California Senate Bill 272 updates California Public Records Act with new mandate
Written by Sloane Dell'Orto
SB-272, SECTION 6270.5 OF THE CALIFORNIA PUBLIC RECORDS ACT: LOCAL AGENCIES: INVENTORY.
SB 272 requires local agencies (excluding school districts) to create catalogs of all enterprise systems that store information about the public, and to post this catalog on their websites, if they have websites. If they do not have a website, they are required to publish the catalog in a way that can be provided to anyone who asks. This law applies to all California special districts, cities and counties, and compliance is required by July 1, 2016.
Governor Brown approved SB 272 in October 2015, adding section 6270.5 to the California Public Records Act (the "Act," Government Code Sections 6250-6276.48). Because it was added to the Public Records Act, local agencies will not be able to seek reimbursement from the State for costs associated with compliance.
WHAT IS COVERED BY SB 272?
Section 6270.5 defines an enterprise system as a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is:
a multidepartmental system or system that contains information collected about the public and a system of record A system of record means a system that serves as an original source of data within an agency.
SB 272 requires local agencies to create a catalog of multidepartmental systems or systems containing information about the public that store original records and post the catalog on their agency website.
WHAT IS EXCLUDED?
Enterprise systems do not include cybersecurity systems, infrastructure and mechanical control systems, or information that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, a public agency's IT system. Additionally, section 6270.5 does not automatically require disclosure of the specific records that the IT systems collect, store, exchange or analyze, however, the Act's other provisions pertaining to disclosure of such records still apply.
WHAT IS REQUIRED IN THE CATALOG?
For each enterprise system included in the catalog list, agencies must disclose:
Current system vendor Current system product The purpose of the system What kind of data is stored in it The department that serves as the system's primary custodian How frequently system data is collected How frequently system data is updated For the full text of the bill, see https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id 1520160SB272
SECTION 1. The Legislature finds and declares all of the following:
(a) New information technology has dramatically changed the way people search for and expect to find information in California. (b) This technology has unlocked great potential for government to better serve the people it represents. A recent study estimated that digitizing government data could generate one trillion dollars in economic value worldwide through cost savings and improved operational performance. (c) California plays a vitally important role in moving our nation forward in the world of technology. Just as the state's thriving tech industry surges ahead in setting new standards for society, so too must California. (d) As several nations, states, and cities have begun to embrace policies of online access to public sector data, they have enjoyed the benefits of increased operational efficiency and better collaboration. Here in California, cities across the state are turning internally gathered and maintained data into usable information for the public to access and leverage for the benefit of their communities. (e) In moving government to a more effective digital future, standards should be adopted to ensure that data collection and publication are standardized, including uniform definitions for machine-readable data. Online portals should also be developed to assist with public access to collected data. (f) With a public sector committed to success in the digital age, the residents and businesses of California will stand to benefit from the greater collaboration and integration, improved accountability, and increased productivity that will result. (g) In making California government more accessible to the people of the state, paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution requires local governments to comply with the California Public Records Act and with any subsequent statutory enactment amending that act and furthering that purpose. SEC. 2. Section 6270.5 is added to the Government Code, to read:
6270.5. (a) In implementing this chapter, each local agency, except a local educational agency, shall create a catalog of enterprise systems. The catalog shall be made publicly available upon request in the office of the person or officer designated by the agency's legislative body. The catalog shall be posted in a prominent location on the local agency's Internet Web site, if the agency has an Internet Web site. The catalog shall disclose a list of the enterprise systems utilized by the agency and, for each system, shall also disclose all of the following:
(1) Current system vendor.
(2) Current system product.
(3) A brief statement of the system's purpose.
(4) A general description of categories or types of data.
(5) The department that serves as the system's primary custodian.
(6) How frequently system data is collected.
(7) How frequently system data is updated.
(b) This section shall not be interpreted to limit a person's right to inspect public records pursuant to this chapter.(c) For purposes of this section:(1) "Enterprise system" means a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is both of the following:
(A) A multidepartmental system or a system that contains information collected about the public.
(B) A system of record.
(2) "System of record" means a system that serves as an original source of data within an agency.
(3) An enterprise system shall not include any of the following:
(A) Information technology security systems, including firewalls and other cybersecurity systems.
(B) Physical access control systems, employee identification management systems, video monitoring, and other physical control systems.
(C) Infrastructure and mechanical control systems, including those that control or manage street lights, electrical, natural gas, or water or sewer functions.
(D) Systems related to 911 dispatch and operation or emergency services.
(E) Systems that would be restricted from disclosure pursuant to Section 6254.19.(F) The specific records that the information technology system collects, stores, exchanges, or analyzes.
(d) Nothing in this section shall be construed to permit public access to records held by an agency to which access is otherwise restricted by statute or to alter the process for requesting public records, as set forth in this chapter. (e) If, on the facts of the particular case, the public interest served by not disclosing the information described in paragraph (1) or (2) of subdivision (a) clearly outweighs the public interest served by disclosure of the record, the local agency may instead provide a system name, brief title, or identifier of the system.(f) The local agency shall complete and post the catalog required by this section by July 1, 2016, and thereafter shall update the catalog annually.
SEC. 3. The Legislature finds and declares that Section 2 of this act, which adds Section 6270.5 to the Government Code, furthers, within the meaning of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, the purposes of that constitutional section as it relates to the right of public access to the meetings of local public bodies or the writings of local public officials and local agencies. Pursuant to paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, the Legislature makes the following findings:
Because increased information about what data is collected by local agencies could be leveraged by the public to more efficiently access and better use that information, the act furthers the purpose of Section 3 of Article I of the California Constitution. SEC. 4. The Legislature finds and declares that Section 2 of this act limits the public's right of access to public documents within the meaning of paragraph (2) of subdivision (b) of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest and the need for protecting that interest: (a) The interest protected by this limitation is the security of enterprise systems in public agencies. (b) The need for protecting that interest is that enterprise systems can contain information that, if released to the public, could result in negative consequences. SEC. 5. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district under this act would result from a legislative mandate that is within the scope of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution.