Porn filtering, new privacy protections feature in 2021 Utah session

Utahns are set to see some new protections of their personal digital data and how it is gathered, stored and shared by online companies and government agencies thanks to a handful of bills passed in the 2021 Utah legislative session.

But a pair of proposals adopted by lawmakers, one aiming to place new moderation regulations on social media companies and another that would compel makers of cellphones and tablets to install and switch on porn filtering software for all Utah sales, are likely to run into constitutional challenges and possible litigation if they earn the signature of Gov. Spencer Cox.

SB228 sponsor Sen. Michael McKell, R-Spanish Fork, describes his proposal as a “free speech bill” that would help hold operators of social media platforms responsible, and legally liable, for unfairly applying moderation rules stipulated in the terms of use agreements. These are the contracts that, though rarely read, are required of all users of free social media platforms like Twitter, Facebook, TikTok, YouTube, Instagram and others.

The bill chews at the edges of issues that have riled some federal lawmakers, including Utah Republican Sen. Mike Lee, that include allegations that social media companies are in the habit of unfairly suppressing or censoring conservative political content.

The proposal designates Utah’s state consumer protection division and the attorney general’s office as arbiters and enforcers of the new rules, which could also carry fines up to $1,000 per violation. Social media companies would also be obliged under the bill’s provisions to create expansive and specific lists of “banned” content in those user agreements, be required to provide explanations, within a 24-hour window, whenever a comment, video or other content posting is removed, blocked or hidden, and create an appeals process for users who want to contest moderation decisions.

Tech industry representatives and civil rights watchers are aligned in their concerns that SB228’s provisions run afoul of constitutional protections, as well as contravention of Section 230 of the Communications Decency Act of 1996. That clause, which is widely credited with helping online companies prosper since its inception, also provides legal protection for platform operators against legal issues raised by content published by users under the stipulation that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”

One analogy compares the Section 230 protections to other rules that keep, for example, a bookstore owner safe from legal liability if an author of a book they sold was found guilty of libel.

The bill had a single public hearing in a February Senate committee before getting a supporting vote from that body but moved through the House under a late-session suspension of rules scenario. The House narrowly approved SB228 on a 39-35 vote, and the proposal is headed for Cox’s desk.

Just a few hours before the session’s final gavel fell, Cox told reporters that his initial discomfort with the proposal was somewhat allayed by changes McKell made to the implementation date, pushing it out a year.

“(SB228) went from one that was maybe more of a candidate for a veto to less of a candidate … specifically because the implementation date was changed,” Cox said. “I believe the idea behind that is … a willingness to work on this with social media companies over the course of the next year and maybe come up with something a little more palatable for both sides.”

And Cox acknowledged potential issues with regulating an arena that, perhaps, looks and feels like the public square but is actually a business construct.

“It’s a hard one to fix,” Cox said. “They are private companies and there are First Amendment rights in play here.”

McKell recognized the issue of addressing the rules for internet content moderation is of national concern and would be best addressed at the federal level but said he was told by Utah Republican Rep. Chris Stewart that while members of both parties share concerns and are talking about the problem, Congress “won’t actually fix it.”

Jason Groth, an attorney with the American Civil Liberties Union of Utah, agrees with McKell that the best course of redress would be through federal rules or legislation changes but said the Utah action wasn’t the right approach to addressing concerns.

“This bill is almost certainly unconstitutional,” Groth told Senate committee members in February. “The ACLU has long discouraged big platforms from censoring on the basis of viewpoint. But, it’s an entirely different matter for the government to dictate what online platforms must publish.

“It’s never a good idea for government to require speech. Constitutionality aside, this bill is a waste of time because it’s preempted by Section 230 of the Communications Decency Act.”

And Sen. Jake Anderegg, R-Lehi, while voicing his support of the bill also recognized the likelihood of legal action to follow, but noted that litigation could serve as a catalyst to compel federal action on the issue.

“This is probably going to be sued,” Anderegg said in SB228’s committee hearing. “But isn’t that the point? Let’s push it to the courts and actually have them intervene and help push Congress to get their crap together.”

Spenser Heaps, Deseret News

Porn filtering on cellphones and tablets

A proposal aiming to require manufacturers of cellphones and tablets to have porn filtering software installed and switched on for all sales to Utah customers had a few false starts, going back to interim legislative hearings last fall, but ultimately found enough support to get through the 2021 session.

Supporters of HB72, sponsored by Rep. Susan Pulsipher, R-South Jordan, point to the myriad problems early exposure to explicit content can create for children and believe the bill represents a new tool to help parents keep minors safe.

Opponents of the bill, which include representatives of retailer and manufacturer groups, roundly agree about the harms inherent in children being exposed to adult internet content but argue Pulsipher’s legislation is the wrong way to address the issue.

And civil rights groups believe the mandates would lead to infringement on First Amendment protections.

Whether business and civil rights concerns outweigh how the provision could help parents protect children from harmful internet content is now a question for Cox as the bill awaits his consideration.

Spenser Heaps, Deseret News

New guards on personal information stored in the ‘cloud’

A proposal that would extend Fourth Amendment protections to personal information and documents stored in remote computer servers, commonly referred to as “the cloud,” was left to die on the vine at the end of last year’s session.

But a failure that was more about timing than lack of support — the bill earned unanimous House passage in the waning days of the 2020 legislative conclave but never made it to Senate consideration — looks likely to find a more successful outcome this time around.

HB87 establishes new definitions that stipulate what digital information can be accessed via a subpoena versus information, if sought by law enforcement, that will require a warrant.

The proposal found unanimous approval at every step of the process and is headed for the desk of the governor.

Under the proposal, subscriber information held by a third-party provider — like a person’s name, how long they’ve had an account and other basic user data — could be accessed through the direction of a subpoena. But access to transactional data, documents, etc. would require the higher bar of a warrant.

According to an assessment performed last session by the American Civil Liberties Union of Utah, the bill “establishes that a person who transmits data to a third-party (like a cellphone provider or cloud-based server) maintains ownership of their data and is entitled to a reasonable expectation of privacy.”

New commission to oversee how government handles your personal data

A new law enforcement tool unveiled in 2019 from a Utah-based company called Banjo — that relied on surveillance cameras, location tracking and mining social media sites for information to accomplish its goals — traveled an incredibly short journey from promise to peril after issues with how the platform worked, and the personal history of the founder, became public. But, those issues weren’t brought to light until after Banjo was granted a multimillion-dollar contract with the state of Utah.

This session’s HB243 was constructed to help ensure something similar can’t happen again.

Last spring, the Utah Attorney General’s Office announced the state had suspended use of the technology services of Park City-based Banjo after it was revealed company founder Damien Patton had past connections with a white supremacist group and was involved in a shooting at a Jewish synagogue in the early 1990s. The $21 million contract had also opened the door for dozens of local Utah law enforcement agencies to use Banjo’s services under existing preferred provider agreements.

But even before the revelations of Patton’s past became public, privacy watchdogs questioned the methods by which Banjo gathered information, whether the data was being appropriately scrubbed of personally identifying characteristics, and the veracity of security measures in place to ensure access was limited to appropriate agencies and, even then, used only in specific and justified circumstances.

Sponsored by House Majority Leader Rep. Francis Gibson, R-Mapleton, HB243 creates a permanent committee, housed within the state auditor’s office, that would include topic experts from the realms of internet technology, cybersecurity, law enforcement, data privacy law, data privacy technology and civil liberties law.

The collected experts would be responsible for reviewing technology products and services for how they collect, assess and store personal data and information for state agencies as well as those of Utah municipal and county government operations, including school districts. Overseeing that work would be two new state data privacy officers, one of whom would also be a part of the auditor’s staff and another in the governor’s office.

HB243 ran the tables in the 2021 session, earning unanimous support at every step in the legislative process and will now be considered by the governor.

Kristin Murphy, Deseret News

Two proposals seeking inroads on other areas of personal data privacy earned initial support from lawmakers but failed to make it through the entirety of the legislative process. Both, according to sponsors, are likely to be revisited during the interim session.

How easily should police be able to track your location?

A new tool in wide use by law enforcement agencies across the country can draw a circle on any map and seek out, through chilling data search techniques, who was in or near that area at any specific time.

That’s all thanks to the signals your cellphone is constantly receiving and emitting, whether you’re using it or not.

So if you happened to be walking your dog through that search zone at the same time a crime was committed, you could end up as part of an investigation based on nothing more substantial than easily obtainable records showing everywhere you’ve been with that cellphone in your pocket.

A bill that could have created landmark restrictions on these type of dragnet-style law enforcement searches, ones that can access databases showing not only where you’ve been but what searches you’ve conducted on your browser — even if you’re not a suspect — got toned down by Utah lawmakers but could still lead to some new privacy protections for residents.

In its initial form, Rep. Ryan Wilcox’s HB251 would have created an outright ban on law enforcement access to that stored data without a much more specific and narrow warrant from the outset. But the Ogden Republican’s revised version dropped the attempt at a ban and removed any new stipulations on reverse keyboard searches.

But Wilcox says he still has hope to address both types of data gathering, and even in its current form, HB251 would create some new law enforcement boundaries where none previously existed when it comes to the scope of location data searches.

HB251 earned unanimous support in its committee hearing in the House as well a voter by the full body but failed to advance through the Senate.

A first crack at data sharing opt-out rights for consumers

A proposal aiming to require internet-based companies to get permission from users before they can share gathered personal digital data, as well as extending other rights to help individuals assert some control over their personal information, got a late start in this year’s session. But the proposal earned unanimous support from the Senate Transportation, Public Utilities, Energy and Technology Committee late last month.

Sen. Kirk Cullimore, R-Draper, said his SB200 would, in addition to creating a permission requirement for sharing data, allow consumers to access, correct and delete certain personal data and get reports, on demand, showing what information about them has been shared and with whom.

The proposal has some similarity to consumer privacy legislation adopted by the European Commission several years ago and, more recently, by California via the California Consumer Privacy Act and California Privacy Rights Act.

Business leaders are raising some concerns about the potential cost and complexity of complying with the new rules, but the proposal earned a unanimous vote from committee lawmakers.

That would, however, be as far as the proposal would go as it failed to advance out of the Senate before the final gavel fell on the 2021 session.