H-3701.1

HOUSE BILL 2366

ByRepresentatives Smith, Hudgins, and Young

AN ACT Relating to making the chief privacy officer an elected position; amending RCW 43.105.369, 43.01.010, 29A.32.031, 29A.36.121, and 43.03.010; adding a new section to chapter 29A.04 RCW; adding a new section to chapter 42.17A RCW; creating a new section; providing an effective date; and providing an expiration date.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

(2) The legislature statutorily established the position of chief privacy officer within the office of privacy and data protection in 2016, shortly after the governor created the office through executive order 16-01. The legislature continues to find that a full-time data privacy officer fulfills many valuable roles and functions, including educating consumers, researching best practices, providing privacy training for state agencies, and consulting with stakeholders to help shape policy regarding data privacy and security.

(3) The legislature finds that while the state has statutorily defined the role of the chief privacy officer position since 2016, experience has shown that there needs to be improvements to how that position is structured. The position can be filled only by the governor or the state's chief information officer, without the advice and consent of lawmakers. It is filled without the privacy officer's views about privacy and how to balance consumer protection and commercial freedom being subject to public scrutiny and debate. In 2019 the position was vacant for prolonged periods during which momentous data privacy legislation was under development by stakeholders and lawmakers. As the public sector does not compensate for information technology jobs at the level of the private sector, vacancies can be anticipated to occur in the future during times that important events impacting public policy choices are unfolding.

(4) The legislature finds that the public should have a say in the quality and style of advocacy of its chief data privacy officer. The public should also have the opportunity to elect someone who best articulates, prioritizes, and promotes his or her vision of the future of privacy and data security. Requiring the chief privacy officer to stand for election and make a public case for certain priorities and principles will give additional weight to the officer's policy guidance to lawmakers and state agency officials. Therefore, the legislature intends to make the state's chief privacy officer a statewide elected official. The legislature intends the chief privacy officer to continue to be the director of the existing office of privacy and data protection, having the same duties. The legislature intends the chief privacy officer and office of privacy and data protection to be housed within the office of the chief information officer, but not subject to its supervision, for administrative simplicity and cost efficiency.

Sec. 2. RCW 43.105.369 and 2016 c 195 s 2 are each amended to read as follows:

(1) The office of privacy and data protection is created within the office of the state chief information officer. The purpose of the office of privacy and data protection is to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection.

(2) The ((director shall appoint the)) chief privacy officer((, who)) is the director of the office of privacy and data protection. The office of the chief privacy officer is a state office elected in accordance with Title 29A RCW.

(3) The primary duties of the office of privacy and data protection with respect to state agencies are:

(a) To conduct an annual privacy review;

(b) To conduct an annual privacy training for state agencies and employees;

(c) To articulate privacy principles and best practices;

(d) To coordinate data protection in cooperation with the agency; and

(e) To participate with the office of the state chief information officer in the review of major state agency projects involving personally identifiable information.

(4) The office of privacy and data protection must serve as a resource to local governments and the public on data privacy and protection concerns by:

(a) Developing and promoting the dissemination of best practices for the collection and storage of personally identifiable information, including establishing and conducting a training program or programs for local governments; and

(b) Educating consumers about the use of personally identifiable information on mobile and digital networks and measures that can help protect this information.

(5) By December 1, 2016, and every four years thereafter, the office of privacy and data protection must prepare and submit to the legislature a report evaluating its performance. The office of privacy and data protection must establish performance measures in its 2016 report to the legislature and, in each report thereafter, demonstrate the extent to which performance results have been achieved. These performance measures must include, but are not limited to, the following:

(a) The number of state agencies and employees who have participated in the annual privacy training;

(b) A report on the extent of the office of privacy and data protection's coordination with international and national experts in the fields of data privacy, data protection, and access equity;

(c) A report on the implementation of data protection measures by state agencies attributable in whole or in part to the office of privacy and data protection's coordination of efforts; and

(d) A report on consumer education efforts, including but not limited to the number of consumers educated through public outreach efforts, as indicated by how frequently educational documents were accessed, the office of privacy and data protection's participation in outreach events, and inquiries received back from consumers via telephone or other media.

(6) Within one year of June 9, 2016, the office of privacy and data protection must submit to the joint legislative audit and review committee for review and comment the performance measures developed under subsection (5) of this section and a data collection plan.

(7) The office of privacy and data protection shall submit a report to the legislature on the: (a) Extent to which telecommunications providers in the state are deploying advanced telecommunications capability; and (b) existence of any inequality in access to advanced telecommunications infrastructure experienced by residents of tribal lands, rural areas, and economically distressed communities. The report may be submitted at a time within the discretion of the office of privacy and data protection, at least once every four years, and only to the extent the office of privacy and data protection is able to gather and present the information within existing resources.

Sec. 3. RCW 43.01.010 and 1965 c 8 s 43.01.010 are each amended to read as follows:

The governor, lieutenant governor, secretary of state, treasurer, auditor, attorney general, superintendent of public instruction, commissioner of public lands, ((and)) insurance commissioner, and chief privacy officer, shall hold office for the term of four years, and until their successors are elected and qualified; and the term shall commence on the Wednesday after the second Monday of January following their election.

NEW SECTION.  Sec. 4. A new section is added to chapter 29A.04 RCW to read as follows:

(1) The first election for the chief privacy officer shall be held at the general election in November 2024.

(2) The office of chief privacy officer shall be considered a state office for purposes of this title.

(3) The election shall be conducted in accordance with this title.

(4) Candidates for the first general election for the chief privacy officer shall file for office as provided in chapter 29A.24 RCW during the filing period in 2024, and a primary election shall be held as provided in chapter 29A.52 RCW.

(5) This section expires February 1, 2025.

Sec. 5. RCW 29A.32.031 and 2013 c 283 s 2 are each amended to read as follows:

The voters' pamphlet published or distributed under RCW 29A.32.010 must contain:

(1) Information about each measure for an advisory vote of the people and each ballot measure initiated by or referred to the voters for their approval or rejection as required by RCW 29A.32.070;

(2) In even-numbered years, statements, if submitted, from candidates for the office of president and vice president of the United States, United States senator, United States representative, governor, lieutenant governor, secretary of state, state treasurer, state auditor, attorney general, commissioner of public lands, superintendent of public instruction, insurance commissioner, chief privacy officer, state senator, state representative, justice of the supreme court, judge of the court of appeals, or judge of the superior court. Candidates may also submit campaign contact information and a photograph not more than five years old in a format that the secretary of state determines to be suitable for reproduction in the voters' pamphlet;

(3) In odd-numbered years, if any office voted upon statewide appears on the ballot due to a vacancy, then statements and photographs for candidates for any vacant office listed in subsection (2) of this section must appear;

(4) Contact information for the public disclosure commission established under RCW 42.17A.100, including the following statement: "For a list of the people and organizations that donated to state and local candidates and ballot measure campaigns, visit www.pdc.wa.gov." The statement must be placed in a prominent position, such as on the cover or on the first two pages of the voters' pamphlet. The secretary of state may substitute such language as is necessary for accuracy and clarity and consistent with the intent of this section;

(5) Contact information for major political parties;

(6) A brief statement explaining the deletion and addition of language for proposed measures under RCW 29A.32.080; and

(7) Any additional information pertaining to elections as may be required by law or in the judgment of the secretary of state is deemed informative to the voters.

Sec. 6. RCW 29A.36.121 and 2013 c 11 s 42 are each amended to read as follows:

(1) The positions or offices on a primary consolidated ballot shall be arranged in substantially the following order: United States senator; United States representative; governor; lieutenant governor; secretary of state; state treasurer; state auditor; attorney general; commissioner of public lands; superintendent of public instruction; insurance commissioner; chief privacy officer; state senator; state representative; county officers; justices of the supreme court; judges of the court of appeals; judges of the superior court; and judges of the district court. For all other jurisdictions on the primary ballot, the offices in each jurisdiction shall be grouped together and be in the order of the position numbers assigned to those offices, if any.

(2) The order of the positions or offices on a general election ballot shall be substantially the same as on a primary ballot except that state ballot issues must be placed before all offices. The offices of president and vice president of the United States shall precede all other offices on a presidential election ballot. The positions on a ballot to be assigned to ballot measures regarding local units of government shall be established by the secretary of state by rule.

NEW SECTION.  Sec. 7. A new section is added to chapter 42.17A RCW to read as follows:

The office of the chief privacy officer is a "state office" as that term is used in this chapter.

Sec. 8. RCW 43.03.010 and 1989 c 10 s 8 are each amended to read as follows:

The annual salaries of the following named state elected officials shall be prescribed by the Washington citizens' commission on salaries for elected officials: Governor; lieutenant governor: PROVIDED, That in arriving at the annual salary of the lieutenant governor the commission shall prescribe a fixed amount plus a sum equal to 1/260th of the difference between the annual salary of the lieutenant governor and the annual salary of the governor for each day that the lieutenant governor is called upon to perform the duties of the governor by reason of the absence from the state, removal, resignation, death, or disability of the governor; secretary of state; state treasurer; state auditor; attorney general; superintendent of public instruction; commissioner of public lands; ((and)) state insurance commissioner; and chief privacy officer. Members of the legislature shall receive for their service per annum the amount prescribed by the Washington citizens' commission on salaries for elected officials; and in addition, reimbursement for mileage for travel to and from legislative sessions as provided in RCW 43.03.060.

--- END ---