2001 SESSION

01-0460

05/10

HOUSE BILL 314-FN

AN ACT relative to administrative rules governing privacy.

COMMITTEE: Executive Departments and Administration

ANALYSIS

This bill requires state agencies to adopt administrative rules governing privacy. It also regulates the use of personal information by state agencies.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Explanation: Matter added to current law appears in bold italics.

Matter removed from current law appears [in brackets and struckthrough.]

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

01-0460

05/10

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand One

AN ACT relative to administrative rules governing privacy.

Be it Enacted by the Senate and House of Representatives in General Court convened:

1 Purpose. The general court recognizes that preserving the confidentiality of individually identifiable information in the possession of the state is of great importance to our citizens. Consequently, the general court recognizes that individually identifiable information in the possession of the state should be used only for the purposes for which it was collected. Such information should not be disclosed to other persons or organizations, except as provided by law, nor should it be given or sold to others so as to become a commodity in the marketplace.

2 Information Practices Act; Definitions Section Amended Generally. Amend RSA 7-A:1 to read as follows:

7-A:1 Definitions. In this chapter:

I. "Agency" means each state board, commission, department, institution, officer or other state official or group other than the legislature or the courts.

II. "File" means the point of collection of personal identifiable information.

III. "Individual" means a human being, alive or dead, who is the subject of personal information.

IV. "Machine-accessible" means recorded on magnetic tape, magnetic disk, magnetic drum, punched card, optically scannable paper or film, punched paper tape or any other medium by means of which information can be communicated to data processing machines.

[IV.] V. "Person" includes a human being, association, organization, trust, corporation, partnership, the state of New Hampshire, any other state of the United States, the federal government and its agencies and instrumentalities, and governmental agencies of any foreign nation or its political subdivisions.

VI. "Personal information" means [any information that by some specific means of identification, including but not limited to any name, number, description, and including any combination of such characters, it is possible to identify with reasonable certainty the person to whom such information pertains] information relating to an individual that is reported to the state or is derived from any interaction between the state and an individual and which:

(a) Contains primary or obvious identifiers, such as the individual's name, address, e-mail address, telephone number, and social security number, or secondary identifiers through which a user could deduce the individual's identity; and

(b) Is under the control of the state.

[V.] VII. "Personal information system" means any method by which personal information is collected, stored or disseminated by any agency of the state.

[VI.] VIII. "Provided by law" means use and disclosure as permitted or required by New Hampshire state law governing programs or activities undertaken by the state or its agencies, or required by federal law, necessary for use or disclosure in any legal process or proceeding, or records evidencing property rights, liens or encumbrances.

IX. "Public records" means records available to any person without restriction.

X. "Purpose for which it was collected" means utilization as intended at the time the information was collected, utilization for any other program administered by the entity which collected the information, and for any use which is established to detect or investigate accuracy, fraud, and any unlawful activity or for licensing, certification or regulatory purposes, failure to comply with any law or rule.

XI. "Responsible authority" means the head of any governmental agency which is responsible for the collection and use of any data on persons or summary data.

XII. "State" means the state of New Hampshire, its agencies or instrumentalities.

3 New Subdivision; The State and its Government; Information Practices Act; Limitation on Use of Personally Identifiable Information. Amend RSA 7-A by inserting after section 5 the following new subdivision:

Limitation on Use of Personally Identifiable Information

7-A:6 Privacy Right. There is hereby recognized an individual's right to privacy in the content of an individual's personal information under the control of the state.

7-A:7 Disclosure of Personal Information.

I. Except as provided in paragraph II or otherwise provided by law or if the individual or the individual's authorized representative otherwise consents to disclosure or waives confidentiality, the state may disclose or use personal information only for the purposes for which it was collected.

II. The state may disclose personal information without the consent of the individual if the personal information is disclosed to a person authorized to receive such information pursuant to a valid order of a court of competent jurisdiction for good cause shown and after the individual whose personal information is the subject of such order has been notified of the proposed order in clear, conspicuous, and simple language, and has had reasonable opportunity to contest the proposed order and to verify the accuracy of the information being disclosed by the state.

III. Any disclosure under this section shall provide only the minimum amount of personal information to the minimum number of persons necessary and in as confidential a manner as possible in order to effect the purpose for which disclosure is being ordered.

7-A:8 Consent to Disclosure Required. An individual's consent to the disclosure of his or her personal information shall be valid only if it is fully informed, freely given, and in writing.

I. In this section, "fully informed" means that the individual consenting knows the nature of what will be disclosed, to whom the information will be disclosed, and the purpose for which the disclosure is being made.

II. Consent shall not be considered "freely given" if it is a condition of receiving any service or benefit provided by the state.

III. The consenting individual may revoke consent prospectively at any time.

7-A:9 Limitation on Collection of Personal Information. The state shall limit its collection of personal information to the minimum necessary to operate programs or activities as provided by law.

7-A:10 Individual Access to Personal Information. Every individual shall be allowed access to his or her personal information held by the state, and provided reasonable opportunity to ensure that it is accurate. Except as provided by law, no individual's personal information held by the state shall be disclosed to other persons or entities unless the individual has been afforded reasonable opportunity to correct any inaccuracies. No fee shall be charged to an individual for copies of his or her personal information provided for this purpose.

7-A:11 Administrative Rules Governing Privacy.

I. Each agency shall adopt rules pursuant to RSA 541-A governing privacy.

II. The attorney general, in consultation with agencies that receive personal information, and with the advice of the director of the office of legislative services, shall draft proposed model rules relative to privacy.

III. The model rules adopted pursuant to paragraph II, and all rules on privacy, unless otherwise authorized by statutes governing an agency, shall address at least the following areas:

(a) Limiting the collection of personal information to the minimum details needed to operate programs or activities as provided by law.

(b) Collecting the information, whenever possible, directly from the individual concerned.

(c) Informing individuals about why information is being collected and how it will be used.

(d) Restricting use of the data collected to the purpose for which it was collected, unless otherwise provided by law.

(e) Ensuring the personal information being maintained is as accurate as possible.

(f) Allowing individuals a reasonable opportunity to expeditiously obtain access to their personal information and to ensure that it is correct.

(g) Restricting disclosure of personal information to the purposes for which it was collected, unless otherwise provided by law.

(h) Providing for the disclosure of additional identifying information about holders of licenses and permits in order to allow confirmation of identity and professional competence without undue disclosure or additional personal information.

(i) Establishing criteria for exceptions for emergencies causing a serious risk to public health and safety.

IV. Each state agency shall be required to apply the model rules 6 months after their effective date to the extent the agency's rules or governing statutes do not address each of the areas listed in the preceding paragraph, provided that such use shall not conflict with a statute, judicial decision, or other rule of the agency.

7-A:12 Penalties. Penalties for violating a provision of this subdivision are as follows:

I. An aggrieved individual may bring a civil action under this section if the state knew or should have known that personal information was being collected, used, or disclosed in violation of this subdivision. State agency employees determined to have knowingly violated this section may be subject to termination. Good faith shall be an affirmative defense.

II. Neither the state nor its agencies or employees shall be civilly liable for any improper use or disclosure of personal information by any person obtaining such personal information as provided in this section.

III. An aggrieved individual may bring an action for injunctive relief for a violation of this subdivision in addition to or instead of penalties provided for in this section. The applicant for injunctive relief shall not be required to give security as a condition for the issuance of the injunction.

IV. Whenever the attorney general has reason to believe that the state has negligently, or knowingly and willfully violated a provision of this subdivision and that an action under this subdivision is in the public interest, the attorney general may bring an action to enjoin the violations of this subdivision.

V. The superior court shall have jurisdiction over any action arising under this subdivision.

7-A:13 Construction with Other Laws. To the extent other federal or state statutes subject the use or disclosure of personal information to more restrictive confidentiality provisions than those found in this subdivision, and the rules adopted thereunder, the more restrictive provisions shall apply.

4 New Paragraph; Access to Public Records; Personal Information Exempted. Amend RSA 91-A:5 by inserting after paragraph V the following new paragraph:

VI. Personal information which is not subject to disclosure pursuant to RSA 7-A.

5 New Subparagraph; Administrative Procedures Act; Administrative Rules Governing Privacy. Amend RSA 541-A:16, I by inserting after subparagraph (d) the following new subparagraph:

(e) Adopt rules governing privacy and the use of personal information, pursuant to RSA 7-A:11.

6 Reference Added; Administrative Procedures Act; Time Limit. Amend RSA 541-A:17, II to read as follows:

II. Notwithstanding the provisions of paragraph I, the rules proposed and adopted pursuant to RSA 541-A:16, I(a), (b)(2), (b)(3), (c), [and] (d) and (e) shall not expire, provided that they have been approved by the committee. No changes to such rules may be made by the agency, other than editorial changes not affecting the substance of the rules, without following the rulemaking procedures required in this chapter. However, if the adoption or amendment of a statute governing the agency renders the agency's rules under RSA 541-A:16, I(a), (b)(2), (b)(3), (c), [or] (d), or (e) no longer accurate, such rules shall expire one year after the effective date of the statute that makes such change, unless such rules are amended, superseded, or repealed before such expiration. The agency shall commence rulemaking to amend its rules no later than 90 days after the effective date of such statute. If the agency reorganizes its organization and responsibilities in such a way that the agency's rules under RSA 541-A:16, I(a) describing its organization are no longer accurate, the agency shall amend its rules as soon as is practicable, but shall commence rulemaking not later than 90 days after such changes occur.

7 Effective Date. This act shall take effect January 1, 2002.

LBAO

01-0460

1/23/01

HB 314-FN - FISCAL NOTE

FISCAL IMPACT: