DAR File No. 43836

Attorney General, Administration

Rule R105-4

Child Protection Registry

Notice of Proposed Rule

(New Rule)

DAR File No.: 43836
Filed: 06/28/2019 12:54:51 PM

RULE ANALYSIS

Purpose of the rule or reason for the change:

This new rule complies with the new legislative mandate, S.B. 230 (2019 General Session), requiring the Internet Crimes Against Children Unit of the Attorney General's Office to establish and operate the Child Protection Registry.

Summary of the rule or change:

This new rule transfers the establishment and operation of the Child Protection Registry from the Division of Consumer Protection to the Internet Crimes Against Children Unit of the Utah Attorney General's Office. (EDITOR'S NOTE: The proposed repeal of Rule R152-39 is under Filing No. 43845 in this issue, July 15, 2019, of the Bulletin.)

Statutory or constitutional authorization for this rule:

• Title 13, Chapter 39

Anticipated cost or savings to:

the state budget:

There will be no net change as this rule transfers the operation of the Child Protection Registry from one state agency to the other.

local governments:

This rule does not have an impact on local governments.

small businesses:

This rule does not have an impact on small businesses.

persons other than small businesses, businesses, or local governmental entities:

This rule does not have an impact on other persons.

Compliance costs for affected persons:

There are no compliance costs.

Comments by the department head on the fiscal impact the rule may have on businesses:

The head of the Department, Sean Reyes, Utah Attorney General, has signed off on this analysis.

Sean Reyes, Attorney General

The full text of this rule may be inspected, during regular business hours, at the Office of Administrative Rules, or at:

Attorney General
Administration
Room 230 UTAH STATE CAPITOL
350 N STATE ST
SALT LAKE CITY, UT 84114

Direct questions regarding this rule to:

• Michelle Kfoury at the above address, by phone at 801-865-2015, by FAX at , or by Internet E-mail at mkfoury@agutah.gov

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

08/14/2019

This rule may become effective on:

08/21/2019

Authorized by:

Brian Tarbet, Deputy Attorney General

Appendix 1: Regulatory Impact Summary Table*

Fiscal Costs	FY 2020	FY 2021	FY 2022
State Government	$0	$0	$0
Local Government	$0	$0	$0
Small Businesses	$0	$0	$0
Non-Small Businesses	$0	$0	$0
Other Person	$0	$0	$0
Total Fiscal Costs:	$0	$0	$0
Fiscal Benefits
State Government	$0	$0	$0
Local Government	$0	$0	$0
Small Businesses	$0	$0	$0
Non-Small Businesses	$0	$0	$0
Other Persons	$0	$0	$0
Total Fiscal Benefits:	$0	$0	$0
Net Fiscal Benefits:	$0	$0	$0

 

*This table only includes fiscal impacts that could be measured. If there are inestimable fiscal impacts, they will not be included in this table. Inestimable impacts for State Government, Local Government, Small Businesses and Other Persons are described in the narrative. Inestimable impacts for Non-Small Businesses are described in Appendix 2.

 

Appendix 2: Regulatory Impact to Non-Small Businesses

No regulatory impact on non-small businesses. No regulatory changes are being made to this rule. This new rule transfers the operation and enforcement of the Child Protection Registry from one state agency to the other.

 

 

R105. Attorney General, Administration.

R105-4. Child Protection Registry.

R105-4-1. Authority and Purpose.

Pursuant to Utah Code Section 13-39-203, these rules (R105-4) are intended to establish the procedures under which:

(1) A person may register a contact point with the registry; and

(2) A marketer may verify compliance with the registry.

 

R105-4-2. Definitions.

As used in these rules (105-4):

(1) "Attorney General is as defined in Utah Code Section 77-42-102.

(2) "Contact point" is as defined in Utah Code Section 13-39-102.

(3) "Marketer" means a person described in Utah Code Section 13-39-201(4).

(4) "Provider" means the third party with whom the Unit has contracted, pursuant to Utah Code Section 13-39-201(1)(b), to establish and secure the registry.

(5) "Registry" is as defined in Utah Code Section 13-39-102.

(6) "Unit" is as defined in Utah Code Section 13-39-102.

 

R105-4-3. Information Required to Register.

(1) A person desiring to register a contact point with the registry shall provide the following information to the provider:

(a) The contact point the person desires to register;

(b) An affirmation that:

(i) the contact point belongs to a minor;

(ii) a minor has access to the contact point; or

(iii) the contact point is used in a household in which a minor is present;

(c) an affirmation that the minor referenced in R105-4-3(1)(b) is a Utah resident; and

(d) an affirmation that the person registering the contact point is:

(i) the minor referenced in R105-4-3(1)(b); or

(ii) a parent or guardian of the minor referenced in R105-4-3(1)(b).

(2) A contact point may not become a part of the registry until the provider sends a message to the contact point informing the user of the contact point:

(a) the contact point has been registered; and

(b) the process for removing the contact point from the registry.

(3) A school or institution desiring to register a domain name shall provide verification to the provider that:

(a) the school or institution primarily serves minors; and

(b) the school or institution owns the domain name being registered.

 

R105-4-4. Information Required to Verify Compliance.

A marketer desiring to verify compliance with the registry shall provide the following information to the provider before the provider compares the marketer's contact point list against the registry:

(1) the name, address, and telephone number of the marketer;

(2) the specific legal nature and corporate status of the marketer;

(3) the name, address, and telephone number of a natural person who consents to service of process for the marketer; and

(4) an affirmation that the person described in R105-4-4(3) understands that improper use of information obtained from the registry is a second degree felony.

 

R105-4-5. Compliance.

(1) After a marketer has complied with R105-4-4 and paid the fee established by the Unit under Section 13-39-201(4)(b), the marketer may check the marketer's contact point list with the provider according to the privacy and security measures implemented by the provider.

(2) After a marketer has complied with R105-4-5(1) and paid the fee established by the Unit under Section 13-39-201(4)(b), the provider shall, according to the privacy and security measures implemented by the provider, remove from the marketer's list of contact points any contact points that are contained on the registry.

(3)(a) A marketer who desires to utilize the provisions of Subsection 13-39-202(4) shall:

(i) provide the Unit with a detailed description of the methods the marketer intends to use to verify compliance with Subsection 13-39-202(4); and

(ii) agree to provide to the Unit, at any time upon request by the Unit, copies of all documentation relating to the marketer's compliance with Subsection 13-39-202(4).

(b) Within thirty calendar days after a marketer complies with R105-4-5(3)(a), the Unit shall inform the marketer in writing whether the Unit considers the marketer's methods sufficient to verify compliance with Subsection 13-39-202(4).

(c)(i) Approval of a verification method for compliance with Subsection 13-39-202(4) does not prevent the Unit from investigating further whether the approved verification method actually guarantees compliance with Subsection 13-39-202(4).

(ii) The Unit may revoke an approval granted pursuant to R105-4-5(3) upon a finding that the verification method does not adequately guarantee compliance with Subsection 13-39-202(4).

 

R105-4-6. Discounted Fee.

(1) In order for senders to qualify for the discounted fee schedule established pursuant to Subsection 13-39-203(3)(a), a sender must agree to be subject to enhanced security criteria for each subsequent list that they may submit to the state's compliance mechanism. To meet these criteria, senders must affirmatively agree that their scrubbing tasks may be stopped if a particular task deviates from a statistically normal baseline.

(2) The statistical baseline used for comparison will be based on the senders' past histories as well as the totality of the histories of senders that have used the compliance mechanism to scrub their lists.

(3) To restart a task and retrieve the results, senders whose tasks have been stopped must confirm that they in fact initiated the task and that the list submitted is not an attempt to abuse the registry mechanism. Depending on the amount of the deviation from the baseline, this confirmation may come from a telephone call to a pre-established phone number, completing information online, or sending an e-mail to a customer support representative.

(4) The Unit, or its appointed representative, shall have discretion in allowing the retrieval of tasks if the confirmation does not resolve the security concerns.

 

KEY: Child Protection Registry

Date of Enactment or Last Substantive Amendment: 2019

Authorizing, and Implemented or Interpreted Law: 13-39