Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state.

This bill would require each local agency, except a local educational agency, in implementing the California Public Records Act, to create a catalog of enterprise systems, as defined, to make the catalog publicly available upon request in the office of the person or officer designated by the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the enterprise systems utilized by the agency, and, among other things, the current system vendor and product, unless, on the facts of the particular case, the public interest served by not disclosing that information clearly outweighs the public interest served by disclosure, in which case the local agency may instead provide a system name, brief title, or identifier of the system. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers this purpose.

This bill would make legislative findings to that effect.

Existing constitutional provisions require a statute that limits the right of public access to meetings or writings of public officials to be adopted with findings demonstrating the interest to be protected by that limitation and the need to protect that interest.

This bill would declare that it includes limitations on access, that the interest to be protected is the security of enterprise systems in public agencies, and that the need to protect that interest is that enterprise systems can contain information that, if released to the public, could result in negative consequences.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state.

This bill would require each local agency, except a local educational agency, in implementing the California Public Records Act, to create a catalog of enterprise systems, as defined, to make the catalog publicly available upon request in the office of the person or officer designated by the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the enterprise systems utilized by the agency, and, among other things, the current system vendor and product, unless, on the facts of the particular case, the public interest served by not disclosing that information clearly outweighs the public interest served by disclosure, in which case the local agency may instead provide a system name, brief title, or identifier of the system. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers this purpose.

This bill would make legislative findings to that effect.

Existing constitutional provisions require a statute that limits the right of public access to meetings or writings of public officials to be adopted with findings demonstrating the interest to be protected by that limitation and the need to protect that interest.

This bill would declare that it includes limitations on access, that the interest to be protected is the security of enterprise systems in public agencies, and that the need to protect that interest is that enterprise systems can contain information that, if released to the public, could result in negative consequences.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state.

This bill would require each local agency, except a local educational agency, in implementing the California Public Records Act, to create a catalog of enterprise systems, as defined, to make the catalog publicly available upon request in the office of the person or officer designated by the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the enterprise systems utilized by the agency, and, among other things, the current system vendor and product. product, unless, on the facts of the particular case, the public interest served by not disclosing that information clearly outweighs the public interest served by disclosure, in which case the local agency may instead provide a system name, brief title, or identifier of the system. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers this purpose.

This bill would make legislative findings to that effect.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state.

This bill would require each local agency, except a local educational agency, in implementing the California Public Records Act, to create a catalog of enterprise systems, as defined, to make the catalog publicly available upon request in the office of the person or officer designated by the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the enterprise systems utilized by the agency, and, among other things, the current system vendor and product. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers this purpose.

This bill would make legislative findings to that effect.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state.

This bill would require each local agency, except a school district, local educational agency, in implementing the California Public Records Act, to create a catalog of information technology enterprise systems, as defined, to make the catalog publicly available upon request in the office of the clerk of person or officer designated by the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the information technology enterprise systems utilized by the agency, and, among other things, the current system vendor and product. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers this purpose.

This bill would make legislative findings to that effect.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state.

This bill would require each local agency, except a school district, in implementing the California Public Records Act, to create a catalog of enterprise information technology systems, as defined, to make the catalog publicly available upon request in the office of the clerk of the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the enterprise information technology systems utilized by the agency, and, among other things, the current system vendor and product. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers this purpose.

This bill would make legislative findings to that effect.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state. Existing law also requires every public agency to comply with the California Public Records Act and with any subsequent statutory enactment amending the act, or enacting or amending any successor act.

This bill would require each local agency, in implementing the California Public Records Act, to conduct an inventory of data gathered by the agency that discloses what data is maintained by the agency, by whom, and with what frequency it is collected. The bill would require the inventory to be available to the public. create a catalog of enterprise systems, as defined, to make the catalog publicly available upon request in the office of the clerk of the agencys legislative body, and to post the catalog on the local agencys Internet Web site. The bill would require the catalog to disclose a list of the enterprise systems utilized by the agency, and, among other things, the current system vendor and product. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the California Public Records Act, requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act declares that access to information concerning the conduct of the peoples business is a fundamental and necessary right of every person in this state. Existing law also requires every public agency to comply with the California Public Records Act and with any subsequent statutory enactment amending the act, or enacting or amending any successor act.

