Background:

Executive Order 16-01.

In January 2016 Governor Inslee issued Executive Order 16-01 establishing an Office of Privacy and Data Protection (Office). The stated intent of the Executive Order is to ensure that state agencies comply fully with state public records and open government laws, while seeking to protect personal information to the maximum extent possible. The Office must work with state agencies to promote data minimization, monitor sale of personally identifiable information or lists of individuals to third parties, examine data retention practices, update privacy policies, and monitor citizen complaints regarding the collection and use of personal information. The Office must conduct an annual privacy review and annual privacy training, articulate privacy principles and best practices, and educate consumers through public outreach across Washington. The Office must coordinate data protection and security measures in cooperation with Washington Technology Solutions and the Office of the Chief Information Officer (OCIO), participate with the OCIO in the review of major projects involving personally identifiable information, and brief the OCIO and the Office of Cyber Security on the privacy issues relating to risk management and cyber-attack threat analysis and liability. "Personally identifiable information" means information collected by a state agency about a natural person that is readily identifiable to that specific individual.

Access to Advanced Telecommunications Capability.

Congress directed the Federal Communications Commission (FCC) to evaluate and annually report on whether advanced telecommunications capability is being deployed to all Americans in a reasonable and timely fashion. The term "advanced telecommunications capability" is defined in federal law as high-speed, switched, broadband telecommunications capability that enables users to originate and receive high-quality voice, data, graphics, and video telecommunications using any technology. The FCC's annual evaluation presents data on access to broadband in each state, broken down to show access in urban areas, rural areas, and on tribal lands.

Summary:

Office of Data Privacy, Protection, and Access Equity.

An Office of Privacy and Data Protection (Office) is created in the Office of the Chief Information Officer. The purpose of the Office is to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection, and to serve as a forum for ensuring equitable consumer access to communications and data technology. The Chief Information Officer must appoint the director, who is the Chief Privacy Officer.

Duties Pertaining to State Agencies.

The primary duties of the Office are to conduct an annual privacy review, to conduct an annual privacy training for state agencies and employees, to articulate privacy principles and best practices for state agencies, to coordinate data protection, and to participate in the review of major state agency projects involving personally identifiable information.

Public Education.

The Office must serve as a resource to local governments and the public on data privacy and protection concerns. This includes developing and promoting the dissemination of best practices for the collection and storage of personally identifiable information, establishing and conducting a training program or programs for local governments, and educating consumers about the use of personally identifying information on mobile and digital networks and measures that can help protect such information.

Performance Measures and Review by the Joint Legislative Audit and Review Committee.

The Office must establish performance measures in its 2016 report to the Legislature and, in each report thereafter, demonstrate the extent to which performance results have been achieved. Certain performance metrics are specified, for example pertaining to the Office's training, coordination, consumer education, and outreach efforts. The Office must submit the performance measures and a data collection plan for review and comment to the Joint Legislative Audit and Review Committee within one year of the Act's effective date.

Evaluation of Access Equity.

The Office must, at its discretion but at least once every four years, report to the Legislature on access of state residents to advanced telecommunications capability. The report must describe the extent to which telecommunications providers in the state are deploying advanced telecommunications capability and the existence of any inequality in access experienced by residents of rural areas, tribal lands, and economically distressed communities. The report is only required to the extent that the Office is able to gather and present the information within existing resources.

House	97	0
Senate	40	8