SSB 5869

HOUSE BILL REPORT
SSB 5869

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As Reported by House Committee On:
State Government & Tribal Affairs

Title: An act relating to the collection of personally identifiable information by state agencies.

Brief Description: Monitoring personal information collected by state agencies.

Sponsors: Senate Committee on Government Operations & Elections (originally sponsored by Senators Kline, Fairley, Franklin and Keiser).

Majority Report: Do pass as amended. Signed by 7 members: Representatives Hunt, Chair; Appleton, Vice Chair; Chandler, Ranking Minority Member; Kretz, Liias, Miloscia and Ormsby.

Background:

The Department of Information Services (Department) was created to provide coordinated planning and management of state information services. The Washington State Information Services Board (Board) was created to provide direction to state agencies on strategic planning and technical policies for information services, to develop acquisition standards, and to assist agencies in acquiring and implementing information services.

The Department's duties include reviewing agency information technology portfolios; implementing statewide and interagency policies, standards, and guidelines; making information services available to state agencies, local governments, and public benefit nonprofit corporations on a full cost-recovery basis; establishing rates and fees for services provided by the Department; and performing all duties delegated to it by the Board.

Summary of Amended Bill:

The Department must create and maintain a registry of information systems maintained by state agencies that contain personally identifiable information.

The registry must contain at least the following information about each information technology system used to conduct official public business:

The registry is not required to include systems that contain personally identifiable information pertaining solely to public officials acting in their official capacity.

Personally identifiable information is defined as information that can be associated with a particular natural person through one or more identifiers or other information.

Official public business is defined as any legally authorized transaction or communication between a state agency and federal government, another state agency, tribes, or local governments, or between a state agency, tribe, or local government and a private person or entity.

Amended Bill Compared to Substitute Bill:

The amendment changes the name of the committee referenced in the bill to the Enterprise Architecture Committee; it includes unique agency identifiers in the list of information that the registry must contain about each information technology system used to conduct official public business, and whether information in the system is shared with other government entities pursuant to a data-sharing agreement or regulation. It also includes the registry of information systems as created by the bill in the public disclosure exemption for information regarding the infrastructure and security of computer and telecommunications networks; it clarifies that the system security and emergency preparedness plan is exempted, rather than the "security program plan."

Effective Date of Amended Bill: The bill takes effect 90 days after adjournment of session in which bill is passed.

Staff Summary of Public Testimony:

(In support) The Department of Information Systems can incorporate the requirements of this bill into an existing portfolio management system and has worked with the prime sponsor to develop this criteria. The bill adds additional privacy protection for state employees.

(Opposed) None.

Persons Testifying: Senator Kline, prime sponsor; and Tracy Guerin, Department of Information Services.