SB 302 — Revises provisions relating to personal information collected by governmental agencies. (BDR 52-547)

(ReprintedSenate withBill amendmentsNo. adopted on May 24, 2019) THIRD REPRINT S.B.

302302–Senator SENATESeevers BILLGansert NOCHAPTER.......... .

302–SENATOR SEEVERS GANSERT M ARCH 18, 2019 ____________ Referred to Committee on Commerce and Labor SUMMARY—Revises provisions relating to personal information collected by governmental agencies.

(BDR 52-547) FISCAL NOTE:

Effect on Local Government:

May have Fiscal Impact.

Effect on the State:

Yes.

~ EXPLANATION – Matter in bolded italics is new;

matter between brackets [omitted material] is material to be omitted.

Existing law requires a data collector, including a governmental agency, that maintainsimplement recordsand whichmaintain containreasonable personalsecurity informationmeasures ofto aprotect residentsuch records.tate to (NRS 603A.210) Section 1 of this Statebill torequires implementa anddata maintaincollector reasonablethat securityis measuresa governmental agency to protectcomply, suchto records.the extent practicable, with certain standards published by the Center for Internet Security, Inc.

(NRSor 603A.210)the SectionNational 1Institute of thisStandards billand requiresTechnology of the United States Department of Commerce with respect to the collection, dissemination and maintenance of records containing Division of Enterprise Information Technology Services of the Department of of the Administration to create, maintain and make available to the public a datalist collectorof controls and standards that the State is arequired publishedto bycomply with pursuant to federal law that also satisfy the Centerstandards forand Internetcontrols Security,set Inc.forth in section 1.

orExisting thelaw Nationalrequires Institutethe ofLegislative StandardsAuditor andto Technologyconduct ofa thepostaudit United States Department of Commerceall withaccounts, respectfunds toand theother collection,records disseminationof andall maintenanceagencies of recordsthe containingState personalto information.determine certain regulations.

Section(NRS 1218G.200) requiresSection the2 Office of Informationthis Securitybill ofspecifies thethat Divisionsuch ofapplicable Enterpriselaws Informationand Technologyregulations Servicesinclude, ofwithout limitation, the Department of controls and standards thatregarding therecords Statecontaining ispersonal requiredinformation to comply with pursuant to federal law that also satisfy the standards and controls set forth in section 1.

- *SB302_R3* – 2 – Existing law requires the Legislative Auditor to conduct a postaudit of all accounts, funds and other records of all agencies of the State to determine certain information, including the compliance of the agency with applicable laws and laws and regulations include, without limitation, the standards regarding records containing personal information set forth in section 1.

Section 1.5 further requires the Legislative Auditor to report to the Governor, the Chair of the Legislative Commission,Commission and the Chairhead of thean Auditaffected Subcommitteeagency ofany vulnerability in the information system of an agency of this State that the Legislative AuditoryAuditor in discovers during the course of an audit and determines poses a serious threat to the security of the information system.

(NRS 719.350) Existing law prohibits a governmental agency from requiring a person to include - 80th Session (2019) – 2 – personal information on any document submitted to the governmental agency on or after January 1, 2007, unless required pursuant to a specific state or federal law, for the administration of a public program or for an application for a federal or state for grant.

(NRS 239B.030) Section 3 of this bill authorizes a governmental agency to require a person to submit a document that is required to contain personal informationagency to establish procedures by electronicwhich means.a person may apply for and receive a waiver from such a requirement.

Section 31.1 furtherof authorizesthis abill governmentalrequires agencyeach tocourt establishof proceduresjustice byin whichthis aState personto maypermanently applyremove forall anddata receivefrom aelectronic waiverwaste frombefore suchdisposing aof requirement.such waste.

SectionSections 1.11.3, of this bill requires each court of justice in this State to permanently 2.7, 5 and 6 of this bill similarly require the Legislative Counsel Bureau, certain state agencies, each school district and the Nevada System of Higher Education, respectively, to remove all data from electronic waste before disposing of such waste.

EXPLANATION – Matter in bolded italics is new;

matter between brackets [omitted material] is material to be omitted.

or its successor organization, or corresponding standards adopted by the National - *SB302_R3* – 3 – Institute of Standards and Technology of the United States Department of Commerce.

If a state or federal law requires a data collector to provide greater protection to records that contain personal information of a resident of this State which are maintained by the data collector and the data collector is in compliance with the - 80th Session (2019) – 3 – provisions of that state or federal law, the data collector shall be deemed to be in compliance with the provisions of this section.

thereto a new section to read as follows:mended by adding 1.

Before disposing of electronic waste, each court of justice in this State shall permanently remove any data stored on the electronic waste.

2.

As used in this section, “electronic waste” means electronic equipment that has been discarded, is no longer wanted by the owner or for any other reason enters the waste collection, recovery, treatment, processing or recycling system.

1.1.

Chapter 1 of NRS is hereby amended by adding thereto a new section to read as follows:

in this State shall permanently remove any data stored on theustice electronic waste.

electronic equipment that has been discarded, is no longer wanted by the owner or for any other reason enters the waste collection, recovery, treatment, processing or recycling system.

Sec.

1.must not contain any information that the Legislative Auditoritor determines could potentially expose this State to a breach of the security of an information system of an agency of this State.

A2. report of an audit conducted by the Legislative Auditor must not contain any information that the Legislative Auditor determines could potentially expose this State to a breach of the security of an information system of an agency of this State.

- *SB302_R3* – 4 – 2.

- 80th Session (2019) – 4 – Sec.

(c) Compliance with all applicable laws and regulations [.] , including, without limitation, compliance with the standardsstandards.] , regarding records containing personal information set forth in NRS 603A.210.

(d) Whether the operations of the agency of the State have been con(e)conducted Whetherin controlaccordance bywith managementits andcontractual theobligations. system ofns.

information(e) provideWhether ancontrol adequateby management and efficientthe system of recordsinformation andprovide acc2.ntiEvery officer and employee of an agencyadequate of the State shall aid and assistefficient thesystem Legislative Auditor at such times as the Legislative Auditor requires in the inspection, examination and audit of anyrecords books, accounts and recordsaccounting. in their possession.