This bill would require each local agency, in implementing the California Public Records Act, to conduct an inventory of data gathered by the agency that discloses what data is maintained by the agency, by whom, and with what frequency it is collected. The bill would require the inventory to be available to the public. Because the bill would require local agencies to perform additional duties, it would impose a state-mandated local program.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

 UNFINISHED BUSINESS  

Bill No: SB 272

Author: Hertzberg (D)

Amended: 9/2/15

Vote: 21

SENATE GOVERNANCE & FIN. COMMITTEE: 7-0, 4/15/15

AYES: Hertzberg, Nguyen, Bates, Beall, Hernandez, Lara, Pavley

SENATE JUDICIARY COMMITTEE: 7-0, 4/21/15

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/4/15

AYES: Lara, Bates, Beall, Hill, Leyva, Mendoza, Nielsen

SENATE FLOOR: 37-0, 5/7/15

AYES: Allen, Anderson, Bates, Beall, Berryhill, Block, Cannella, De León, Gaines, Galgiani, Hall, Hancock, Hernandez, Hertzberg, Hill, Hueso, Huff, Jackson, Lara, Leno, Leyva, McGuire, Mendoza, Mitchell, Monning, Moorlach, Morrell, Nguyen, Nielsen, Pan, Pavley, Roth, Runner, Stone, Vidak, Wieckowski, Wolk

NO VOTE RECORDED: Fuller, Liu

ASSEMBLY FLOOR: 79-0, 9/4/15 - See last page for vote

SUBJECT: The California Public Records Act: local agencies: inventory

SOURCE: Author

DIGEST: This bill requires local governments, with specified exceptions, to catalog, and make publicly available, information about their data systems

Assembly Amendments exclude local education agencies from this bill’s requirements, modify this bill’s definition of “enterprise system,” specify a schedule by which local agencies must complete and update catalogues of their data systems, and provide local agencies with an alternative to publicly disclosing specified information in cases when public disclosure would not serve the public interest.

ANALYSIS:

Existing law, the California Public Records Act (CPRA), requires public records to be open to inspection during office hours and gives every person a right to inspect public records, with specific exceptions. The CPRA also specifies procedures for requesting copies of public records.

This bill:

1. Requires local agencies, except local education agencies, in implementing the CPRA, to create a catalog of enterprise systems.

2. Defines “enterprise system” as a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is both:

   1. A multi-departmental system or a system that contains information collected about the public.

   2. A system of record.

3. Defines “system of record” as a system that serves as an original source of data within an agency.

4. Directs that an enterprise system must not include any of the following:

   1. Information technology security systems, including firewalls and other cybersecurity systems.

   2. Physical access control systems, employee identification management systems, video monitoring, and other physical control systems.

   3. Infrastructure and mechanical control systems, including those that control or manage street lights, electrical, natural gas, or water or sewer functions.

   4. Systems related to 911 dispatch and operation or emergency services.

   5. Systems that would be restricted from disclosure pursuant to Section 6254.19.

   6. The specific records that the information technology system collects, stores, exchanges, or analyzes.

5. Requires that the catalog prepared by each local agency must:

   1. Be completed and posted by July 1, 2016, and updated annually.

   2. List the enterprise systems utilized by the agency.

   3. Disclose, for each enterprise system, all of the following:

      1. Current system vendor.

      2. Current system product.

      3. A brief statement of the system’s purpose.

      4. A general description of categories or types of data.

      5. The department that serves as the system’s primary custodian.

      6. How frequently system data is collected.

      7. How frequently system data is updated.

      8. Be made publicly available in a specified manner.

   4. Allows a local agency to provide alternative information if, on the facts of the particular case, the public interest served by not disclosing the current system vendor and current system product clearly outweighs the public interest served by disclosure.

6. Directs that its provisions must not be construed to permit public access to records held by an agency to which access is otherwise restricted by statute or to alter the process for requesting public records, as specified.

7. States that its provisions must not be interpreted to limit a person’s right to inspect public records pursuant to the provision of the CPRA.

8. Contains legislative findings and declarations that:

   1. Identify the potential benefits of expanded public access to electronic data gather and maintained by local agencies.

   2. Demonstrate the interest protected by a specified provision of this bill which limits the public’s right of access to public documents.

   3. Disclaim the need to reimburse costs that may be incurred by a local agency or school district under this act.

Comments

Purpose of the bill. Government agencies are rapidly expanding their use of computer technologies to conduct the public’s business, including budgeting, mapping, and issuing permits. Much of the electronic data that local governments throughout California possess can be a powerful tool for improving the lives of Californians. Harnessing the power of local data will help to make government more transparent and accountable to the public, foster collaboration among agencies to deliver public services more efficiently and effectively, and support policies that generate economic growth and improve California communities. However, members of the public too often are not aware of what data local governments collect, the format the data is in, or the location where the data is stored. Similarly, a lack of information about local agencies’ data systems may impede efforts among local agencies to collaborate on projects to standardize and share public data sets. By requiring local governments to share information about their enterprise data systems, SB 272 takes a significant step towards making California local government data more accessible to the public.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Assembly Appropriations Committee, because this bill furthers the purpose of the CPRA, local agencies' costs to create catalogues of their respective enterprise systems would be nonreimbursable.

SUPPORT: (Verified 9/4/15)

American Civil Liberties Union of California
American Federation of State, County and Municipal Employees, AFL-CIO
Associated Builders and Contractors of California
Building Owners and Managers Association of California
California Asian Pacific Chamber of Commerce
California Broadcasters Association
California Business Properties Association
California Business Roundtable
California Forward Action Fund
California League of Food Processors
California Manufacturers & Technology Association
California Retailers Association
Commercial Real Estate Development Association
Data Transparency Coalition

Family Business Association
Firearms Policy Coalition
International Council of Shopping Centers
Los Angeles County Business Federation
National Federation of Independent Businesses
San Diego Regional Data Library
San Francisco Technology Democrats
Sunlight Foundation
Urban Strategies Council

OPPOSITION: (Verified 9/4/15)

Cites of Fountain Valley and Palo Alto

ASSEMBLY FLOOR: 79-0, 9/04/15

AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins

NO VOTE RECORDED: Ridley-Thomas

Prepared by: Brian Weinberger / GOV. & F. / (916) 651-4119

9/4/15 19:10:21

**** END ****

SENATE THIRD READING

STR Bill Id:SB 272

Author:(Hertzberg)

As Amended Ver:September 2, 2015

Majority vote

SENATE VOTE: 37-0

SUMMARY: Requires cities, counties, special districts, and joint powers authorities, by July 2016, to create a catalogue of their enterprise systems and make the catalog available to the public, including on the agency's Web site. Specifically, this bill:

1. Defines "enterprise system" as a software application or computer system that collects, stores, exchanges, and analyzes information used by the public agency that is: a) a multi-departmental system or a system that contains information collected about the public; and b) a "system of record," i.e. serving as an original source of data within an agency.

2. Stipulates that an enterprise system does not include:

   1. Information technology security systems, including firewalls and other cybersecurity systems;

   2. Physical access control systems, employee identification management systems, video monitoring, and other physical control systems;

   3. Infrastructure and mechanical control systems, including those that control or manage street lights, electrical, natural gas, or water or sewer functions;

   4. Systems related to 911 dispatch and operation or emergency services;

   5. Systems that would be restricted from disclosure pursuant to existing law, as specified, which exempts from the California Public Records Act (PRA) the disclosure of information security records that would reveal vulnerabilities of an information technology system or increase the potential for cyber-attacks, as specified; and,

   6. The specific records that the information technology system collects, stores, exchanges, or analyzes.

3. Requires that the catalog, for each system, disclose:

1. Current system vendor;

2. Current system product;

3. A brief statement of the system’s purpose;

4. A general description of categories or types of data;

5. The department that serves as the system's primary custodian;

6. How frequently system data is collected; and,

7. How frequently system data is updated.

4. Specifies that if, on the facts of the particular case, the public interest served by not disclosing specified information on enterprises systems clearly outweighs the public interest served by disclosure of the record, the local agency may instead provide a system name, brief title, or identifier of the system.

EXISTING LAW:

1. Provides, under the PRA, that all public agency records are open to public inspection upon request, unless the records are otherwise exempt from public disclosure.

2. Requires a public agency to make non-exempt electronic public records available to the public in any electronic format in which it holds the information or, if requested, in an electronic format used by the agency to create copies for its own or other agency's use. However, a public agency is not required to release an electronic record in an electronic form if its release would jeopardize or compromise the security or integrity of the original record or of any proprietary software in which it is maintained.

3. Provides that nothing in the PRA shall be construed to require the disclosure of an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.

FISCAL EFFECT: According to the Assembly Appropriations Committee, Proposition 42 was passed by voters on June 3, 2014, and requires all local governments to comply with the PRA and the Ralph M. Brown Act (Brown Act) and with any subsequent changes to those Acts. Proposition 42 also eliminated reimbursements to local agencies for costs of complying with the PRA and the Brown Act. As the bill furthers the purpose of the PRA, local agencies' costs to create catalogues of their respective enterprise systems would be nonreimbursable.

COMMENTS: According to the author, this measure seeks to move government toward "a more effective digital future" by assisting access to government data through "online portals." However, the substantive provisions of this bill do not actually require (or even encourage) local agencies to make existing records more accessible (i.e. in an electronic format), much less create open data portals. Instead, the author states that this bill constitutes a first step toward that a larger "open data" goal. Specifically, this bill would require a local agency (other than a school district) to create to a catalogue of their "enterprise systems" and make the catalog available to the public, including on the agency's Web site. This bill defines "enterprise system" as a software application or computer system that collects, stores, exchanges, and analyzes information used by the public agency that is: a) a multi-departmental system or a system that contains information collected about the public; and b) a "system of record," i.e. serving as an original source of data within an agency. The bill also specifies what an "enterprise system" does not include, such as information security systems, physical access control systems, or systems related to 911 dispatch and operation services.

In addition to providing a catalog of "enterprise systems," this bill would also require the catalog to include additional information, including the system vendor and product and information about how often information is collected and updated. Although those either opposed to or expressing concerns about the bill contend that providing vendor and product information about their data collection systems could create security breaches, the author notes that the California PRA already permits a public agency to withhold any information that could reveal system vulnerabilities.

While the opposition's security concerns may be overstated and possibly already addressed by existing law, there is nonetheless a legitimate question as to whether this measure is appropriately placed in the PRA. Although the intent language in this bill proclaims that it serves the purposes of the PRA and California Constitution Article 1, Section 3, this claim is debatable. The purpose of the PRA is to ensure that people have the right to access "the writings of public officials and agencies." Although the PRA does not say so expressly, it is clear from the legislative history of the PRA, case law interpreting the PRA, and the overall statutory scheme that the purpose of the PRA is to give people access to existing documents that are created and maintained by a public agency in the normal course of its business. This proposal appears to expand the purpose of the PRA by requiring the creation of new documents.

The placement of this bill's language in the PRA is likely an attempt to avoid the creation of a reimbursable local mandate. The California Constitution provides that whenever the Legislature or any state agency mandates a new program or higher level of service on a local government, the state shall reimburse the local government for the costs of that program or increased level of service. (California Constitution Article XIII B, Section 6.) However, Proposition 42 amended the state constitution to eliminate the state’s responsibility to pay local governments for the costs that they incur in complying with the PRA. Historically those costs have included the relatively modest burden of locating and physically retrieving existing documents if and when a public record request is made. Copying costs may be offset by modest fees collected from the requester, so long as the fees do not exceed the actual costs of copying documents.

Since Proposition 42 was approved by the voters in 2014, there is more at stake for local governments when it comes to legislative proposals for amending the PRA. Most notably, in its official analysis of Proposition 42, the Legislative Analyst's Office (LAO) warned of the possibility that the state legislature might be tempted to place new mandates in the PRA in order to avoid reimbursing local governments. Specifically, the LAO summary concluded that Proposition 42 could "change the future behavior of state officials. This is because under Proposition 42, the state could make changes to the Public Records Act and it would not have to pay local governments for their costs. Thus, state officials might make more changes to this law than they would have otherwise. In this case, local governments could incur additional costs - potentially in the tens of millions of dollars annually in the future." [Emphasis added.]

Unlike past amendments to the PRA, this bill does not exempt a category of public records from disclosure, remove an existing exemption, or require the disclosure of an existing document. Indeed, the bill says nothing about what records should or should not be disclosed, which is the primary purpose of the PRA. Rather, this bill would require local agencies to conduct an inventory of their "enterprise systems" and put it in the form of a new catalog that must contain specified information without reimbursing the agencies for the cost of doing so.

Analysis Prepared by: Thomas Clark / JUD. / (916) 319-2334 FN: 0001980

SENATE THIRD READING

STR Bill Id:SB 272

Author:(Hertzberg)

As Amended Ver:August 17, 2015

Majority vote

SENATE VOTE: 37-0

SUMMARY: Requires cities, counties, special districts, and joint powers authorities, by July 2016, to create a catalogue of their enterprise systems and make the catalog available to the public, including on the agency's Web site. Specifically, this bill:

1. Defines "enterprise system" as a software application or computer system that collects, stores, exchanges, and analyzes information used by the public agency that is: a) a multi-departmental system or a system that contains information collected about the public; and b) a "system of record," i.e. serving as an original source of data within an agency.

