AN ACT Relating to enhancing personal information privacy protections in government entities; amending RCW 46.52.130, 42.56.120, and 42.56.420; adding a new section to chapter 19.215 RCW; and adding a new chapter to Title 40 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

(a) Develop an agency personal information minimization policy to reduce the use and retention of personal information wherever possible;

(b) Create a work plan that uses a Gantt chart or similar project planning tool for the following, including the estimated costs of execution:

(i) An inventory of all personal information prepared, owned, used, or retained by the agency, that would include the specific type of information, the purpose for its collection, and the extent to which the information is protected from unauthorized access; and

(ii) A map of the physical or digital location of all personal information collected by the agency, that would be indexed to the inventory created in (b)(i) of this subsection; and

(c) Report the work plan created under (b) of this subsection to the state office of privacy and data protection no later than December 15, 2018.

(2) Agency privacy officers designated under subsection (1) of this section must complete a training course provided by the state office of privacy and data protection on privacy best practices. The training course must be completed no later than sixty days after assuming responsibilities as an agency privacy officer, and at intervals of no more than four years as long as they maintain the designation.

(3) Any inventory or data map records created under subsection (1)(b) of this section that reveal the location of personal information or the extent to which it is protected may not be disclosed under the public records act, chapter 42.56 RCW.

(4) On December 1st of each odd-numbered year, the department of licensing must report to the legislature on the implementation and maintenance of this section, including best practices and recommendations for developing and implementing the department's policy and plan under this section.

(5) For purposes of this section, "personal information" has the same meaning as in RCW 42.56.590(5).

NEW SECTION.  Sec. 2.  A new section is added to chapter 19.215 RCW to read as follows:

A governmental entity is prohibited from furnishing without charge or selling, or charging for:

(1) Personal financial and health information, except information furnished in an abstract driving record, pursuant to RCW 46.52.130; and

(2) Personal identification numbers issued by a government entity.

Sec. 3.  RCW 46.52.130 and 2017 c 43 s 2 are each amended to read as follows:

Upon a proper request, the department may furnish an abstract of a person's driving record as permitted under this section.

(1) Contents of abstract of driving record. An abstract of a person's driving record, whenever possible, must include:

(a) An enumeration of motor vehicle accidents in which the person was driving, including:

(i) The total number of vehicles involved;

(ii) Whether the vehicles were legally parked or moving;

(iii) Whether the vehicles were occupied at the time of the accident; and

(iv) Whether the accident resulted in a fatality;

(b) Any reported convictions, forfeitures of bail, or findings that an infraction was committed based upon a violation of any motor vehicle law;

(c) The status of the person's driving privilege in this state; and

(d) Any reports of failure to appear in response to a traffic citation or failure to respond to a notice of infraction served upon the named individual by an arresting officer.

(2) Release of abstract of driving record. An abstract of a person's driving record may be furnished to the following persons or entities:

(a) Named individuals. (i) An abstract of the full driving record maintained by the department may be furnished to the individual named in the abstract.

(ii) Nothing in this section prevents a court from providing a copy of the driver's abstract to the individual named in the abstract or that named individual's attorney, provided that the named individual has a pending or open infraction or criminal case in that court. A pending case includes criminal cases that have not reached a disposition by plea, stipulation, trial, or amended charge. An open infraction or criminal case includes cases on probation, payment agreement or subject to, or in collections. Courts may charge a reasonable fee for the production and copying of the abstract for the individual.

(b) Employers or prospective employers. (i)(A) An abstract of the full driving record maintained by the department may be furnished to an employer or prospective employer or an agent acting on behalf of an employer or prospective employer of the named individual for purposes related to driving by the individual as a condition of employment or otherwise at the direction of the employer.

(B) Release of an abstract of the driving record of an employee or prospective employee requires a statement signed by: (I) The employee or prospective employee that authorizes the release of the record; and (II) the employer attesting that the information is necessary for employment purposes related to driving by the individual as a condition of employment or otherwise at the direction of the employer. If the employer or prospective employer authorizes an agent to obtain this information on their behalf, this must be noted in the statement. The statement must also note that any information contained in the abstract related to an adjudication that is subject to a court order sealing the juvenile record of an employee or prospective employee may not be used by the employer or prospective employer, or an agent authorized to obtain this information on their behalf, unless required by federal regulation or law. The employer or prospective employer must afford the employee or prospective employee an opportunity to demonstrate that an adjudication contained in the abstract is subject to a court order sealing the juvenile record.

