1. (1)

   1. (a) Except as provided in this section, all records of the division shall be classified and disclosed in accordance with Title 63G, Chapter 2, Government Records Access and Management Act.

   2. (b) The division may disclose personal identifying information in accordance with 18 U.S.C. Chapter 123:

      1. (i) to a licensed private investigator holding a valid agency license, with a legitimate business need;
      2. (ii) to an insurer, insurance support organization, or a self-insured entity, or its agents, employees, or contractors that issues any motor vehicle insurance under Title 31A, Chapter 22, Part 3, Motor Vehicle Insurance, for use in connection with claims investigation activities, antifraud activities, rating, or underwriting for any person issued a license certificate under this chapter;
      3. (iii) to a depository institution as that term is defined in Section 7-1-103;
      4. (iv) to the State Tax Commission for the purposes of tax fraud detection and prevention and any other use required by law;
      5. (v) subject to Subsection (8), to the University of Utah for data collection in relation to genetic and epidemiologic research; or

      6. (vi)

         1. (A) to a government entity, including any court or law enforcement agency, to fulfill the government entity's functions; or
         2. (B) to a private person acting on behalf of a government entity to fulfill the government entity's functions, if the division determines disclosure of the information is in the interest of public safety.

2. (2)

   1. (a) A person who receives personal identifying information shall be advised by the division that the person may not:

      1. (i) disclose the personal identifying information from that record to any other person; or
      2. (ii) use the personal identifying information from that record for advertising or solicitation purposes.

   2. (b) Any use of personal identifying information by an insurer or insurance support organization, or by a self-insured entity or its agents, employees, or contractors not authorized by Subsection (1)(b)(ii) is:

      1. (i) an unfair marketing practice under Section 31A-23a-402; or
      2. (ii) an unfair claim settlement practice under Subsection 31A-26-303(3).

3. (3)

   1. (a) Notwithstanding the provisions of Subsection (1)(b), the division or the division's designee may disclose portions of a driving record, in accordance with this Subsection (3), to:

      1. (i) an insurer as defined under Section 31A-1-301, or a designee of an insurer, for purposes of assessing driving risk on the insurer's current motor vehicle insurance policyholders;
      2. (ii) an employer or a designee of an employer, for purposes of monitoring the driving record and status of current employees who drive as a responsibility of the employee's employment if the requester demonstrates that the requester has obtained the written consent of the individual to whom the information pertains;
      3. (iii) an employer or the employer's agents to obtain or verify information relating to a holder of a commercial driver license that is required under 49 U.S.C. Chapter 313; and
      4. (iv) a county assessor for purposes of verifying eligibility for the residential property tax exemption described in Section 59-2-103.

   2. (b) A disclosure under Subsection (3)(a)(i) shall:

      1. (i) include the licensed driver's name, driver license number, date of birth, and an indication of whether the driver has had a moving traffic violation that is a reportable violation, as defined under Section 53-3-102 during the previous month;
      2. (ii) be limited to the records of drivers who, at the time of the disclosure, are covered under a motor vehicle insurance policy of the insurer; and
      3. (iii) be made under a contract with the insurer or a designee of an insurer.

   3. (c) A disclosure under Subsection (3)(a)(ii) or (iii) shall:

      1. (i) include the licensed driver's name, driver license number, date of birth, and an indication of whether the driver has had a moving traffic violation that is a reportable violation, as defined under Section 53-3-102, during the previous month;
      2. (ii) be limited to the records of a current employee of an employer;
      3. (iii) be made under a contract with the employer or a designee of an employer; and

      4. (iv) include an indication of whether the driver has had a change reflected in the driver's:

         1. (A) driving status;
         2. (B) license class;
         3. (C) medical self-certification status; or
         4. (D) medical examiner's certificate under 49 C.F.R. Sec. 391.45.

   4. (d) The contract under Subsection (3)(b)(iii) or (c)(iii) shall specify:

      1. (i) the criteria for searching and compiling the driving records being requested;
      2. (ii) the frequency of the disclosures;
      3. (iii) the format of the disclosures, which may be in bulk electronic form; and
      4. (iv) a reasonable charge for the driving record disclosures under this Subsection (3).

   5. (e)

      1. (i) A disclosure under Subsection (3)(a)(iv) shall:

         1. (A) include the licensed driver's name, date of birth, and current residential address; and
         2. (B) be made upon request by a county assessor.
      2. (ii) A county assessor may use information disclosed by the division under Subsection (3)(a)(iv) only for purposes of verifying a property owner's eligibility to receive the residential property tax exemption authorized under Section 59-2-103.

4. (4)

   1. (a) Notwithstanding Subsection (1)(a), the division may provide a "yes" or "no" response to an electronically submitted request to verify information from a driver license or identification card issued by the division if:

      1. (i) the request is made by a private entity operating under the Transportation Security Administration Registered Traveler program;
      2. (ii) the private entity implements the Transportation Security Administration enrollment standards; and

      3. (iii) the program participant:

         1. (A) voluntarily provides the participant's division-issued identification to confirm the participant's identity; and
         2. (B) consents to verification of the participant's name, date of birth, and home address.
   2. (b) The data described in Subsection (4)(a)(iii)(B) may only be used to enroll or reenroll the participant in the Transportation Security Administration Registered Traveler program.
   3. (c) The division may not furnish a "yes" response under Subsection (4)(a) unless all data fields match.