2. Stipulates that an enterprise system does not include:

   1. Information technology security systems, including firewalls and other cybersecurity systems;

   2. Physical access control systems, employee identification management systems, video monitoring, and other physical control systems;

   3. Infrastructure and mechanical control systems, including those that control or manage street lights, or water or sewer functions;

   4. Systems related to 911 dispatch and operation or emergency services;

   5. Systems that would be restricted from disclosure pursuant to existing law, as specified, which exempts from the California Public Records Act (PRA) the disclosure of information security records that would reveal vulnerabilities of an information technology system or increase the potential for cyber-attacks, as specified; and,

   6. The specific records that the information technology system collects, stores, exchanges, or analyzes.

3. Requires that the catalog, for each system, disclose:

1. Current system vendor;

2. Current system product;

3. A brief statement of the system’s purpose;

4. A general description of categories or types of data;

5. The department that serves as the system's primary custodian;

6. How frequently system data is collected; and,

7. How frequently system data is updated.

EXISTING LAW:

1. Provides, under the PRA, that all public agency records are open to public inspection upon request, unless the records are otherwise exempt from public disclosure.

2. Requires a public agency to make non-exempt electronic public records available to the public in any electronic format in which it holds the information or, if requested, in an electronic format used by the agency to create copies for its own or other agency's use. However, a public agency is not required to release an electronic record in an electronic form if its release would jeopardize or compromise the security or integrity of the original record or of any proprietary software in which it is maintained.

3. Provides that nothing in the PRA shall be construed to require the disclosure of an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.

FISCAL EFFECT: According to the Assembly Appropriations Committee, Proposition 42 was passed by voters on June 3, 2014, and requires all local governments to comply with the PRA and the Ralph M. Brown Act (Brown Act) and with any subsequent changes to those Acts. Proposition 42 also eliminated reimbursements to local agencies for costs of complying with the PRA and the Brown Act. As the bill furthers the purpose of the PRA, local agencies' costs to create catalogues of their respective enterprise systems would be nonreimbursable.

COMMENTS: According to the author, this measure seeks to move government toward "a more effective digital future" by assisting access to government data through "online portals." However, the substantive provisions of this bill do not actually require (or even encourage) local agencies to make existing records more accessible (i.e. in an electronic format), much less create open data portals. Instead, the author states that this bill constitutes a first step toward that a larger "open data" goal. Specifically, this bill would require a local agency (other than a school district) to create to a catalogue of their "enterprise systems" and make the catalog available to the public, including on the agency's Web site. The bill defines "enterprise system" as a software application or computer system that collects, stores, exchanges, and analyzes information used by the public agency that is: a) a multi-departmental system or a system that contains information collected about the public; and b) a "system of record," i.e. serving as an original source of data within an agency. The bill also specifies what an "enterprise system" does not include, such as information security systems, physical access control systems, or systems related to 911 dispatch and operation services.

In addition to providing a catalog of "enterprise systems," this bill would also require the catalog to include additional information, including the system vendor and product and information about how often information is collected and updated. Although those either opposed to or expressing concerns about the bill contend that providing vendor and product information about their data collection systems could create security breaches, the author notes that the California PRA already permits a public agency to withhold any information that could reveal system vulnerabilities.

While the opposition's security concerns may be overstated and possibly already addressed by existing law, there is nonetheless a legitimate question as to whether this measure is appropriately placed in the PRA. Although the intent language in this bill proclaims that it serves the purposes of the PRA and California Constitution Article 1, Section 3, this claim is debatable. The purpose of the PRA is to ensure that people have the right to access "the writings of public officials and agencies." Although the PRA does not say so expressly, it is clear from the legislative history of the PRA, case law interpreting the PRA, and the overall statutory scheme that the purpose of the PRA is to give people access to existing documents that are created and maintained by a public agency in the normal course of its business. This proposal appears to expand the purpose of the PRA by requiring the creation of new documents.

The placement of this bill's language in the PRA is likely an attempt to avoid the creation of a reimbursable local mandate. The California Constitution provides that whenever the Legislature or any state agency mandates a new program or higher level of service on a local government, the state shall reimburse the local government for the costs of that program or increased level of service. (California Constitution Article XIII B, Section 6.) However, Proposition 42 amended the state constitution to eliminate the state’s responsibility to pay local governments for the costs that they incur in complying with the PRA. Historically those costs have included the relatively modest burden of locating and physically retrieving existing documents if and when a public record request is made. Copying costs may be offset by modest fees collected from the requester, so long as the fees do not exceed the actual costs of copying documents.

