House OKs substitute limiting state collection of location-based contact-tracing data

The Utah House adopted a substitute to House Bill 5001 on June 18 that narrows and governs government collection of location information tied to contact-tracing and tracking apps.

Representative Spendlove presented the bill as a privacy-protection measure: entities working with the state may not sell or otherwise share covered tracing information beyond the state, must destroy information when appropriate, and must obtain affirmative consent before collecting certain personal information. Representative Stratton’s second substitute further requires legislative approval — by concurrent resolution with the governor — before a government entity may commence collection of covered location information. The substitute also requires termination of existing contracts for covered collection and certified destruction of covered location information collected under those contracts within specified time periods, with criminal penalties described in the bill for noncompliance.

During floor discussion, members raised questions about scope (location data versus personally identifiable information), timing concerns for legislative concurrence when not in session, the impact on existing contracts, and the operational effects for the Department of Health. Sponsors responded that the language preserves contractual payment obligations incurred before the bill’s effective date but prevents further data gathering until the legislative approval process is complete.

Representative Brammer and others supported the substitute, calling it a strong signal about protecting citizens’ medical privacy. The House adopted the second substitute and passed HB 5001 (second substitute) by recorded vote 71-0; the bill will be transmitted to the Senate.

The legislation focuses narrowly on tracking-and-tracing data; the sponsor and supporters said other statutory protections remain for more traditional public-health data collection.