September 2020 Privacy Points

September 21, 2020

Thank you to everyone who has submitted feedback on the draft Washington State Agency Privacy Principles.

The intent of the publication is to guide agency practices to maintain public trust. Many services provided by state government require the collection of personal information. Public agencies have an obligation to handle personal information about Washington residents responsibly, fairly and transparently. The feedback we’ve received will be discussed at our next State Agency Privacy Forum on Oct. 22, 2020. Invites will be sent to state agencies soon. We plan to finalize the principles this fall.

Our office is also making progress on the Privacy Assessment Survey, which will provide policymakers with a valuable snapshot of practices, progress and risks regarding the use and protection of personal information entrusted to state agencies by Washingtonians.

State agencies are required to complete the survey by Sept. 30. The survey is extensive, so we encourage agencies to make sure they allow enough time to complete their work by the deadline. Please feel free to reach out to my office with any questions by emailing privacy@ocio.wa.gov. Agencies can view a tutorial on how to complete the assessment on the Office of Privacy and Data Protection (OPDP) website, by clicking on the Privacy Assessment Survey Walkthrough link.

OPDP presentations

Privacy initiatives: If you missed it, I presented to the Washington Technology Services Board on Tuesday, Sept. 8, where I covered upcoming OPDP initiatives.
Health care privacy laws: Matt King, OPDP’s privacy and open data manager, recently made a presentation with the state Health Care Authority on the development and implementation of resources on 42 CFR Part 2 and related health care privacy laws. The webinar was sponsored by the National Association of State Alcohol and Drug Abuse Directors. The Center of Excellence for Protected Health Information also presented on recent and upcoming changes to 42 CFR Part 2.
Public Records Act: Our next webinar will be on Privacy and the Public Records Act. There is a difficult balance between individual privacy and open records. Please join us on Sept. 24 from 10-11 a.m. as we discuss considerations when handling public records that may contain private information. If you are interested in attending the webinar, please RSVP at privacy@ocio.wa.gov. The sessions will be archived on the OPDP website.

In other news:

An updated version of the Washington Privacy Act has been released by Senator Carlyle for review and feedback. Here’s a helpful summary.
A group of U.S. senators have introduced federal privacy legislation.
Portland passed a strict facial recognition ban that applies to both public and private sector uses.
Some schools and universities are using privacy as a justification to withhold COVID data.
Facebook is nearing a $650 million settlement related to claims it illegally collected biometric information without consent.
Oracle’s partnership with TikTok raises privacy and security considerations.