Background:

With some exceptions, the Employment Security Department (Department) must keep information regarding individuals and employers private and confidential.

Third-Party Disclosure.

Disclosure to third parties is permitted if the individual or employer consents. By rule, the Department allows release to third parties who supply the Department with reasonable written or oral assurances of their identity and that they are acting with the approval of the individual or employer whose records are involved.

Administrative/Judicial Proceedings.

Private information is available to parties in judicial or administrative proceedings only upon a finding by the presiding officer that the need for the information outweighs any reasons for privacy. A subpoena may be directed to any employee of the Department.

Data Sharing.

Governmental agencies have access to private information if the information is needed for official purposes and the agency submits a written application to the Department. With some exceptions, such as to detect fraudulent claims, the agency must also serve a copy of the application on the individual or employer whose information is sought and the individual or employer has an opportunity to object.

Penalties.

A person or organization that misuses or releases private information without authorization is subject to a penalty of $5,000 and any other applicable sanctions under state and federal law.

Other.

The prohibition against disclosing private information does not apply if all details identifying an individual or employer are deleted.

Summary of Bill:

Privacy Officer.

The Department must designate an agency privacy officer (officer) to oversee privacy provisions relating to the administration of unemployment compensation as well as privacy provisions proposed for the Paid Family and Medical Leave program. The officer must coordinate with the State Office of Privacy and Data Protection to develop:

a personal information minimization policy to reduce the use and retention of personal information; and
a work plan that includes the estimated costs of inventorying all personal information, to include the type of information, the purpose for its collection, and the extent to which the information is protected from unauthorized access; and a map of the physical or digital location of all information, indexed to the inventory.

The Department must annually report the work plan to the State Office of Privacy and Data Protection.

The Department must report to the Governor and the Legislature by December 1 of each odd-numbered year on the implementation and maintenance of the minimization policy and work plan, including best practices and recommendations for developing and implementing the Department's minimization policy and work plan.

The inventory and data map records that reveal the location of personal information or the extent to which personal information is protected are exempt from disclosure under the Public Records Act.

Third-Party Disclosure.

More specific provisions are enacted regarding disclosure to third parties. The Department may disclose information to a third party acting on behalf of an individual or employer if the individual, employer, or third party provides a signed release. The release must:

identify the information;
state that state government files will be accessed to obtain the information;
state the specific purposes for which the information is sought and that it will be used only for that purpose; and
indicate the parties who may receive the information.

Administrative/Judicial Proceedings.

The finding by a presiding officer in a judicial or administrative proceeding required to make information available to parties must be in writing. Subpoenas to the Department may no longer be submitted to any Department employee; instead, they must be submitted in a manner prescribed by the Department. The Department may recover the costs of responding to a subpoena.

Data Sharing.

Federally recognized Indian tribes are added as a government eligible for access to private information. The requirement that the application be in writing is deleted and instead the Department specifies the manner of submission. The requirement to serve a copy of the application on the individual or employer whose information is sought also does not apply if the information is sought for reasons within the discharge of the agency or tribe's official duties. Examples of items governments may obtain are deleted.

Penalties.

An affirmative obligation is expressly placed on persons, agencies, and organizations authorized to receive information to take all reasonable actions necessary that are designed to prevent the disclosure of confidential information. Disclosure of information received from the Department is prohibited unless expressly permitted. Express permission must be obtained prior to redisclosure. However, governments are exempt from penalties if the redisclosure is necessary for a criminal prosecution. If misuse or unauthorized disclosure occurs, all parties aware of the violation must immediately inform the Department and take all reasonably available actions to rectify the disclosure.

The penalty for misuse or unauthorized disclosure is raised to up to $20,000, with an annual adjustment based on the consumer price index.

Other.

Private information may be disclosed if identifying details are deleted only if the information cannot be foreseeably combined with other public information to reveal the identity of an individual or employer.

References to the Department are updated and provisions are reorganized.