(C) Upon request of the person named in the abstract provided under this subsection, and upon that same person furnishing copies of court records ruling that the person was not at fault in a motor vehicle accident, the department must indicate on any abstract provided under this subsection that the person was not at fault in the motor vehicle accident.

(D) No employer or prospective employer, nor any agent of an employer or prospective employer, may use information contained in the abstract related to an adjudication that is subject to a court order sealing the juvenile record of an employee or prospective employee for any purpose unless required by federal regulation or law. The employee or prospective employee must furnish a copy of the court order sealing the juvenile record to the employer or prospective employer, or the agent of the employer or prospective employer, as may be required to ensure the application of this subsection.

(ii) In addition to the methods described in (b)(i) of this subsection, the director may enter into a contractual agreement with an employer or its agent for the purpose of reviewing the driving records of existing employees for changes to the record during specified periods of time. The department shall establish a fee for this service, which must be deposited in the highway safety fund. The fee for this service must be set at a level that will not result in a net revenue loss to the state. Any information provided under this subsection must be treated in the same manner and is subject to the same restrictions as driving record abstracts.

(c) Volunteer organizations. (i) An abstract of the full driving record maintained by the department may be furnished to a volunteer organization or an agent for a volunteer organization for which the named individual has submitted an application for a position that would require driving by the individual at the direction of the volunteer organization.

(ii) Release of an abstract of the driving record of a prospective volunteer requires a statement signed by: (A) The prospective volunteer that authorizes the release of the record; and (B) the volunteer organization attesting that the information is necessary for purposes related to driving by the individual at the direction of the volunteer organization. If the volunteer organization authorizes an agent to obtain this information on their behalf, this must be noted in the statement.

(d) Transit authorities. An abstract of the full driving record maintained by the department may be furnished to an employee or agent of a transit authority checking prospective volunteer vanpool drivers for insurance and risk management needs.

(e) Insurance carriers. (i) An abstract of the driving record maintained by the department covering the period of not more than the last three years may be furnished to an insurance company or its agent:

(A) That has motor vehicle or life insurance in effect covering the named individual;

(B) To which the named individual has applied; or

(C) That has insurance in effect covering the employer or a prospective employer of the named individual.

(ii) The abstract provided to the insurance company must:

(A) Not contain any information related to actions committed by law enforcement officers or firefighters, as both terms are defined in RCW 41.26.030, or by Washington state patrol officers, while driving official vehicles in the performance of their occupational duty, or by registered tow truck operators as defined in RCW 46.55.010 in the performance of their occupational duties while at the scene of a roadside impound or recovery so long as they are not issued a citation. This does not apply to any situation where the vehicle was used in the commission of a misdemeanor or felony;

(B) Include convictions under RCW 46.61.5249 and 46.61.525, except that the abstract must report the convictions only as negligent driving without reference to whether they are for first or second degree negligent driving; and

(C) Exclude any deferred prosecution under RCW 10.05.060, except that if a person is removed from a deferred prosecution under RCW 10.05.090, the abstract must show the deferred prosecution as well as the removal.

(iii) Any policy of insurance may not be canceled, nonrenewed, denied, or have the rate increased on the basis of information regarding an accident included in the abstract of a driving record, unless the policyholder was determined to be at fault.

(iv) Any insurance company or its agent, for underwriting purposes relating to the operation of commercial motor vehicles, may not use any information contained in the abstract relative to any person's operation of motor vehicles while not engaged in such employment. Any insurance company or its agent, for underwriting purposes relating to the operation of noncommercial motor vehicles, may not use any information contained in the abstract relative to any person's operation of commercial motor vehicles.

(v) The director may enter into a contractual agreement with an insurance company or its agent for the limited purpose of reviewing the driving records of existing policyholders for changes to the record during specified periods of time. The department shall establish a fee for this service, which must be deposited in the highway safety fund. The fee for this service must be set at a level that will not result in a net revenue loss to the state. Any information provided under this subsection must be treated in the same manner and is subject to the same restrictions as driving record abstracts.

(f) Alcohol/drug assessment or treatment agencies. An abstract of the driving record maintained by the department covering the period of not more than the last five years may be furnished to an alcohol/drug assessment or treatment agency approved by the department of social and health services to which the named individual has applied or been assigned for evaluation or treatment, for purposes of assisting employees in making a determination as to what level of treatment, if any, is appropriate, except that the abstract must:

(i) Also include records of alcohol-related offenses, as defined in RCW 46.01.260(2), covering a period of not more than the last ten years; and

(ii) Indicate whether an alcohol-related offense was originally charged as a violation of either RCW 46.61.502 or 46.61.504.

(g) Attorneys—City attorneys, county prosecuting attorneys, and named individual's attorney of record. An abstract of the full driving record maintained by the department, including whether a recorded violation is an alcohol-related offense, as defined in RCW 46.01.260(2), that was originally charged as a violation of either RCW 46.61.502 or 46.61.504, may be furnished to city attorneys, county prosecuting attorneys, or the named individual's attorney of record. City attorneys, county prosecuting attorneys, or the named individual's attorney of record may provide the driving record to alcohol/drug assessment or treatment agencies approved by the department of social and health services to which the named individual has applied or been assigned for evaluation or treatment.

(h) State colleges, universities, or agencies, or units of local government. An abstract of the full driving record maintained by the department may be furnished to (i) state colleges, universities, or agencies for employment and risk management purposes or (ii) units of local government authorized to self-insure under RCW 48.62.031 for employment and risk management purposes.

(i) Superintendent of public instruction. An abstract of the full driving record maintained by the department may be furnished to the superintendent of public instruction for review of public school bus driver records. The superintendent or superintendent's designee may discuss information on the driving record with an authorized representative of the employing school district for employment and risk management purposes.

(3) Release to third parties, or for commercial purposes, prohibited. (a) Any person or entity receiving an abstract of a person's driving record under subsection (2)(b) through (i) of this section shall use the abstract exclusively for his, her, or its own purposes or as otherwise expressly permitted under this section, and shall not divulge any information contained in the abstract to a third party.

(4) Fee. The director shall collect a ((thirteen dollar)) fee for each abstract of a person's driving record furnished by the department. The fee must include:

(a) Thirteen dollars for each abstract, fifty percent of ((the fee)) which must be deposited in the highway safety fund, and fifty percent of ((the fee)) which must be deposited according to RCW 46.68.038; and

(iii) The preparation and submission of the biennial report required under section 1(4) of this act.

(5) Violation. (a) Any negligent violation of this section is a gross misdemeanor.

(b) Any intentional violation of this section is a class C felony.

(6) Effective July 1, 2019, the contents of a driving abstract pursuant to this section shall not include any information related to sealed juvenile records unless that information is required by federal law or regulation.

Sec. 4.  RCW 42.56.120 and 2017 c 304 s 3 are each amended to read as follows:

(1) No fee shall be charged for the inspection of public records or locating public documents and making them available for copying, except as provided in RCW 42.56.240(14) and subsection (3) of this section. A reasonable charge may be imposed for providing copies of public records and for the use by any person of agency equipment or equipment of the office of the secretary of the senate or the office of the chief clerk of the house of representatives to copy public records, which charges shall not exceed the amount necessary to reimburse the agency, the office of the secretary of the senate, or the office of the chief clerk of the house of representatives for its actual costs directly incident to such copying. When calculating any fees authorized under this section, an agency shall use the most reasonable cost-efficient method available to the agency as part of its normal operations. If any agency translates a record into an alternative electronic format at the request of a requestor, the copy created does not constitute a new public record for purposes of this chapter. Scanning paper records to make electronic copies of such records is a method of copying paper records and does not amount to the creation of a new public record.

(2)(a) Agency charges for actual costs may only be imposed in accordance with the costs established and published by the agency pursuant to RCW 42.56.070(7), and in accordance with the statement of factors and manner used to determine the actual costs. In no event may an agency charge a per page cost greater than the actual cost as established and published by the agency.

(b) An agency need not calculate the actual costs it charges for providing public records if it has rules or regulations declaring the reasons doing so would be unduly burdensome. To the extent the agency has not determined the actual costs of copying public records, the agency may not charge in excess of:

(i) Fifteen cents per page for photocopies of public records, printed copies of electronic public records when requested by the person requesting records, or for the use of agency equipment to photocopy public records;

(ii) Ten cents per page for public records scanned into an electronic format or for the use of agency equipment to scan the records;

(iii) Five cents per each four electronic files or attachment uploaded to email, cloud-based data storage service, or other means of electronic delivery; and

(iv) Ten cents per gigabyte for the transmission of public records in an electronic format or for the use of agency equipment to send the records electronically. The agency shall take reasonable steps to provide the records in the most efficient manner available to the agency in its normal operations; and

(v) The actual cost of any digital storage media or device provided by the agency, the actual cost of any container or envelope used to mail the copies to the requestor, and the actual postage or delivery charge.

(c) The charges in (b) of this subsection may be combined to the extent that more than one type of charge applies to copies produced in response to a particular request.

(d) An agency may charge a flat fee of up to two dollars for any request as an alternative to fees authorized under (a) or (b) of this subsection when the agency reasonably estimates and documents that the costs allowed under this subsection are clearly equal to or more than two dollars. An additional flat fee shall not be charged for any installment after the first installment of a request produced in installments. An agency that has elected to charge the flat fee in this subsection for an initial installment may not charge the fees authorized under (a) or (b) of this subsection on subsequent installments.

(e) An agency shall not impose copying charges under this section for access to or downloading of records that the agency routinely posts on its public internet web site prior to receipt of a request unless the requestor has specifically requested that the agency provide copies of such records through other means.

(f) A requestor may ask an agency to provide, and if requested an agency shall provide, a summary of the applicable charges before any copies are made and the requestor may revise the request to reduce the number of copies to be made and reduce the applicable charges.

(3)(a)(i) In addition to the charge imposed for providing copies of public records and for the use by any person of agency equipment copying costs, an agency may include a customized service charge. A customized service charge may only be imposed if the agency estimates that the request would require the use of information technology expertise to prepare data compilations, or provide customized electronic access services when such compilations and customized access services are not used by the agency for other agency purposes.

(ii) The customized service charge may reimburse the agency up to the actual cost of providing the services in this subsection.

(b) An agency may not assess a customized service charge unless the agency has notified the requestor of the customized service charge to be applied to the request, including an explanation of why the customized service charge applies, a description of the specific expertise, and a reasonable estimate cost of the charge. The notice also must provide the requestor the opportunity to amend his or her request in order to avoid or reduce the cost of a customized service charge.

(4) An agency may require a deposit in an amount not to exceed ten percent of the estimated cost of providing copies for a request, including a customized service charge. If an agency makes a request available on a partial or installment basis, the agency may charge for each part of the request as it is provided. If an installment of a records request is not claimed or reviewed, the agency is not obligated to fulfill the balance of the request. An agency may waive any charge assessed for a request pursuant to agency rules and regulations. An agency may enter into any contract, memorandum of understanding, or other agreement with a requestor that provides an alternative fee arrangement to the charges authorized in this section, or in response to a voluminous or frequently occurring request.

Sec. 5.  RCW 42.56.420 and 2017 c 149 s 1 are each amended to read as follows:

The following information relating to security is exempt from disclosure under this chapter:

(1) Those portions of records assembled, prepared, or maintained to prevent, mitigate, or respond to criminal terrorist acts, which are acts that significantly disrupt the conduct of government or of the general civilian population of the state or the United States and that manifest an extreme indifference to human life, the public disclosure of which would have a substantial likelihood of threatening public safety, consisting of:

(a) Specific and unique vulnerability assessments or specific and unique response or deployment plans, including compiled underlying data collected in preparation of or essential to the assessments, or to the response or deployment plans; and

(b) Records not subject to public disclosure under federal law that are shared by federal or international agencies, and information prepared from national security briefings provided to state or local government officials related to domestic preparedness for acts of terrorism;

(2) Those portions of records containing specific and unique vulnerability assessments or specific and unique emergency and escape response plans at a city, county, or state adult or juvenile correctional facility, or secure facility for persons civilly confined under chapter 71.09 RCW, the public disclosure of which would have a substantial likelihood of threatening the security of a city, county, or state adult or juvenile correctional facility, secure facility for persons civilly confined under chapter 71.09 RCW, or any individual's safety;

(3) Information compiled by school districts or schools in the development of their comprehensive safe school plans under RCW 28A.320.125, to the extent that they identify specific vulnerabilities of school districts and each individual school;

(4) Information regarding the public and private infrastructure and security of computer and telecommunications networks, consisting of security passwords, security access codes and programs, access codes for secure software applications, security and service recovery plans, security risk assessments, and security test results to the extent that they identify specific system vulnerabilities, and other such information the release of which may increase risk to the confidentiality, integrity, or availability of security, information technology infrastructure, or assets;

(5) The system security and emergency preparedness plan required under RCW 35.21.228, 35A.21.300, 36.01.210, 36.57.120, 36.57A.170, and 81.112.180; ((and))

(6) Personally identifiable information of employees, and other security information, of a private cloud service provider that has entered into a criminal justice information services agreement as contemplated by the United States department of justice criminal justice information services security policy, as authorized by 28 C.F.R. Part 20; and

(7) Personal information inventory or data map records created under section 1(1)(b) of this act, that reveal the location of personal information or the extent to which it is protected.

--- END ---