AN ACT Relating to confidentiality of employment security department records and data; amending RCW 50.13.020, 50.13.030, 50.13.040, 50.13.060, 50.13.070, 50.13.080, 50.13.100, and 42.56.410; adding new sections to chapter 50.13 RCW; and prescribing penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:

Sec. 1. RCW 50.13.020 and 2004 c 121 s 5 are each amended to read as follows:

Any information or records concerning an individual or employing unit obtained by the employment security department ((of employment security)) pursuant to the administration of this title ((or other programs for which the department has responsibility)) shall be private and confidential, except as otherwise provided in this chapter. This chapter does not create a rule of evidence. Information or records may be released by the employment security department ((of employment security)) when the release is:

(1) Required by the federal government in connection with, or as a condition of funding for, a program being administered by the employment security department; or

(2) Requested by a county clerk for the purposes of RCW 9.94A.760.

The provisions of RCW 50.13.060 (1) (a), (b) and (c) will not apply to such release.

Sec. 2. RCW 50.13.030 and 2005 c 274 s 320 are each amended to read as follows:

The commissioner shall have the authority to adopt, amend, or rescind rules interpreting and implementing the provisions of this chapter. ((In particular, these rules shall specify the procedure to be followed to obtain information or records to which the public has access under this chapter or chapter 42.56 RCW.))

Sec. 3. RCW 50.13.040 and 2005 c 274 s 321 are each amended to read as follows:

(1) An individual shall have access to all records and information concerning that individual held by the employment security department, unless the information is exempt from disclosure under RCW 42.56.410.

(2) An employing unit shall have access to its own records and to any records and information relating to a benefit claim by an individual if the employing unit is either the individual's last employer or is the individual's base year employer.

(3) An employing unit shall have access to any records and information relating to any decision to allow or deny benefits if:

(a) The decision is based on employment or an offer of employment with the employing unit; or

(b) If the decision is based on material information provided by the employing unit.

(4) An employing unit shall have access to general summaries of benefit claims by individuals whose benefits are chargeable to the employing unit's experience rating or reimbursement account.

Sec. 4. RCW 50.13.060 and 2011 1st sp.s. c 43 s 466 are each amended to read as follows:

(1) Unless otherwise required by federal law, only state and local governmental agencies((, including law enforcement agencies, prosecuting agencies, and the executive branch, whether state, local, or federal shall))and federally recognized Indian tribes as defined in Title 26 U.S.C. Sec. 3306(u) of the federal unemployment tax act may have access to information or records deemed private and confidential under this chapter if the information or records are needed by the agency for official purposes and:

(a) The agency submits an application in ((writing to))a manner specified by the employment security department for the records or information containing a statement of the official purposes for which the information or records are needed and specific identification of the records or information sought from the employment security department; and

(b) The director, commissioner, chief executive, or other official of the agency requesting records or information has verified the need for the specific information ((in writing either on the application or on a separate document)); and

(c) The agency requesting access has served a copy of the application for records or information on the individual or employing unit whose records or information are sought and has provided the employment security department with proof of service. Service shall be made in a manner which conforms to the civil rules for superior court. The requesting agency shall include with the copy of the application a statement to the effect that the individual or employing unit may contact the public records officer of the employment security department to state any objections to the release of the records or information. The employment security department shall not act upon the application of the requesting agency until at least five days after service on the concerned individual or employing unit. The employment security department shall consider any objections raised by the concerned individual or employing unit in deciding whether the requesting agency needs the information or records for official purposes.

(2) The requirements of subsection((s)) (1) ((and (9))) of this section shall not apply to the state legislative branch. The state legislature ((shall))may have access to information or records deemed private and confidential under this chapter, if the legislature or a legislative committee finds that the information or records are necessary and for official purposes. ((If the employment security department does not make information or records available as provided in this subsection, the legislature may exercise its authority granted by chapter 44.16 RCW.))

(3) In cases of emergency the governmental agency requesting access shall not be required to formally comply with the provisions of subsection (1) of this section at the time of the request if the procedures required by subsection (1) of this section are complied with by the requesting agency following the receipt of any records or information deemed private and confidential under this chapter. An emergency is defined as a situation in which irreparable harm or damage could occur if records or information are not released immediately.

(4) The requirements of subsection (1)(c) of this section shall not apply to state and local governmental agencies and federally recognized Indian tribes as defined in Title 26 U.S.C. Sec. 3306(u) of the federal unemployment tax act where the procedures would frustrate the investigation of possible violations of criminal laws or to the release of employing unit names, addresses, number of employees, and aggregate employer wage data for the purpose of state governmental agencies preparing small business economic impact statements under chapter 19.85 RCW or preparing cost-benefit analyses under RCW 34.05.328(1) (c) and (d). ((Information provided by the department and held to be private and confidential under state or federal laws must not be misused or released to unauthorized parties. A person who misuses such information or releases such information to unauthorized parties is subject to the sanctions in RCW 50.13.080.))

(5) State and local governmental agencies ((shall))and federally recognized Indian tribes as defined in Title 26 U.S.C. Sec. 3306(u) of the federal unemployment tax act may have access to certain records or information((, limited to such items as names, addresses, social security numbers, and general information about benefit entitlement or employer information possessed by the department,))deemed private and confidential under this chapter for comparison purposes with records or information possessed by the requesting agency to detect improper or fraudulent claims, ((or)) to determine potential tax liability or employer compliance with registration and licensing requirements, or for reasons otherwise within the discharge of their official duties. In those cases the state or local governmental agency or federally recognized Indian tribe as defined in Title 26 U.S.C. Sec. 3306(u) of the federal unemployment tax act shall not be required to comply with subsection (1)(c) of this section, but the requirements of ((the remainder of)) subsection (1)(a) and (b) of this section must be satisfied.

(6) Governmental agencies may have access to certain records and information, limited to employer information possessed by the employment security department for purposes authorized in chapter 50.38 RCW. Access to these records and information is limited to only those individuals conducting authorized statistical analysis, research, and evaluation studies. Only in cases consistent with the purposes of chapter 50.38 RCW are governmental agencies not required to comply with subsection (1)(c) of this section, but the requirements of ((the remainder of)) subsection (1)(a) and (b) of this section must be satisfied. ((Information provided by the department and held to be private and confidential under state or federal laws shall not be misused or released to unauthorized parties subject to the sanctions in RCW 50.13.080.))

(7) Disclosure to governmental agencies of information or records obtained by the employment security department from the federal government shall be governed by any applicable federal law or any agreement between the federal government and the employment security department where so required by federal law. When federal law does not apply to the records or information state law shall control.

(8) The employment security department may provide information for purposes of statistical analysis and evaluation of the WorkFirst program or any successor state welfare program to the department of social and health services, the office of financial management, and other governmental entities with oversight or evaluation responsibilities for the program in accordance with RCW 43.20A.080. The confidential information provided by the employment security department shall remain the property of the employment security department and may be used by the authorized requesting agencies only for statistical analysis, research, and evaluation purposes as provided in RCW 74.08A.410 and 74.08A.420. The department of social and health services, the office of financial management, or other governmental entities with oversight or evaluation responsibilities for the program are not required to comply with subsection (1)(c) of this section, but the requirements of the remainder of subsection (1) of this section and applicable federal laws and regulations must be satisfied. The confidential information used for evaluation and analysis of welfare reform supplied to the authorized requesting entities with regard to the WorkFirst program or any successor state welfare program are exempt from public inspection and copying under chapter 42.56 RCW.

(9) ((The disclosure of any records or information by a governmental agency which has obtained the records or information under this section is prohibited unless the disclosure is (a) directly connected to the official purpose for which the records or information were obtained or (b) to another governmental agency which would be permitted to obtain the records or information under subsection (4) or (5) of this section.

(10))) In conducting periodic salary or fringe benefit studies pursuant to law, the office of financial management shall have access to records of the employment security department as may be required for such studies. For such purposes, the requirements of subsection (1)(c) of this section need not apply.

(((11)))(10)(a) To promote the reemployment of job seekers, the commissioner may enter into data-sharing contracts with partners of the one-stop ((career development)) system established by P.L. 113-128 or its successor and identified as signatories of local memoranda of understanding. The contracts shall provide for the transfer of data only to the extent that the transfer is necessary for the efficient provisions of workforce programs, including but not limited to public labor exchange, unemployment insurance, worker training and retraining, vocational rehabilitation, vocational education, adult education, transition from public assistance, and support services. The transfer of information under contracts with one-stop partners is exempt from subsection (1)(c) of this section.

(b) An individual who applies for services from the employment security department and whose information will be shared under (a) of this subsection (((11))) must be notified that his or her private and confidential information in the employment security department's records will be shared among the one-stop partners to facilitate the delivery of one-stop services to the individual. The notice must advise the individual that he or she may request that private and confidential information not be shared among the one-stop partners and the employment security department must honor the request. In addition, the notice must:

(i) Advise the individual that if he or she requests that private and confidential information not be shared among one-stop partners, the request will in no way affect eligibility for services;

(ii) Describe the nature of the information to be shared, the general use of the information by one-stop partner representatives, and among whom the information will be shared;

(iii) Inform the individual that shared information will be used only for the purpose of delivering one-stop services and that further disclosure of the information is prohibited under contract and is not subject to disclosure under chapter 42.56 RCW; and

(iv) Be provided in English and an alternative language selected by the one-stop center or job service center as appropriate for the community where the center is located.

If the notice is provided in-person, the individual who does not want private and confidential information shared among the one-stop partners must immediately advise the one-stop partner representative of that decision. The notice must be provided to an individual who applies for services telephonically, electronically, or by mail, in a suitable format and within a reasonable time after applying for services, which shall be no later than ten working days from the employment security department's receipt of the application for services. ((A one-stop representative must be available to answer specific questions regarding))Information describing the nature, extent, and purpose for which the information may be shared must be available upon request.

(((12)))(11) To facilitate improved operation and evaluation of state programs, the commissioner may enter into data-sharing contracts with other state and local governmental agencies and federally recognized Indian tribes as defined in Title 26 U.S.C. Sec. 3306(u) of the federal unemployment tax act, and by extension their agents, only to the extent that such transfer is necessary for the efficient operation or evaluation of outcomes for those programs. The transfer of information by contract under this subsection is exempt from subsection (1)(c) of this section.

(((13) The misuse or unauthorized release of records or information by any person or organization to which access is permitted by this chapter subjects the person or organization to a civil penalty of five thousand dollars and other applicable sanctions under state and federal law. Suit to enforce this section shall be brought by the attorney general and the amount of any penalties collected shall be paid into the employment security department administrative contingency fund. The attorney general may recover reasonable attorneys' fees for any action brought to enforce this section.))

Sec. 5. RCW 50.13.070 and 1977 ex.s. c 153 s 7 are each amended to read as follows:

Information or records deemed private and confidential under this chapter shall be available to parties to judicial or formal administrative proceedings only upon a written finding by the presiding officer that the need for the information or records in the proceeding outweighs any reasons for the privacy and confidentiality of the information or records. Information or records deemed private and confidential under this chapter shall not be available in discovery proceedings unless the court in which the action has been filed has made the finding specified above. A judicial or administrative subpoena directed to the employment security department must contain this finding. A subpoena for records or information ((held by the department may be directed to and served upon any employee of the department, but the department may specify by rule which employee shall produce the records or information in compliance with the subpoena))under this section must be submitted in a manner prescribed by the employment security department. The employment security department may recover costs of responding to subpoenas, consistent with 20 C.F.R. Sec. 603.8 (2012), for proceedings where the employment security department is not a party.

Sec. 6. RCW 50.13.080 and 2005 c 274 s 323 are each amended to read as follows:

(1) The employment security department shall have the right to disclose information or records deemed private and confidential under this chapter to any private person or organization when such disclosure is necessary to permit private contracting parties to assist in the operation and management of the employment security department in instances where certain employment security departmental functions may be delegated to private parties to increase the employment security department's efficiency or quality of service to the public. The private persons or organizations shall use the information or records solely for the purpose for which the information was disclosed and shall be bound by the same rules of privacy and confidentiality as employment security department employees.

(2) Nothing in this section shall be construed as limiting or restricting the effect of RCW 42.56.070(((9)))(8).

(((3) The misuse or unauthorized release of records or information deemed private and confidential under this chapter by any private person or organization to which access is permitted by this section shall subject the person or organization to a civil penalty of five thousand dollars and other applicable sanctions under state and federal law. Suit to enforce this section shall be brought by the attorney general and the amount of any penalties collected shall be paid into the employment security department administrative contingency fund. The attorney general may recover reasonable attorneys' fees for any action brought to enforce this section.))

