FINAL BILL REPORT

EHB 2789

FULL VETO

Brief Description: Concerning technology-enhanced government surveillance.

Sponsors: Representatives Taylor, Goodman, Shea, Morris, Smith, Walkinshaw, Overstreet, Condotta, Moscoso, Ryu, Short and Scott.

Senate Committee on Law & Justice

Background:

Unmanned Aircraft Systems.

The Federal Aviation Authority (FAA) first authorized the use of unmanned aircraft systems (UAS), in the national airspace in 1990. The FAA defines unmanned aircraft as a device intended to be used for flight with no onboard pilot.

In 2012 the FAA established the Unmanned Aircraft Systems Integration Office to provide a one-stop portal for civil and public use of UAS in the United States airspace. This office is developing a comprehensive plan to integrate and establish operational and certification requirements for UAS. It will also oversee and coordinate UAS research and development.

There are two ways to get FAA approval to operate a UAS. The first is to obtain an experimental airworthiness certificate for private sector (civil) aircraft to do research and development and training and flight demonstrations. The second is to obtain a Certificate of Waiver or Authorization (COA), which can only be obtained by federal, state, or local governmental agencies.

Summary:

Definitions.

For the purposes of the act, an "agency" includes the State of Washington, its agencies, and political subdivisions, including county and city governmental entities, and includes any entity or individual, whether public or private, with which any of the governmental entities has entered into a contractual relationship or any other type of relationship, with or without consideration, for the operation of an extraordinary sensing device that acquires, collects, or indexes personal information to accomplish an agency function.

An Extraordinary Sensing Device (ESD) is a sensing device attached to an unmanned aircraft system.

A governing body means the council, commission, board, or other controlling body of an agency in which legislative powers are vested, except that for a state agency for which there is no governing body other than the Legislature, the governing body is the chief executive officer of the agency.

Personal information is any information that:

• describes, locates, or indexes anything about a person including, but not limited to: (1) his or her social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and the person's education, financial transactions, medical history, ancestry, religion, political ideology, or criminal or employment record; or (2) intellectual property, trade secrets, proprietary information, or operational information;

• affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such person; and the record of the person's presence, registration, or membership in an organization or activity, or admission to an institution; or

• indexes anything about a person including, but not limited to, his or her activities, behaviors, pursuits, conduct, interests, movements, occupations, or associations.

Procurement.

No state agency with jurisdiction over criminal or regulatory enforcement may procure an ESD without an express appropriation by the Legislature for that specific purpose.

No local agency with jurisdiction over criminal law enforcement or regulatory violations may procure an ESD without the explicit approval of the local governing body, given for that device, for that specific purpose.

Usage.

No agency, including the state, its agencies, and any political subdivisions, such as county and city governmental entities, may use an ESD except as specifically authorized by the act.

An agency may only use an ESD pursuant to a judicially issued search warrant or under one of the following exceptions:

• for a non-criminal emergency with immediate danger of death of serious bodily injury, if the ESD can reasonable reduce the danger of death or serious physical injury;

• for training or testing if no personal information is collected outside a military base;

• for emergency response if there is a Governor-declared state of emergency; or

• for an operation unlikely to collect personal information and not for regulatory enforcement, limited to the following:

• monitoring to discover, locate, observe, or prevent forest fires;

• monitoring an environmental or weather-related catastrophe or damage from such an event;

• surveying for wildlife management, habitat preservation, or environmental damage; and

• surveying for assessment and evaluation of environmental or weather-related damage, erosion, flood, or contamination.

Use of ESDs for regulatory enforcement purposes is prohibited until the Legislature has approved standards.

Any agency using an ESD must develop written policies and procedures for ESD use and make those policies and procedures public, with an opportunity for public notice and comment.

An ESD operated by an agency must have a unique identifier registration number affixed to it.

All usage must comply with FAA guidelines, in addition to the requirements of the act.

Information management.

No agency may disclose personal information acquired through operation of an ESD except as specifically authorized by the act. All operations of ESD and disclosure of personal information must be done to minimize the unauthorized collection and disclosure of personal information.

Personal information collected by ESDs may not be used, copied, or disclosed after the operation has ended except if there is probable cause that the information is evidence of criminal activity.

Information collected incidentally on a person other than the target of a warrant must be destroyed within 10 days of collection if it can be destroyed without destroying evidence that may be relevant to a pending criminal investigation or case.

Information on the target of the warrant must be destroyed within 30 days after the period of limitations for the criminal activity has expired if the person has not been charged. Personal information may not be received in evidence if the collection or disclosure would violate the terms of the bill.

Recordkeeping and Reporting.

Every state agency that uses ESDs must maintain records of each use of an ESD and, for each year in which an ESD was used, prepare an annual report. The contents of the report vary, depending on whether the agency has jurisdiction over criminal law enforcement. Each report must include, at a minimum, the types of ESDs used and the circumstances of each use and may be required to include the kinds of information collected, the storage and deletion of the information, and the successes and costs of the ESD use.

The reports must be compiled by the Office of Financial Management, which must submit them electronically to the Legislature by September 1 of each year, beginning in 2015.

Local agencies need not produce a report, but must maintain records of each use of an ESD including, at a minimum, the number and types of uses, the frequency, type and deletion schedule of collected personal information, and the use of data collected for investigations.

The act does not expand or contract the obligations of an agency under the Public Records Act.

Penalties.

Anyone who claims that a violation of the act's provisions has injured his or her business, person, or reputation may sue for actual damages, as well as attorneys' fees and other costs of litigation.

Work group

The Department of Enterprise Services must convene a work group comprised of four legislators and a representative of the Governor. The work group must submit a report to the Legislature proposing standards for the use of ESDs for regulatory enforcement purposes by December 1, 2014.

Votes on Final Passage: