Background:

Executive Order 16-01.

In January 2016 Governor Inslee issued Executive Order 16-01 establishing an Office of Privacy and Data Protection (Office). The stated intent of the Executive Order is to ensure that state agencies comply fully with state public records and open government laws, while seeking to protect personal information to the maximum extent possible. The Office must work with state agencies to promote data minimization, monitor sale of personally identifiable information or lists of individuals to third parties, examine data retention practices, update privacy policies, and monitor citizen complaints regarding the collection and use of personal information. The Office must conduct an annual privacy review and annual privacy training, articulate privacy principles and best practices, and educate consumers through public outreach across Washington. The Office must coordinate data protection and security measures in cooperation with Washington Technology Solutions and the Office of the Chief Information Officer (OCIO), participate with the OCIO in the review of major projects involving personally identifiable information, and brief the OCIO and the Office of Cyber Security on the privacy issues relating to risk management and cyber-attack threat analysis and liability. "Personally identifiable information" means information collected by a state agency about a natural person that is readily identifiable to that specific individual.

Access to Advanced Telecommunications Capability.

Congress directed the Federal Communications Commission (FCC) to evaluate and annually report on whether advanced telecommunications capability, often referred to more simply as broadband, is being deployed to all Americans in a reasonable and timely fashion. The term "advanced telecommunications capability" is defined in federal law as high-speed, switched, broadband telecommunications capability that enables users to originate and receive high-quality voice, data, graphics, and video telecommunications using any technology. In its 2015 report, the FCC concluded that for the average household to have advanced telecommunications capability now requires actual download speeds of at least 25 megabits per second (Mbps) and actual upload speeds of at least 3 Mbps. This new benchmark replaced a 2010 benchmark that was 4 Mbps down and 1 Mbps up. The FCC's annual evaluation presents data on access to broadband in each state, broken down to show access in urban areas, rural areas, and on tribal lands.

–––––––––––––––––––––––––––––––––

Summary of Substitute Bill:

Office of Data Privacy, Protection, and Access Equity.

An Office of Privacy and Data Protection (Office) is created in the Office of the Chief Information Officer. The purpose of the Office is to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection, and to serve as a forum for ensuring equitable consumer access to communications and data technology. The Chief Information Officer must appoint the director, who is the Chief Privacy Officer.

Duties Pertaining to State Agencies.

The primary duties of the Office are to conduct an annual privacy review, to conduct an annual privacy training for state agencies and employees, to articulate privacy principles and best practices for state agencies, to coordinate data protection, and to participate in the review of major state agency projects involving personally identifiable information.

Public Education.

The Office must serve as a resource to local governments and the public on data privacy and protection concerns. This includes developing and promoting the dissemination of best practices for the collection and storage of personally identifiable information, and establishing and conducting a training program or programs for local governments and educating consumers about the use of personally identifying information on mobile and digital networks and measures that can help protect such information.

Performance Measures and Review by the Joint Legislative Audit and Review Committee.

The Office must establish performance measures in its 2016 report to the Legislature and, in each report thereafter, demonstrate the extent to which performance results have been achieved. Certain performance reports are specified, for example pertaining to the Office's training, coordination, consumer education, and outreach efforts. The Office must submit the performance measures and a data collection plan for review and comment to the Joint Legislative Audit and Review Committee within one year of the Act's effective date.

Evaluation of Access Equity.

The Office must, at its discretion but at least once every four years, report to the Legislature on access of state residents to advanced telecommunications capability. The report must describe the extent to which telecommunications providers in the state are deploying advanced telecommunications capability and the existence of any inequality in access experienced by residents of rural areas, tribal lands, and economically distressed communities. The report is only required to the extent that the Office is able to gather and present the information within existing resources.

Substitute Bill Compared to Original Bill:

The substitute bill makes the following changes compared to the original bill:

establishes the Office of Privacy and Data Protection (Office) within the Office of the Chief Information Officer (OCIO), rather than within the Department of Enterprise Services;
provides that the Office's director is the Chief Privacy Officer and must be appointed by the Chief Information Officer, rather than the Governor;
eliminates definitions for "advanced telecommunications capability," "benchmark speed," and "personally identifiable information;"
removes duties related to advising and consulting on cybersecurity issues and audits of state and local agency data storage and management practices;
changes certain performance measures that the Office must develop and use to evaluate its performance;
removes the requirement that the Office report on disparities in access to advanced telecommunications capability along with other performance measures (by December 1, 2016, and every four years thereafter), providing instead that the Office must report on this issue at a time determined by the Office, at least once every four years, but only to the extent the Office is able to gather and present the information within existing resources; and
removes legislative findings pertaining to disparities in access to advanced telecommunications and the percent of Washington residents who lack access to broadband at benchmark speeds.

Staff Summary of Public Testimony:

(In support) Members hear concerns from constituents every day about the loss of control they feel in their personal lives as a result of living in an increasingly interconnected world. This bill establishes the Office of Privacy and Data Protection (Office). The Office will provide the state an opportunity to roll out best practices as a resource for state agencies, local governments, and people within the state. The bill also addresses access equity, in a manner that minimizes fiscal impacts but plants a stake for the issue by asking the Office to keep the Legislature abreast of inequities in the deployment of advanced telecommunications infrastructure. The Federal Communications Commission broadband report of 2015 shows that there are counties where the majority of people do not have access. Putting the Office into statute will position Washington as a leader around digital privacy. The Chief Privacy Officer has been exploring how to address privacy issues, adopt best practices, and provide training. This Office can look at new technologies and understand their implications for citizens of the state. The state is custodian for millions of files and the state needs to be a leader. Broadband access is a threshold requirement for participating in the state economy.

(Opposed) None.