Sec. 7. RCW 50.13.100 and 1977 ex.s. c 153 s 10 are each amended to read as follows:

Nothing in this chapter shall prevent the disclosure of information or records deemed private and confidential under this chapter if all details identifying an individual or employing unit are deleted so long as the information or records cannot be foreseeably combined with other publicly available information to reveal the identity of an individual or employing unit or the individual or employing unit consents to the disclosure in a manner prescribed by the employment security department.

NEW SECTION.  Sec. 8. A new section is added to chapter 50.13 RCW to read as follows:

(1) All private persons, governmental agencies, and organizations authorized to receive information from the employment security department under this chapter have an affirmative obligation to take all reasonable actions necessary that are designed to prevent the disclosure of confidential information.

(2) The disclosure of any records or information by a private person, governmental agency, or organization that obtained the records or information from the employment security department under this chapter is prohibited unless expressly permitted by this chapter.

(3) If misuse or an unauthorized disclosure of confidential records or information occurs, all parties aware of the violation must inform the employment security department immediately and take all reasonably available actions to rectify the disclosure to the employment security department's standards.

(4) The misuse or unauthorized disclosure of records or information deemed private and confidential under this chapter by any private person, governmental agency, or organization to which access is permitted by this chapter shall subject the person, governmental agency, or organization to a civil penalty of up to twenty thousand dollars in 2018 and annually adjusted by the employment security department on the first calendar day of each year based on changes in the United States consumer price index for all urban consumers. Other applicable sanctions under state and federal law also apply. The amount of any penalties collected shall be paid into the employment security department administrative contingency fund. The attorney general may recover reasonable attorneys' fees for any action brought to enforce this section.

(5) Any redisclosure of information obtained under this chapter by a private person, governmental agency, or organization must be expressly permitted by the employment security department prior to redisclosure. Failure to obtain prior approval by the employment security department could subject the private person, governmental agency, or organization to the penalties described in subsection (4) of this section.

(6) State and local governmental agencies and federally recognized Indian tribes as defined in Title 26 U.S.C. Sec. 3306(u) of the federal unemployment tax act are exempt from the penalties described in subsection (4) of this section if the redisclosure is necessary for the state, local, or tribal government to conduct a criminal prosecution.

NEW SECTION.  Sec. 9. A new section is added to chapter 50.13 RCW to read as follows:

(1) The employment security department shall designate an agency privacy officer to oversee the administration of this chapter and chapter 50A.--- RCW (the new chapter created in section . . ., chapter . . . (Z-0085/19), Laws of 2019. In coordination with the state office of privacy and data protection, the agency privacy officer must:

(a) Develop an agency personal information minimization policy to reduce the use and retention of personal information wherever possible;

(b) Create a work plan that includes the estimated costs of execution for the following:

(i) An inventory of all personal information prepared, owned, used, or retained by the employment security department, that would include the specific type of information, the purpose for its collection, and the extent to which the information is protected from unauthorized access; and

(ii) A map of the physical or digital location of all personal information collected by the employment security department, indexed to the inventory created in (b)(i) of this subsection; and

(c) Report the work plan created under (b) of this subsection to the state office of privacy and data protection annually.

(2) Any inventory or data map records created under subsection (1)(b) of this section that reveal the location of personal information or the extent to which it is protected may not be disclosed under the public records act, chapter 42.56 RCW.

(3) On December 1st of each odd-numbered year, the employment security department must report to the governor and the legislature on the implementation and maintenance of this section, including best practices and recommendations for developing and implementing the employment security department's policy and plan under this section.

(4) For purposes of this section, "personal information" means any information obtained by the employment security department deemed private and confidential under this chapter and chapter 50A.--- RCW (the new chapter created in section . . ., chapter . . . (Z-0085/19), Laws of 2019.

Sec. 10. RCW 42.56.410 and 2005 c 274 s 421 are each amended to read as follows:

(1) Records maintained by the employment security department and subject to chapter 50.13 RCW if provided to another individual or organization for operational, research, or evaluation purposes are exempt from disclosure under this chapter; and

(2) Any inventory or data map records created under section 9(1)(b) of this act that reveal the location of personal information or the extent to which it is protected.

NEW SECTION.  Sec. 11. A new section is added to chapter 50.13 RCW to read as follows:

Except for section 9 of this act, the provisions of this chapter do not apply to information obtained by the employment security department under Title 50A RCW.

--- END ---