Summary of Engrossed Bill:

Definitions.

"Agency" means the State of Washington, its agencies, and political subdivisions, including county and city governmental entities, and includes any entity or individual, whether public or private, with which any of the governmental entities has entered into a contractual relationship or any other type of relationship, with or without consideration, for the operation of an extraordinary sensing device that acquires, collects, or indexes personal information to accomplish an agency function.

"Extraordinary Sensing Device" (ESD) means a sensing device attached to an unmanned aircraft system.

"Governing Body" means the council, commission, board, or other controlling body of an agency in which legislative powers are vested, except that for a state agency for which there is no governing body other than the Legislature, governing body means the chief executive officer of the agency.

"Personal information" means all information that:

describes, locates, or indexes anything about a person including, but not limited to: (1) his or her social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and the person's education, financial transactions, medical history, ancestry, religion, political ideology, or criminal or employment record; or (2) intellectual property, trade secrets, proprietary information, or operational information;
affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such person; and the record of the person's presence, registration, or membership in an organization or activity, or admission to an institution; or
indexes anything about a person including, but not limited to, his or her activities, behaviors, pursuits, conduct, interests, movements, occupations, or associations.

Procurement.

No state agency with jurisdiction over criminal or regulatory enforcement may procure an ESD without an express appropriation by the Legislature for that specific purpose.

No local agency with jurisdiction over criminal law enforcement or regulatory violations may procure an ESD without the explicit approval of the local governing body, given for that device, for that specific purpose.

Usage.

No agency, including the state, its agencies, and any political subdivisions, such as county and city governmental entities, may use an ESD except as specifically authorized by the bill.

An agency may only use an ESD pursuant to a judicially issued search warrant or under one of the following exceptions:

for a non-criminal emergency with immediate danger of death of serious bodily injury, if the ESD can reasonable reduce the danger of death or serious physical injury;
for training or testing if no personal information is collected outside a military base;
for emergency response if there is a Governor-declared state of emergency; or
for an operation unlikely to collect personal information and not for regulatory enforcement, limited to the following:
monitoring to discover, locate, observe, or prevent forest fires;
monitoring an environmental or weather-related catastrophe or damage from such an event;
surveying for wildlife management, habitat preservation or environmental damage; and
surveying for assessment & evaluation of environmental or weather-related damage, erosion, flood or contamination.

Use of ESDs for regulatory enforcement purposes is prohibited until the legislature has approved standards.

Any agency using an ESD must develop written policies and procedures for ESD use and make those policies and procedures public, with an opportunity for public notice and comment.

An ESD operated by an agency must have a unique identifier registration number affixed to it.

All usage must comply with Federal Aviation Administration guidelines, in addition to the requirements of the act.

Information management.

No agency may disclose personal information acquired through operation of an ESD except as specifically authorized by the bill. All operations of ESD and disclosure of personal information must be done to minimize the unauthorized collection and disclosure of personal information.

Personal information collected by ESDs may not be used, copied, or disclosed after the operation has ended except if there is probable cause that the information is evidence of criminal activity.

Information collected incidentally on a person other than the target of a warrant must be destroyed within 10 days of collection, if it can be destroyed without destroying evidence that may be relevant to a pending criminal investigation or case.

Information on the target of the warrant must be destroyed within 30 days after the period of limitations for the criminal activity has expired, if the person has not been charged. Personal information may not be received in evidence if the collection or disclosure would violate the terms of the bill.

Recordkeeping and Reporting.

Every state agency which uses ESDs must maintain records of each use of an ESD and, for each year in which an ESD was used, prepare an annual report. The contents of the report vary, depending on whether the agency has jurisdiction over criminal law enforcement or not. Each report shall include, at a minimum, the types of ESDs used and the circumstances of each use and may be required to include the kinds of information collected, the storage and deletion of the information, and the successes and costs of the ESD use.

The reports will be compiled by the Office of Financial Management, which must submit them electronically to the Legislature by September 1 of each year, beginning in 2015.

Local agencies need not produce a report, but must maintain records of each use of an ESD including, at a minimum, the number and types of uses, the frequency, type and deletion schedule of collected personal information, and the use of data collected for investigations.

The act does not expand or contract the obligations of an agency under the Public Records Act.

Penalties.

Anyone who claims that a violation of the bill's provisions has injured his or her business, person, or reputation may sue for actual damages, as well as attorneys' fees and other costs of litigation.

Work group

The Department of Enterprise Services will convene a work group comprised of four legislators and a representative of the Governor. The work group will submit a report to the Legislature proposing standards for the use of ESDs for regulatory enforcement purposes by December 1, 2014.