Washington State

House of Representatives

Office of Program Research

BILL

ANALYSIS

Technology & Economic Development Committee

HB 2875

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

Brief Description: Establishing the office of data privacy, protection, and access equity.

Sponsors: Representatives Smith, Morris and Magendanz.

Brief Summary of Bill

  • Establishes an Office of Data Privacy, Protection, and Access Equity within the Department of Enterprise Services.

Hearing Date: 2/2/16

Staff: Jasmine Vasavada (786-7301).

Background:

Executive Order 16-01.

In January 2016 Governor Inslee issued Executive Order 16-01 establishing an Office of Privacy and Data Protection (Office). The stated intent of the Executive Order is to ensure that state agencies comply fully with state public records and open government laws, while seeking to protect personal information to the maximum extent possible. The Office shall work with state agencies to promote data minimization, monitor sale of personally identifiable information or lists of individuals to third parties, examine data retention practices, update privacy policies, and monitor citizen complaints regarding the collection and use of personal information. The Office must conduct an annual privacy review and annual privacy training, articulate privacy principles and best practices, and educate consumers through public outreach across Washington. The Office must coordinate data protection and security measures in cooperation with Washington Technology Solutions and the Office of the Chief Information Officer (OCIO), participate with the OCIO in the review of major projects involving personally identifiable information, and brief the OCIO and the Office of Cyber Security on the privacy issues relating to risk management and cyber-attack threat analysis and liability. "Personally identifiable information" means information collected by a state agency about a natural person that is readily identifiable to that specific individual.

Broadband Regulation.

The role of a state in enacting laws regulating broadband access and quality is limited by federal law. Under the Federal Telecommunications Act, the Federal Communications Commission (FCC) has explicit authority to preempt certain state laws that regulate access to telecommunications services, including broadband. In addition, the FCC is delegated authority to accomplish specific regulatory objectives and its rules implementing these objectives may preempt conflicting state laws. The FCC, in a 2010 declaratory ruling sought by the National Association of Regulatory Utility Commissioners, concluded that state efforts to mandate broadband information collection had not been preempted.

Access to Advanced Telecommunications Capability.

Congress directed the FCC to evaluate and annually report on whether advanced telecommunications capability, often referred to more simply as broadband, is being deployed to all Americans in a reasonable and timely fashion. The term "advanced telecommunications capability" is defined in federal law as high-speed, switched, broadband telecommunications capability that enables users to originate and receive high-quality voice, data, graphics, and video telecommunications using any technology. In its 2015 report, the FCC concluded that for the average household to have advanced telecommunications capability now requires actual download speeds of at least 25 megabits per second (Mbps) and actual upload speeds of at least 3 Mbps. This new benchmark replaced a 2010 benchmark that was 4 Mbps down and 1 Mbps up. The FCC's annual evaluation presents data on access to broadband in each state, broken down to show access in urban areas, rural areas, and on tribal lands.

Summary of Bill:

Office of Data Privacy, Protection, and Access Equity.

An Office of Data Privacy, Protection, and Access Equity (Office) is created in the Department of Enterprise Services. The purpose of the Office is to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection, and to serve as a forum for ensuring equitable consumer access to communications and data technology. The Governor must appoint the director, who may employ such staff as necessary to carry out the duties of the Office.

Duties Pertaining to State Agencies.

The Office must conduct an annual privacy review, conduct an annual privacy training, and articulate privacy principles and best practices for state agencies. The Office must, in cooperation with Washington Technology Solutions and the OCIO, coordinate data protection and security measures and participate in the review of major state agency projects involving personally identifiable information. The Office must consult with and advise the OCIO and the Office of Cyber Security on privacy issues relating to risk management and cyber attack threat analysis and liability. The Office must cooperate and consult with the State Auditor in audits of state government and local agencies' data storage and management practices.

Public Education.

The Office must serve as a resource to local governments and the public on data privacy and protection concerns, by developing and promoting the dissemination of best practices for the collection and storage of personally identifiable information, including establishing and conducting a training program or programs for local governments and educating consumers about the use of personally identifying information on mobile and digital networks, and measures that can help protect such information.

Personally Identifiable Information.

"Personally identifiable information" means information collected by a state agency about a natural person that is readily identifiable to that specific individual.

Evaluation of Access Equity.

The Office must evaluate the extent to which consumers across the state have functional access to telecommunications capability that permits their full participation in an advanced, data-driven economy. By December 1, 2016, the Office must prepare and submit to the Legislature a report evaluating the extent to which telecommunications providers in the state are deploying advanced telecommunications capability at benchmark speeds for download and upload. The report must assess the existence of a digital divide in the state, considering inequality in access of residents of urban areas, rural areas, tribal lands, and economically distressed communities, and report on the extent to which the connectivity of schools, tribes, and rural areas is achieving the FCC's short-term and long-term goals for connectivity to advanced telecommunications capabilities. The Office is encouraged to make recommendations about whether definitions for "benchmark speed" or "advanced telecommunications capability" require updating in order to better facilitate evaluation of the existence of a digital divide and inequalities in achieving fundamental access to technology required for economic development in a data-driven economy.

"Advanced telecommunications capability" means access to both mobile broadband and fixed broadband through a high-speed, high-capacity connection capable of supporting bandwidth-intensive uses by multiple users in a household or business. "Benchmark speed" means the speed established by the federal communications commission as the benchmark for measuring broadband deployment in its most recent broadband progress report made pursuant to the Telecommunications Act. The report must be updated every four years.

Performance Measures and JLARC Review.

The Office must establish performance measures in its 2016 report to the Legislature and, in each report thereafter, demonstrate the extent to which performance results have been achieved. Certain performance measures are specified, for example metrics pertaining to the Office's training, coordination, consumer education, and outreach efforts. The report must include a qualitative summary of how documentation of the digital divide may have informed public discussion about the issue. The Office must submit the performance measures and a data collection plan for review and comment to the Joint Legislative Audit and Review Committee within one year of the Act's effective date.

Appropriation: None.

Fiscal Note: Requested on January 28, 2016.

Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is passed.