HB383: limiting the disclosure of personal information on government Internet sites and amending the information practices act.

HB 383 - AS INTRODUCED

2003 SESSION

03-0245

05/10

HOUSE BILL 383

AN ACT limiting the disclosure of personal information on government Internet sites and amending the information practices act.

SPONSORS: Rep. Kurk, Hills 48; Rep. M. Smith, Straf 72

COMMITTEE: Executive Departments and Administration

ANALYSIS

This bill requires that an individual consent to having his or her personal information available to the public on an Internet site maintained by a state agency or local political subdivision. The bill also updates RSA 7-A, the information practices act, by amending the definition of personal information, removing the definition of machine-accessible, clarifying the biennial reporting requirement, and expanding the reporting requirement to include the legislature, courts, and political subdivisions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

03-0245

05/10

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand Three

AN ACT limiting the disclosure of personal information on government Internet sites and amending the information practices act.

Be it Enacted by the Senate and House of Representatives in General Court convened:

1 Information Practices Act; Definition of Personal Information Amended. Amend RSA 7-A:1 to read as follows:

7-A:1 Definitions. In this chapter:

I. "Agency" means each state board, commission, department, institution, officer or other state official or group [other than] , including the legislature [or] and the courts, established in the state constitution, statutes, session laws, or executive orders, other than the university system of New Hampshire.

II. "File" means the point of collection of personal identifiable information.

III. ["Machine-accessible" means recorded on magnetic tape, magnetic disk, magnetic drum, punched card, optically scannable paper or film, punched paper tape or any other medium by means of which information can be communicated to data processing machines.

IV.] "Personal information" means any information that [by some specific means of identification, including but not limited to any name, number, description, and including any combination of such characters, it is possible to identify with reasonable certainty the person to whom such information pertains] identifies an individual including an individual's name, address, telephone number, social security number, photograph, or computerized image.

[V] IV. "Personal information system" means any method by which personal information is collected, stored or disseminated by any agency of the state.

V. "Publicly available" means any access to personal information on an Internet site maintained by or on behalf of an agency or political subdivision, other than:

(a) By an individual with respect to personal information relating to that individual to the extent determined by the agency or political subdivision.

(b) By the agency or political subdivision or its employees but only in connection with its Internet site.

(c) By the employees of an organization under contract with the agency or political subdivision, but only for purposes of fulfilling contractual obligations.

VI. "Responsible authority" means the head of any governmental agency which is responsible for the collection and use of any data on persons or summary data.

2 Information Practices Act; File with Secretary of State; Report Date Amended and Political Subdivisions Added. Amend the introductory paragraph of RSA 7-A:2 to read as follows:

On or before July 1, [1976] of each even-numbered year, all state agencies and political subdivisions shall file with the secretary of state the following information with respect to all personal information systems, except those consisting of criminal investigation files, maintained by said agency or political subdivision:

3 Information Practices Act; File with Secretary of State; Computer-Accessible. Amend RSA 7-A:2, VIII to read as follows:

VIII. Practices regarding the place and method of personal information storage in the system including but not limited to whether [or not] the personal information is [machine-accessible] accessible by computer, whether it is publicly available on the Internet, and if it is publicly available on the Internet, the procedure for obtaining an individual's consent prior to posting personal information on the Internet.

4 Information Practices Act; Report Change in Purpose; Political Subdivisions Added. Amend RSA 7-A:3 to read as follows:

7-A:3 Changes in Purposes, Uses, etc. The agency or political subdivision shall immediately file with the secretary of state any changes in the information required to be filed with the secretary of state by RSA 7-A:2, except RSA 7-A:2, III, and the secretary of state shall annex said changes to the original filing and preserve all filings. Any changes in the information required by RSA 7-A:2, III shall be filed with the secretary of state no less often than annually.

5 New Section; Information Practices Act; Government Internet Sites; Restriction on Access to Personal Information. Amend RSA 7-A by inserting after section 3 the following new section:

7-A:3-a Government Internet Sites; Restriction on Access to Personal Information.

I. Notwithstanding RSA 91-A, an agency or political subdivision that maintains an Internet site or for which an Internet site is maintained shall obtain an individual's consent prior to making any personal information about that individual publicly available on the Internet site.

II. This section shall not apply to the criminal offenders' registry available to the public under RSA 651-B:7 or to an elected official or an employee of an agency or political subdivision.

6 Information Practices Act; Report to General Court; Political Subdivisions and Information Technology Management Advisory Board Added. Amend RSA 7-A:5 to read as follows:

7-A:5 Report to General Court. The secretary of state shall provide to the president of the senate [and], the speaker of the house of representatives, and the information technology management advisory board on October 1 of each even-numbered year a list of all state agencies that have filed information [with him] pursuant to RSA 7-A.

7 Effective Date. This act shall take effect 60 days after its passage.