SENATE BILL REPORT

ESSB 6356

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As Passed Senate, February 16, 2016

Title: An act relating to disclosure of financial, commercial, and proprietary criminal background check information of employees of private cloud service providers.

Brief Description: Concerning disclosure of identifiable information and security information of certain employees of private cloud service providers.

Sponsors: Senate Committee on Government Operations & Security (originally sponsored by Senators Roach, Ranker, Takko, McCoy, Hobbs, Litzow, Fain, Hasegawa and Chase).

Brief History:

Committee Activity: Government Operations & Security: 1/25/16, 1/28/16 [DPS].

Passed Senate: 2/16/16, 47-1.

SENATE COMMITTEE ON GOVERNMENT OPERATIONS & SECURITY

Majority Report: That Substitute Senate Bill No. 6356 be substituted therefor, and the substitute bill do pass.

Signed by Senators Roach, Chair; Benton, Vice Chair; Pearson, Vice Chair; Dansel, Habib, McCoy and Takko.

Staff: Samuel Brown (786-7470)

Background: The Public Records Act (PRA). The PRA, enacted in 1972 as part of Initiative 276, requires that all state and local governments make all public records available for public inspection and copying unless certain statutory exemptions apply. The provisions requiring disclosure of public records are interpreted liberally, while the exemptions from disclosure are narrowly construed, to effectuate a policy favoring disclosure.

Security Exemptions. Various types of security information are exempt from the PRA's disclosure requirements. These include:

Criminal Justice Information Systems (CJIS) Agreements. The CJIS division of the Federal Bureau of Investigation (FBI) serves as the focal point and central repository for criminal justice information systems in the FBI. A variety of functions have been consolidated under CJIS, including the National Crime Information Center, the National Instant Criminal Background Check System, and the Law Enforcement Enterprise Portal, which provides data to law enforcement and criminal justice entities.

Summary of Engrossed Substitute Bill: The following information relating to a private cloud service provider that has entered into a CJIS agreement is exempt from public disclosure requirements:

Appropriation: None.

Fiscal Note: Not requested.

Committee/Commission/Task Force Created: No.

Effective Date: Ninety days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony on First Substitute Bill: PRO: American citizens want privacy in their line of work. This closes a serious cyber-security threat to cloud computing services that maintain data for law enforcement information. Law enforcement agencies are required to provide security safeguards to information they maintain, and all personnel who could have access to that information must be subject to background checks. Background checks contain all sorts of sensitive information that could be used by malicious actors interested in stealing sensitive government information; even disclosure of employee names would reveal who to attack to get access to information.

CON: It is extremely important for the public to trust public employers and the contractors they employ and know that employees have passed through these background checks, just like their public employee counterparts. This is going down a slippery slope. The biggest risk here is other employers trying to lure these employees away. There is no public policy reason for this information to be withheld. This is not classified information, just state information.

Persons Testifying on First Substitute Bill: PRO: Senator Roach, prime sponsor; Ryan Harkins, Microsoft.

CON: Rowland Thompson, Allied Daily Newspapers of Washington.

Persons Signed In To Testify But Not Testifying: No one.