SENATE BILL REPORT
SB 5834
As Reported by Senate Committee On:
Environment, Energy & Technology, February 2, 2022
Title: An act relating to implementing enterprise-wide technology policies in state government to ensure consistency, security, and responsible use of data.
Brief Description: Implementing enterprise-wide technology policies in state government to ensure consistency, security, and responsible use of data.
Sponsors: Senators Carlyle, Frockt, Nguyen and Stanford.
Brief History:
Committee Activity: Environment, Energy & Technology: 1/25/22, 2/02/22 [DP-WM].
Brief Summary of Bill
  • Authorizes and requires the Office of Privacy and Data Protection (OPDP) to establish privacy principles and best practices by July 31, 2022.
  • Requires states agencies, except as provided, to adopt OPDP established privacy principles and best practices by July 1, 2023.
SENATE COMMITTEE ON ENVIRONMENT, ENERGY & TECHNOLOGY
Majority Report: Do pass and be referred to Committee on Ways & Means.
Signed by Senators Carlyle, Chair; Lovelett, Vice Chair; Das, Fortunato, Liias, Lovick, Nguyen, Sheldon, Stanford and Wellman.
Staff: Angela Kleis (786-7469)
Background:

Overview State Information Technology Organization.  The Consolidated Technology Services Agency, also known as Washington Technology Solutions (WaTech), supports state agencies as a centralized provider and procurer of information technology (IT) services.  Within WaTech, the Office of the Chief Information Officer (OCIO) has primary duties related to IT services, which include developing statewide standards and policies, and establishing policies for periodic review.
 
State Privacy Office.  Within the OCIO, the Office of Privacy and Data Protection (OPDP) serves as a central point of contact for state agencies on policy matters involving data privacy and data protection.  The OPDP also serves as a resource to local governments and the public on data privacy and protection concerns.  Statutory primary duties of the OPDP with respect to state agencies include articulating privacy principles and best practices and coordinating data protection in cooperation with WaTech.

 
Privacy Principles.  The current privacy principles articulated by the OPDP include:

  • lawful, fair, and responsible use;
  • data minimization;
  • purpose limitation;
  • transparency and accountability;
  • due diligence;
  • individual participation; and
  • security.
Summary of Bill:

Additional Specified Statutory Duties.  The OCIO, in coordination with the OPDP, must establish privacy policies for periodic review.  The OPDP must establish privacy principles and best practices.
 
Privacy Principles and Best Practices.  By July 31, 2022, the OPDP must establish privacy principles and best practices.


Beginning July 1, 2023, except as provided, each state agency must adopt the privacy principles and best practice established by the OPDP through its policies and procedures.  Each state agency must annually review such policies and procedures to ensure they are current.
 
A state agency with a requirement that prevents it from complying with this act must receive a waiver from the OPDP.  Waivers must cite specific requirements for needing a waiver, including an estimate of how much additional time is needed and what specific resources would assist the state agency in complying.  The OPDP must assist state agencies in complying with this act.
 
Exemption.  This act does not apply to institutions of higher education.
Appropriation: None.
Fiscal Note: Available.
Creates Committee/Commission/Task Force that includes Legislative members: No.
Effective Date: Ninety days after adjournment of session in which bill is passed.
Staff Summary of Public Testimony:

PRO:  This bill is an attempt to elevate the issue that the public sector has the fiduciary obligation to manage, track, and protect the public's data.  Recent data breaches have demonstrated that Washington State needs to do a better job of securing the public's data.

 

OTHER:  This bill supports the privacy initiatives of the state's privacy office and would help further the maturity of privacy programs across the states' enterprise.  However, we would need additional resources to implement the provisions in the bill.
Persons Testifying: PRO: Senator Reuven Carlyle, Prime Sponsor.
OTHER: Derek Puckett, Consolidated Technology Services (WaTech).
Persons Signed In To Testify But Not Testifying: No one.