific agreement with a criminal justice agency to provide services required for the administration of criminal justice; and
      2. (ii) the agreement shall specifically authorize access to data, limit the use of the data to purposes for which given, and ensure the security and confidentiality of the data;
   3. (c) a qualifying entity for employment background checks for the qualifying entity's own employees or volunteers and individuals who have applied for employment with or to serve as a volunteer for the qualifying entity;
   4. (d) noncriminal justice agencies or individuals for any purpose authorized by statute, executive order, court rule, court order, or local ordinance;
   5. (e) agencies or individuals for the purpose of obtaining required clearances connected with foreign travel or obtaining citizenship;
   6. (f) agencies or individuals for the purpose of a preplacement adoptive study, in accordance with the requirements of Sections 81-13-403 and 81-13-405;
   7. (g) private security agencies through guidelines established by the commissioner for employment background checks for their own employees and prospective employees;

   8. (h) state agencies for the purpose of conducting a background check for the following individuals:

      1. (i) employees;
      2. (ii) applicants for employment;
      3. (iii) volunteers; and
      4. (iv) contract employees;

   9. (i) governor's office for the purpose of conducting a background check on the following individuals:

      1. (i) cabinet members;
      2. (ii) judicial applicants; and
      3. (iii) members of boards, committees, and commissions appointed by the governor;
   10. (j) the office of the lieutenant governor for the purpose of conducting a background check on an individual applying to be a notary public under Section 46-1-3;
   11. (k) agencies and individuals as the commissioner authorizes for the express purpose of research, evaluative, or statistical activities pursuant to an agreement with a criminal justice agency; and
   12. (l) other agencies and individuals as the commissioner authorizes and finds necessary for protection of life and property and for offender identification, apprehension, and prosecution pursuant to an agreement.
3. (3) An agreement under Subsection (2)(k) shall specifically authorize access to data, limit the use of data to research, evaluative, or statistical purposes, preserve the anonymity of individuals to whom the information relates, and ensure the confidentiality and security of the data.

4. (4)

   1. (a) Before requesting information, a qualifying entity under Subsection (2)(c), state agency, or other agency or individual described in Subsections (2)(d) through (j) shall obtain a signed waiver from the person whose information is requested.

   2. (b) The waiver shall notify the signee:

      1. (i) that a criminal history background check will be conducted;
      2. (ii) who will see the information; and
      3. (iii) how the information will be used.

   3. (c) A qualifying entity under Subsection (2)(c), state agency, or other agency or individual described in Subsections (2)(d) through (g) that submits a request for a noncriminal justice name based background check of local databases to the bureau shall provide to the bureau:

      1. (i) personal identifying information for the subject of the background check; and
      2. (ii) the fee required by Subsection (15).

   4. (d) A qualifying entity under Subsection (2)(c), state agency, or other agency or individual described in Subsections (2)(d) through (g) that submits a request for a WIN database check and a nationwide background check shall provide to the bureau:

      1. (i) personal identifying information for the subject of the background check;
      2. (ii) a fingerprint card for the subject of the background check; and
      3. (iii) the fee required by Subsection (15).

   5. (e) Information received by a qualifying entity under Subsection (2)(c), state agency, or other agency or individual described in Subsections (2)(d) through (j) may only be:

      1. (i) available to individuals involved in the hiring or background investigation of the job applicant, employee, notary applicant, or as authorized under federal or state law;
      2. (ii) used for the purpose of assisting in making an employment appointment, selection, or promotion decision or for considering a notary applicant under Section 46-1-3; and
      3. (iii) used for the purposes disclosed in the waiver signed in accordance with Subsection (4)(b).
   6. (f) An individual who disseminates or uses information obtained from the division under Subsections (2)(c) through (j) for purposes other than those specified under Subsection (4)(e), in addition to any penalties provided under this section, is subject to civil liability.

   7. (g)

      1. (i) A qualifying entity under Subsection (2)(c), state agency, or other agency or individual described in Subsections (2)(d) through (j) that obtains background check information shall provide the subject of the background check an opportunity to:

         1. (A) request a copy of the information received; and
         2. (B) respond to and challenge the accuracy of any information received.
      2. (ii) An individual who is the subject of a background check and who receives a copy of the information described in Subsection (4)(g)(i) may use the information only for the purpose of reviewing, responding to, or challenging the accuracy of the information.
   8. (h) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules to implement this Subsection (4).
   9. (i) The division or the division's employees are not liable for defamation, invasion of privacy, negligence, or any other claim in connection with the contents of information disseminated under Subsections (2)(c) through (j).

5. (5)

   1. (a) Except as provided in Subsection (5)(b), (c), (d), or (e), or as otherwise authorized under state law, criminal history record information obtained from division files may be used only for the purposes for which the information was provided.
   2. (b) A criminal history provided to an agency under Subsection (2)(f) may be provided by the agency to the individual who is the subject of the history, another licensed child-placing agency, or the attorney for the adoptive parents for the purpose of facilitating an adoption.
   3. (c) A criminal history of a defendant provided to a criminal justice agency under Subsection (2)(a) may also be provided by the prosecutor to a defendant's defense counsel, upon request during the discovery process, for the purpose of establishing a defense in a criminal case.
   4. (d) A public transit district, as described in Title 17B, Chapter 2a, Part 8, Public Transit District Act, that is under contract with a state agency to provide services may, for the purposes of complying with Subsection 26B-6-410(5), provide a criminal history record to the state agency or the agency's designee.
   5. (e) Criminal history record information obtained from a national source may be disseminated if the dissemination is authorized by a policy issued by the Criminal Justice Information Services Division or other federal law.

6. (6)

   1. (a) A qualifying entity under Subsection (2)(c) may submit fingerprints to the bureau and the Federal Bureau of Investigation for a local and national background check under the provisions of the National Child Protection Act of 1993, 42 U.S.C. Sec. 5119 et seq.

   2. (b) A qualifying entity under Subsection (2)(c) that submits fingerprints under Subsection (6)(a):

      1. (i) shall meet all VECHS requirements for using VECHS; and
      2. (ii) may only submit fingerprints for an employee, volunteer, or applicant who has resided in Utah for the seven years before the day on which the qualifying entity submits the employee's, volunteer's, or applicant's fingerprints.

7. (7)

   1. (a) This section does not preclude the use of the division's central computing facilities for the storage and retrieval of criminal history record information.
   2. (b) This information shall be stored so the information cannot be modified, destroyed, or accessed by unauthorized agencies or individuals.
8. (8) Direct access through remote computer terminals to criminal history record information in the division's files is limited to those agencies authorized by the commissioner under procedures designed to prevent unauthorized access to this information.

9. (9)

   1. (a) The commissioner shall establish procedures to allow an individual right of access to review and receive a copy of the individual's criminal history report.
   2. (b) A processing fee for the right of access service, including obtaining a copy of the individual's criminal history report under Subsection (9)(a) shall be set in accordance with Section 63J-1-504.

   3. (c)

      1. (i) The commissioner shall establish procedures for an individual to challenge the completeness and accuracy of criminal history record information contained in the division's computerized criminal history files regarding that individual.
      2. (ii) These procedures shall include provisions for amending any information found to be inaccurate or incomplete.

10. (10) The private security agencies as provided in Subsection (2)(g):

    1. (a) shall be charged for access; and
    2. (b) shall be registered with the division according to rules made by the division under Title 63G, Chapter 3, Utah Administrative Rulemaking Act.
11. (11) Before providing information requested under this section, the division shall give priority to a criminal justice agency's needs.

12. (12)

    1. (a) It is a class B misdemeanor for a person to knowingly or intentionally access, use, disclose, or disseminate a record created, maintained, or to which access is granted by the division or any information contained in a record created, maintained, or to which access is granted by the division for a purpose prohibited or not permitted by statute, rule, regulation, or policy of a governmental entity.
    2. (b) A person who discovers or becomes aware of any unauthorized use of records created or maintained, or to which access is granted by the division shall inform the commissioner and the director of the bureau of the unauthorized use.

13. (13)

    1. (a) Subject to Subsection (13)(b), a qualifying entity or an entity described in Subsection (2) may request that the division register fingerprints taken for the purpose of conducting current and future criminal background checks under this section with:

       1. (i) the WIN Database rap back system, or any successor system;
       2. (ii) the FBI Rap Back System; or
       3. (iii) a system maintained by the division.

    2. (b) A qualifying entity or an entity described in Subsection (2) may only make a request under Subsection (13)(a) if the entity:

       1. (i) has the authority through state or federal statute or federal executive order;
       2. (ii) obtains a signed waiver from the individual whose fingerprints are being registered; and
       3. (iii) establishes a privacy risk mitigation strategy to ensure that the entity only receives notifications for individuals with whom the entity maintains an authorizing relationship.
14. (14) The division is authorized to submit fingerprints to the FBI Rap Back System to be retained in the FBI Rap Back System for the purpose of being searched by future submissions to the FBI Rap Back System, including latent fingerprint searches.

15. (15)

    1. (a) The division shall impose fees set in accordance with Section 63J-1-504 for the applicant fingerprint card, name check, and to register fingerprints under Subsection (13)(a).
    2. (b) Funds generated under this Subsection (15) shall be deposited into the General Fund as a dedicated credit by the department to cover the costs incurred in providing the information.
    3. (c) The division may collect fees charged by an outside agency for services required under this section.
16. (16) For the purposes of conducting a criminal background check authorized under Subsection (2)(h), (i), or (j), the Division of Human Resource Management, in accordance with Title 63A, Chapter 17, Utah State Personnel Management Act, and the governor's office shall have direct access to criminal background information maintained under Chapter 10, Part 2, Bureau of Criminal Identification.

17. (17)

    1. (a) Except as provided in Subsection (18), if an individual has an active FBI Rap Back System subscription with a qualifying entity, the division may, upon request from another qualifying entity, clone the subscription to the requesting qualifying entity if:

       1. (i) the requesting qualifying entity requests the clone:

          1. (A) for the purpose of evaluating whether the individual should be permitted to obtain or retain a license for, or serve as an employee or volunteer in a position in which the individual is responsible for, the care, treatment, training, instruction, supervision, or recreation of children, the elderly, or individuals with disabilities; or
          2. (B) for the same purpose as the purpose for which the original qualifying entity requested the criminal history record information;
       2. (ii) the requesting qualifying entity is expressly authorized by statute to obtain criminal history record information for the individual who is the subject of the request;
       3. (iii) before requesting the clone, the requesting qualifying entity obtains a signed waiver, containing the information described in Subsection (4)(b), from the individual who is the subject of the request;
       4. (iv) the requesting qualifying entity or the individual pays any applicable fees set by the division in accordance with Section 63J-1-504; and
       5. (v) the requesting qualifying entity complies with the requirements described in Subsection (4)(g).
    2. (b) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules regulating the process described in this Subsection (17).

18. (18)

    1. (a) Subsection (17) does not apply unless the Federal Bureau of Investigation approves the use of the FBI Rap Back System for the purpose described in Subsection (17)(a)(i) under the conditions described in Subsection (17).
    2. (b) Subsection (17) does not apply to the extent that implementation of the provisions of Subsection (17) are contrary to the requirements of the Child Care and Development Block Grant, 42 U.S.C. Secs. 9857-9858r or any other federal grant.

19. (19)

    1. (a) Information received by a qualifying entity under Subsection (17) may only be disclosed and used as described in Subsection (4)(e).
    2. (b) A person who disseminates or uses information received under Subsection (17) for a purpose other than those described in Subsection (4)(e) is subject to the penalties described in this section and is also subject to civil liability.
    3. (c) A qualifying entity is not liable for defamation, invasion of privacy, negligence, or any other claim in connection with the contents of information disseminated under Subsection (17).

Amended by Chapter 426, 2025 General Session