BILL REQ. #:  H-0394.1 

Prefiled 12/18/08. Read first time 01/12/09.   Referred to Committee on Technology, Energy & Communications.

     AN ACT Relating to developing state standards for radio frequency identification; amending RCW 43.105.041; and adding new sections to chapter 43.105 RCW.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

Sec. 1   RCW 43.105.041 and 2003 c 18 s 3 are each amended to read as follows:
     (1) The board shall have the following powers and duties related to information services:
     (a) To develop standards and procedures governing the acquisition and disposition of equipment, proprietary software and purchased services, licensing of the radio spectrum by or on behalf of state agencies, and confidentiality of computerized data;
     (b) To purchase, lease, rent, or otherwise acquire, dispose of, and maintain equipment, proprietary software, and purchased services, or to delegate to other agencies and institutions of state government, under appropriate standards, the authority to purchase, lease, rent, or otherwise acquire, dispose of, and maintain equipment, proprietary software, and purchased services: PROVIDED, That, agencies and institutions of state government are expressly prohibited from acquiring or disposing of equipment, proprietary software, and purchased services without such delegation of authority. The acquisition and disposition of equipment, proprietary software, and purchased services is exempt from RCW 43.19.1919 and, as provided in RCW 43.19.1901, from the provisions of RCW 43.19.190 through 43.19.200. This subsection (1)(b) does not apply to the legislative branch;
     (c) To develop statewide or interagency technical policies, standards, and procedures;
     (d) To develop privacy standards for radio frequency identification technology;
     (e) To review and approve standards and common specifications for new or expanded telecommunications networks proposed by agencies, public postsecondary education institutions, educational service districts, or statewide or regional providers of K-12 information technology services, and to assure the cost-effective development and incremental implementation of a statewide video telecommunications system to serve: Public schools; educational service districts; vocational-technical institutes; community colleges; colleges and universities; state and local government; and the general public through public affairs programming;
     (((e))) (f) To provide direction concerning strategic planning goals and objectives for the state. The board shall seek input from the legislature and the judiciary;
     (((f))) (g) To develop and implement a process for the resolution of appeals by:
     (i) Vendors concerning the conduct of an acquisition process by an agency or the department; or
     (ii) A customer agency concerning the provision of services by the department or by other state agency providers;
     (((g))) (h) To establish policies for the periodic review by the department of agency performance which may include but are not limited to analysis of:
     (i) Planning, management, control, and use of information services;
     (ii) Training and education; and
     (iii) Project management;
     (((h))) (i) To set its meeting schedules and convene at scheduled times, or meet at the request of a majority of its members, the chair, or the director; and
     (((i))) (j) To review and approve that portion of the department's budget requests that provides for support to the board.
     (2) Statewide technical standards to promote and facilitate electronic information sharing and access are an essential component of acceptable and reliable public access service and complement content-related standards designed to meet those goals. The board shall:
     (a) Establish technical standards to facilitate electronic access to government information and interoperability of information systems, including wireless communications systems. Local governments are strongly encouraged to follow the standards established by the board; and
     (b) Require agencies to consider electronic public access needs when planning new information systems or major upgrades of systems.
     In developing these standards, the board is encouraged to include the state library, state archives, and appropriate representatives of state and local government.
     (3)(a) The board, in consultation with the K-20 board, has the duty to govern, operate, and oversee the technical design, implementation, and operation of the K-20 network including, but not limited to, the following duties: Establishment and implementation of K-20 network technical policy, including technical standards and conditions of use; review and approval of network design; procurement of shared network services and equipment; and resolving user/provider disputes concerning technical matters. The board shall delegate general operational and technical oversight to the K-20 network technical steering committee as appropriate.
     (b) The board has the authority to adopt rules under chapter 34.05 RCW to implement the provisions regarding the technical operations and conditions of use of the K-20 network.

NEW SECTION.  Sec. 2   A new section is added to chapter 43.105 RCW to read as follows:
     The board shall develop privacy standards for state agencies using radio frequency identification technology for external or internal purposes. These standards, at a minimum, must ensure that:
     (1) A privacy impact assessment is conducted prior to acquisition to determine what implications its implementation of radio frequency identification technology could raise for privacy and the protection of personal data;
     (2) Appropriate technical and organizational measures are being taken by the state agency in order to mitigate any privacy or data protection risks; and
     (3) The type of radio frequency identification technology selected has an appropriate level of security for its intended application.

NEW SECTION.  Sec. 3   A new section is added to chapter 43.105 RCW to read as follows:
     If a state agency intends to deploy radio frequency identification technology for external or internal purposes, the state agency must certify to the department that its intended use of radio frequency identification technology is in compliance with the most recent privacy standards adopted by the board.