HOUSE BILL REPORT

SHB 2875

As Passed House:

February 15, 2016

Title: An act relating to establishing the office of data privacy, protection, and access equity.

Brief Description: Establishing the office of privacy and data protection.

Sponsors: House Committee on Technology & Economic Development (originally sponsored by Representatives Smith, Morris and Magendanz).

Brief History:

Committee Activity:

Technology & Economic Development: 2/2/16, 2/3/16 [DPS];

General Government & Information Technology: 2/5/16 [DPS(TED)].

Floor Activity:

Passed House: 2/15/16, 97-0.

Majority Report: The substitute bill be substituted therefor and the substitute bill do pass. Signed by 13 members: Representatives Morris, Chair; Tarleton, Vice Chair; Smith, Ranking Minority Member; DeBolt, Assistant Ranking Minority Member; Fey, Harmsworth, Hudgins, Magendanz, Nealey, Rossetti, Santos, Wylie and Young.

Staff: Jasmine Vasavada (786-7301).

Majority Report: The substitute bill by Committee on Technology & Economic Development be substituted therefor and the substitute bill do pass. Signed by 6 members: Representatives Hudgins, Chair; Kuderer, Vice Chair; MacEwen, Ranking Minority Member; Caldier, Assistant Ranking Minority Member; Morris and Senn.

Staff: James Mackison (786-7104).

Background:

Executive Order 16-01.

In January 2016 Governor Inslee issued Executive Order 16-01 establishing an Office of Privacy and Data Protection (Office). The stated intent of the Executive Order is to ensure that state agencies comply fully with state public records and open government laws, while seeking to protect personal information to the maximum extent possible. The Office must work with state agencies to promote data minimization, monitor sale of personally identifiable information or lists of individuals to third parties, examine data retention practices, update privacy policies, and monitor citizen complaints regarding the collection and use of personal information. The Office must conduct an annual privacy review and annual privacy training, articulate privacy principles and best practices, and educate consumers through public outreach across Washington. The Office must coordinate data protection and security measures in cooperation with Washington Technology Solutions and the Office of the Chief Information Officer (OCIO), participate with the OCIO in the review of major projects involving personally identifiable information, and brief the OCIO and the Office of Cyber Security on the privacy issues relating to risk management and cyber-attack threat analysis and liability. "Personally identifiable information" means information collected by a state agency about a natural person that is readily identifiable to that specific individual.

Access to Advanced Telecommunications Capability.

Congress directed the Federal Communications Commission (FCC) to evaluate and annually report on whether advanced telecommunications capability, often referred to more simply as broadband, is being deployed to all Americans in a reasonable and timely fashion. The term "advanced telecommunications capability" is defined in federal law as high-speed, switched, broadband telecommunications capability that enables users to originate and receive high-quality voice, data, graphics, and video telecommunications using any technology. In its 2015 report, the FCC concluded that for the average household to have advanced telecommunications capability now requires actual download speeds of at least 25 megabits per second (Mbps) and actual upload speeds of at least 3 Mbps. This new benchmark replaced a 2010 benchmark that was 4 Mbps down and 1 Mbps up. The FCC's annual evaluation presents data on access to broadband in each state, broken down to show access in urban areas, rural areas, and on tribal lands.

Summary of Substitute Bill:

Office of Data Privacy, Protection, and Access Equity.

An Office of Privacy and Data Protection (Office) is created in the Office of the Chief Information Officer. The purpose of the Office is to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection, and to serve as a forum for ensuring equitable consumer access to communications and data technology. The Chief Information Officer must appoint the director, who is the Chief Privacy Officer.

Duties Pertaining to State Agencies.

The primary duties of the Office are to conduct an annual privacy review, to conduct an annual privacy training for state agencies and employees, to articulate privacy principles and best practices for state agencies, to coordinate data protection, and to participate in the review of major state agency projects involving personally identifiable information.

Public Education.

The Office must serve as a resource to local governments and the public on data privacy and protection concerns. This includes developing and promoting the dissemination of best practices for the collection and storage of personally identifiable information, and establishing and conducting a training program or programs for local governments and educating consumers about the use of personally identifying information on mobile and digital networks and measures that can help protect such information.

Performance Measures and Review by the Joint Legislative Audit and Review Committee.

The Office must establish performance measures in its 2016 report to the Legislature and, in each report thereafter, demonstrate the extent to which performance results have been achieved. Certain performance reports are specified, for example pertaining to the Office's training, coordination, consumer education, and outreach efforts. The Office must submit the performance measures and a data collection plan for review and comment to the Joint Legislative Audit and Review Committee within one year of the Act's effective date.

Evaluation of Access Equity.

The Office must, at its discretion but at least once every four years, report to the Legislature on access of state residents to advanced telecommunications capability. The report must describe the extent to which telecommunications providers in the state are deploying advanced telecommunications capability and the existence of any inequality in access experienced by residents of rural areas, tribal lands, and economically distressed communities. The report is only required to the extent that the Office is able to gather and present the information within existing resources.

Appropriation: None.

Fiscal Note: Available.

Effective Date: The bill takes effect 90 days after adjournment of the session in which the bill is passed.

Staff Summary of Public Testimony (Technology & Economic Development):

(In support) Members hear concerns from constituents every day about the loss of control they feel in their personal lives as a result of living in an increasingly interconnected world. This bill establishes the Office of Privacy and Data Protection (Office). The Office will provide the state an opportunity to roll out best practices as a resource for state agencies, local governments, and people within the state. The bill also addresses access equity, in a manner that minimizes fiscal impacts but plants a stake for the issue by asking the Office to keep the Legislature abreast of inequities in the deployment of advanced telecommunications infrastructure. The Federal Communications Commission broadband report of 2015 shows that there are counties where the majority of people do not have access. Putting the Office into statute will position Washington as a leader around digital privacy. The Chief Privacy Officer has been exploring how to address privacy issues, adopt best practices, and provide training. This Office can look at new technologies and understand their implications for citizens of the state. The state is custodian for millions of files and the state needs to be a leader. Broadband access is a threshold requirement for participating in the state economy.

(Opposed) None.

Staff Summary of Public Testimony (General Government & Information Technology):

(In support) The substitute bill recognizes substantial work done by the Governor to establish the Office of Privacy and Data Protection (Office) by Executive Order.  The bill moves the Governor's Executive Order into statute.  The Office will help to protect privacy and personal data for the public.

(Opposed) None.

Persons Testifying (Technology & Economic Development): Representative Smith, prime sponsor; and Michael Cockrill and Alex Alben, Washington Technology Solutions.

Persons Testifying (General Government & Information Technology): Representative Smith, prime sponsor; and Rob St. John, Office of the Chief Information Officer.

Persons Signed In To Testify But Not Testifying (Technology & Economic Development): None.

Persons Signed In To Testify But Not Testifying (General Government & Information Technology): None.