5. (5) The division may charge fees:

   1. (a) in accordance with Section 53-3-105 for searching and compiling its files or furnishing a report on the driving record of a person;
   2. (b) for each document prepared under the seal of the division and deliver upon request, a certified copy of any record of the division, and charge a fee set in accordance with Section 63J-1-504 for each document authenticated;
   3. (c) established in accordance with Section 63J-1-504, for disclosing personal identifying information under Subsection (1)(b); and
   4. (d) established in accordance with Section 63J-1-504, for each response under Subsection (4).
6. (6) Each certified copy of a driving record furnished in accordance with this section is admissible in any court proceeding in the same manner as the original.

7. (7)

   1. (a) A driving record furnished under this section may only report on the driving record of a person for a period of 10 years.
   2. (b) Subsection (7)(a) does not apply to court or law enforcement reports, reports of commercial driver license violations, or reports for commercial driver license holders.

8. (8)

   1. (a) The division shall include on each application for or renewal of a license or identification card under this chapter:

      1. (i) the following notice: "The Driver License Division may disclose the information provided on this form to an entity described in Utah Code Ann. Subsection 53-3-109(1)(b)(v).";
      2. (ii) a reference to the website described in Subsection (8)(b); and

      3. (iii) a link to the division website for:

         1. (A) information provided by the division, after consultation with the University of Utah, containing the explanation and description described in Subsection (8)(b); and
         2. (B) an online form for the individual to opt out of the disclosure of personal identifying information described in Subsection (1)(b)(v).

   2. (b) In consultation with the division, the University of Utah shall create a website that provides an explanation and description of:

      1. (i) what information may be disclosed by the division to the University of Utah under Subsection (1)(b)(v);
      2. (ii) the methods and timing of anonymizing the information;

      3. (iii) for situations where the information is not anonymized:

         1. (A) how the information is used;
         2. (B) how the information is secured;
         3. (C) how long the information is retained; and
         4. (D) who has access to the information;
      4. (iv) research and statistical purposes for which the information is used; and
      5. (v) other relevant details regarding the information.

   3. (c) The website created by the University of Utah described in Subsection (8)(b) shall include the following:

      1. (i) a link to the division website for an online form for the individual to opt out of the disclosure of personal identifying information as described in Subsection (1)(b)(v); and
      2. (ii) a link to an online form for the individual to affirmatively choose to remove, subject to Subsection (8)(e)(ii), personal identifying information from the database controlled by the University of Utah that was disclosed in accordance with Subsection (1)(b)(v).

   4. (d) In the course of business, the division shall provide information regarding the disclosure of personal identifying information, including providing on the division website:

      1. (i) a link to the website created under Subsection (8)(b) to provide individuals with information regarding the disclosure of personal identifying information under Subsection (1)(b)(v); and

      2. (ii) a link to the division website for:

         1. (A) information provided by the division, after consultation with the University of Utah, containing the explanation and description described in Subsection (8)(b); and
         2. (B) an online form for the individual to opt out of the disclosure of personal identifying information as described in Subsection (1)(b)(v).

   5. (e)

      1. (i) The division may not disclose the personal identifying information under Subsection (1)(b)(v) if an individual opts out of the disclosure as described in Subsection (8)(a)(iii)(B) or (8)(c)(i).

      2. (ii)

         1. (A) Except as provided in Subsection (8)(e)(ii)(B), if an individual makes a request as described in Subsection (8)(c)(ii), the University of Utah shall, within 90 days of receiving the request, remove and destroy the individual's personal identifying information received under Subsection (1)(b)(v) from a database controlled by the University of Utah.
         2. (B) The University of Utah is not required to remove an individual's personal identifying information as described in Subsection (8)(e)(ii)(A) from data released to a research study before the date of the request described in Subsection (8)(c)(ii).
   6. (f) The University of Utah shall conduct a biennial internal information security audit of the information systems that store the data received in accordance with Subsection (1)(b)(v), and, beginning in the year 2023, provide a biennial report of the findings of the internal audit to the Transportation Interim Committee.

9. (9) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division may make rules to designate:

   1. (a) what information shall be included in a report on the driving record of a person;
   2. (b) the form of a report or copy of the report which may include electronic format;
   3. (c) the form of a certified copy, as required under Section 53-3-216, which may include electronic format;
   4. (d) the form of a signature required under this chapter which may include electronic format;
   5. (e) the form of written request to the division required under this chapter which may include electronic format;
   6. (f) the procedures, requirements, and formats for disclosing personal identifying information under Subsection (1)(b); and
   7. (g) the procedures, requirements, and formats necessary for the implementation of Subsection (3).

10. (10)

    1. (a) It is a class B misdemeanor for a person to knowingly or intentionally access, use, disclose, or disseminate a record created or maintained by the division or any information contained in a record created or maintained by the division for a purpose prohibited or not permitted by statute, rule, regulation, or policy of a governmental entity.
    2. (b) A person who discovers or becomes aware of any unauthorized use of records created or maintained by the division shall inform the commissioner and the division director of the unauthorized use.

Amended by Chapter 35, 2026 General Session