2000 SESSION

00-2592

05/10

HOUSE BILL 1612-FN

COMMITTEE: Executive Departments and Administration

ANALYSIS

This bill establishes an office of privacy as a unit under the commissioner of administrative services to monitor citizen access rights to personal information held by state agencies.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

00-2592

05/10

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand

Be it Enacted by the Senate and House of Representatives in General Court convened:

1 Purpose. The general court recognizes that preserving the confidentiality of individually identifiable information in the possession of the state is of great importance to our citizens. Consequently, the general court recognizes that individually identifiable information in the possession of the state should be used only for the purposes for which it was collected, and should not be a commodity in the marketplace.

2 Office of the Commissioner; Office of Privacy Unit. Amend RSA 21-I:4 to read as follows:

21-I:4 Office Established. There is hereby established an office of the commissioner consisting of the following [5] units:

I. Financial data management unit.

II. State budget.

III. Internal audit.

IV. Operational analysis.

V. Cost containment.

VI. Office of Privacy.

3 New Subdivision; Office of Privacy. Amend RSA 21-I by inserting after section 5 the following new subdivision:

Office of Privacy

21-I:5-a The office of privacy is hereby established as a unit in the office of the commissioner. The governor shall appoint a privacy director to monitor and assure compliance by the state with the provisions of this subdivision.

I. In this subdivision:

(a) "Individual" means a human being, alive or dead, who is the subject of personal information and includes the individual's legal or other authorized representative.

(b) "Person" includes a human being, association, organization, trust, corporation, partnership, the state of New Hampshire, any other state of the United States, and the federal government and its agencies and instrumentalities.

(c) "Personal information" means information relating to an individual that is reported to the state or is derived from any interaction between the state and an individual and which:

(1) Contains primary or obvious identifiers, such as the individual's name, address, e-mail address, telephone number, and social security number, or secondary identifiers through which a user could deduce the individual's identity; and

(2) Is under the control of the state.

(d) "State" means the state of New Hampshire, its agencies or instrumentalities.

II. There is hereby recognized an individual's right of privacy in the content of the individual's personal information under the control of the state.

III. Except as provided under paragraph IV or otherwise provided by law or if the individual or the individual's authorized representative otherwise consents or waives confidentiality, the state may disclose or use personal information only for the purposes for which it was collected. No person to whom personal information is disclosed may use the information for any purpose other than the purpose for which it was disclosed.

IV.(a) The state may disclose personal information without the consent of the individual if the personal information is disclosed to a person authorized to receive such information pursuant to a valid order of a court of competent jurisdiction for good cause shown and after the individual whose personal information is the subject of the order has been notified of the proposed order in clear, conspicuous, and simple language, and has had an opportunity to contest the proposed order.

(b) Any disclosure under this paragraph shall provide only the minimum amount of personal information to the minimum number of persons necessary and in as confidential a manner as possible in order to effect the purpose for which it is being disclosed.

V. Any consent to the disclosure of personal information under paragraph III shall be valid only if it is fully informed, freely given, and in writing.

(a) "Fully informed" means that the individual consenting knows the nature of what will be disclosed, to whom the information will be disclosed, and the purpose for which the disclosure is being made.

(b) Consent shall not be considered freely given if it is a condition of receiving any service or benefit provided by the state.

(c) Consent may be revoked prospectively at any time.

VI. The state shall limit its collection of personal information to the minimum necessary to operate programs or activities.

VII. Every individual shall be allowed access to his or her personal information and the opportunity to ensure that it is correct. Reasonable fees may be charged for providing personal information.

VIII. The commissioner may adopt rules pursuant to RSA 541-A to fulfill the responsibilities under this subdivision, including but not limited to:

(a) Limiting the collection of personal information to the minimum details needed to operate programs or activities;

(b) Collecting the information, whenever possible, directly from the individual concerned;

(c) Informing individuals about why information is being collected and how it will be used;

(d) Restricting use of the data collected to the purpose for which it was collected;

(e) Ensuring the personal information being maintained is as accurate as possible;

(f) Allowing individuals a reasonable opportunity to obtain access to their personal information and to ensure that it is correct; and

(g) Restricting disclosure of personal information to the purposes for which it was collected.

IX. The commissioner or primary director shall investigate complaints brought by any individual or person concerning the provisions of this subdivision.

X. Penalties for violating a provision of this subdivision are as follows:

(a) An aggrieved individual may bring a civil action under this section if the state knew or should have known that personal information was being collected, used, or disclosed in violation of this subdivision. In addition to compensatory damages, the aggrieved individual, if successful, shall be awarded special damages of not less than $1,000 for each violation.

(b) An aggrieved individual may bring an action for injunctive relief for a violation of this subdivision in addition to or instead of penalties provided for in this paragraph. The application for injunctive relief shall not be required to give security as a condition upon the issuance of the injunction.

(c) Whenever the attorney general has reason to believe that the state has knowingly and willfully violated a provision of this subdivision and that an action under this subdivision is in the public interest, the attorney general may bring an action to enjoin the violations of this section.

4 Effective Date. This act shall take effect January 1, 2001.

LBAO

00-2592

12/17/99

HB 1612-FN - FISCAL NOTE

FISCAL IMPACT: