SENATE BILL REPORT

SHB 2875

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As of February 25, 2016

Title: An act relating to establishing the office of data privacy, protection, and access equity.

Brief Description: Establishing the office of privacy and data protection.

Sponsors: House Committee on Technology & Economic Development (originally sponsored by Representatives Smith, Morris and Magendanz).

Brief History: Passed House: 2/15/16, 97-0.

Committee Activity: Government Operations & Security: 2/25/16.

SENATE COMMITTEE ON GOVERNMENT OPERATIONS & SECURITY

Staff: Alex Kearns (786-7416)

Background: Office of Privacy and Data Protection (Office). In January 2016 Governor Inslee issued Executive Order 16-01 establishing the Office. The stated intent of the Executive Order is to ensure that state agencies comply fully with state public records and open government laws, while seeking to protect personal information to the maximum extent possible.

Advanced Telecommunications Capability. The Telecommunications Act of 1996 requires the Federal Communications Commission (FCC) to report annually on whether advanced telecommunications capability, commonly referred to as broadband, is being deployed to all Americans in a reasonable and timely fashion. Congress defined broadband as high-quality capability that allows users to originate and receive high-quality voice, data, graphics, and video services. Using updated speed benchmarks adopted in 2015, the 2016 Broadband Progress Report concluded that 10 percent of all Americans (34 million people) lack access to advanced broadband, while 39 percent of rural Americans (23 million people) and 41 percent of Americans living on Tribal lands (1.6 million people) lack access to advanced broadband.

Summary of Bill: Office of Privacy and Data Protection (Office). An Office is created in the Office of the Chief Information Officer (OCIO), with the purpose of serving as a central point of contact for state agencies on policy matters involving data and privacy protection. The Director of OCIO will appoint a Chief Privacy Officer to serve as the Director of the Office.

The primary duties of the Office with respect to state agencies include conducting an annual privacy review and training, articulating privacy principles and best practices, coordinating data protection, and reviewing major state agency projects that involve personally identifiable information in coordination with OCIO. In addition to its duties to state agencies, the Office must serve as a resource to local governments and the public by developing and promoting best practices, conducting trainings, and educating consumers about personal information security on mobile and digital networks.

Every four years, beginning in December 2016, the Office must prepare and submit to the Legislature a report evaluating its performance. The first report submitted in 2016 must establish performance measures, and each subsequent report must demonstrate the extent to which the performance results have been achieved. The Office must submit these performance measures to the Joint Legislative Audit and Review Committee (JLARC) for review and comment within one year of the Act's effective date. JLARC must conduct a program and fiscal review of the Office by June 30, 2025 and report its findings to the legislature and governor by December 1, 2025.

Advanced Telecommunications Capability. At least once every four years the Office must submit a report to the Legislature that shows: (1) the extent to which telecommunication providers in the state are deploying advanced telecommunications capability and (2) the existence of any inequality in access to telecommunications infrastructure experienced by residents of tribal lands, rural areas, and economically distressed communities. The report is only required to the extent that the Office is able to gather and present the information within existing resources.

Appropriation: None.

Fiscal Note: Available.

Committee/Commission/Task Force Created: No.

Effective Date: Ninety days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony: PRO: The Governor's Office issued an executive order creating this Office, so this bill simply establishes the Office in statute. There has been much concern from the public about data privacy. While we do not want to grow government unnecessarily, in this time and place we need someone looking out for the consumer and for the folks who are concerned about the privacy breaches we hear about every day. The Office will look outward to ensure that agencies and consumers are deploying best practices, and that local governments are getting the help they need. Currently, there is nobody in our state looking at the issue of broadband access, and there are some distressed areas like tribal lands where there may be a real disconnect. If you can't have access to the digital economy you are being left behind, so we added a portion that simply asks for a report back on that topic.

Persons Testifying: PRO: Representative Smith, Prime Sponsor.

Persons Signed In To Testify But Not Testifying: PRO: Alex Alben, Washington Technology Solutions/ Chief Privacy Officer; Michael Cockrill, Washington Technology Solutions/ State Chief information Information Officer.