Companies from California to New York are already scrambling to comply with a growing patchwork of privacy laws covering both businesses and consumers.

And now, Utah has picked up the proverbial gauntlet and is poised to become the first state to enact a privacy law that requires local law enforcement to obtain a search warrant to access electronic information stored by third parties. The new law – called the “Electronic Information or Data Privacy Act” or H.B. 57 – would give Utah the distinction of having the strongest data privacy laws in the U.S. when law enforcement is faced with accessing electronic information from a third-party.

The bill’s chief sponsor is Rep. Craig Hall, R-Utah. The bill was passed by the state’s legislature earlier last month and sent to Utah Governor Gary Herbert (R) on March 22^nd. It is expected to be signed into law shortly.

Under the bill, local law enforcement will need to obtain a warrant to obtain information from email platforms, wireless service providers, search engines and social media companies. Up until now, law enforcement generally was not required to obtain a search warrant before accessing electronic information stored by third-parties under the theory that there was no expectation of privacy when individuals shared their information with the third-parties.

The Utah bill follows last year’s United States Supreme Court ruling in Carpenter v. United States, which held that that the government generally needs a warrant to collect location information about the customers of cell phone companies. The ruling was hailed as a “major statement on privacy in the digital age.” The 5-4 ruling was confined to location information with the dissenting justices arguing that new legislation was needed to deal with this emerging area of law, much of which is driven by technology.

Key aspects of the Utah bill include:

• “[F]or a criminal investigation or prosecution, a law enforcement agency may not obtain, without a search warrant issued by a court upon probable cause,” location information, stored data or transmitted data;
• Subject to several exceptions, prohibits law enforcement from using such electronic information in a case that has been obtained without a valid search warrant;
• Generally, requires that, within 14-days after a search warrant is issued, the owner of the electronic device or information that is the subject of the warrant must be notified; and,
• The definition of electronic information is broad and includes “information or data including a sign, signal, writing, sound or intelligence or any nature transmitted or stored in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system."

Utah isn’t the only state that will venture into this new territory governing the way companies will respond to information requests from government agencies. Other states are likely to follow Utah’s lead. We’ll continue to monitor and report on significant developments in this area.