Since Proposition 42 was approved by the voters in 2014, there is more at stake for local governments when it comes to legislative proposals for amending the PRA. Most notably, in its official analysis of Proposition 42, the Legislative Analyst's Office (LAO) warned of the possibility that the state legislature might be tempted to place new mandates in the PRA in order to avoid reimbursing local governments. Specifically, the LAO summary concluded that Proposition 42 could "change the future behavior of state officials. This is because under Proposition 42, the state could make changes to the Public Records Act and it would not have to pay local governments for their costs. Thus, state officials might make more changes to this law than they would have otherwise. In this case, local governments could incur additional costs - potentially in the tens of millions of dollars annually in the future." [Emphasis added.]

Unlike past amendments to the PRA, this bill does not exempt a category of public records from disclosure, remove an existing exemption, or require the disclosure of an existing document. Indeed, the bill says nothing about what records should or should not be disclosed, which is the primary purpose of the PRA. Rather, this bill would require local agencies to conduct an inventory of their "enterprise systems" and put it in the form of a new catalog that must contain specified information without reimbursing the agencies for the cost of doing so.

Analysis Prepared by: Thomas Clark / JUD. / (916) 319-2334 FN: 0001409

Date of Hearing: August 19, 2015

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Jimmy Gomez, Chair

SBPCA Bill Id:SB 272

Author:(Hertzberg) – As Amended Ver:August 17, 2015

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill requires cities, counties, special districts, and joint powers authorities, by July 2016, to create a catalogue of their enterprise systems and make the catalog available to the public, including on the agency's website. Specifically, this bill:

1. Defines "enterprise system" as a software application or computer system that collects, stores, exchanges, and analyzes information used by the public agency that is: (a) a multi-departmental system or a system that contains information collected about the public; and (b) a "system of record," i.e. serving as an original source of data within an agency.

2. Stipulates that an enterprise system does not include:

1. Information technology security systems, including firewalls and other cybersecurity systems;

2. Physical access control systems, employee identification management systems, video monitoring, and other physical control systems;

3. Infrastructure and mechanical control systems, including those that control or manage street lights, or water or sewer functions;

4. Systems related to 911 dispatch and operation or emergency services;

5. Systems that would be restricted from disclosure pursuant to existing law, as specified, which exempts from the California Public Records Act (CPRA) the disclosure of information security records that would reveal vulnerabilities of an information technology system or increase the potential for cyber attacks, as specified; and,

6. The specific records that the information technology system collects, stores, exchanges, or analyzes.

3. Requires that the catalog, for each system, disclose:

1. Current system vendor;

2. Current system product;

3. A brief statement of the system’s purpose;

4. A general description of categories or types of data;

5. The department that serves as the system’s primary custodian;

6. How frequently system data is collected; and,

7. How frequently system data is updated.

FISCAL EFFECT:

Proposition 42 was passed by voters on June 3, 2014, and requires all local governments to comply with the CPRA and the Ralph M. Brown Act (Brown Act) and with any subsequent changes to those Acts. Proposition 42 also eliminated reimbursements to local agencies for costs of complying with the CPRA and the Brown Act.

As the bill furthers the purpose of the CPRA, local agencies' costs to create catalogues of their respective enterprise systems would be nonreimbursable.

COMMENTS:

1. Purpose. According to the author, "… SB 272 will identify what information is being kept by local agencies, how it is maintained, and who is responsible. Publishing a catalog of this information will reveal how accessible and usable the information is for public review and analysis, and immediately empower Californians to utilize this information.

"There are thousands of local public agencies that collect information on critical government programs and services. The data include everything from building permits and public parks to potholes and public transportation. Harnessing the power of this locally generated data could help spur economic growth, tackle major infrastructure issues and set millions of Californians on a path toward upward mobility. Properly gathered and clearly understood data would also help empower state and local agencies to collaborate more effectively and improve service delivery."

A broad association of business groups and trade associations support the bill, asserting that it will promote open and accessible government practices.

2. Opposition. Local governments are concerned with costs related to the unfunded mandate of this bill and have cyber security-related concerns about including system vendor and system product as elements of the catalog.

3. Related Legislation. AB 169 (Maienschein), pending in the Senate Appropriations, establishes open format requirements for posting a public record if a local agency maintains an "open data" Internet Resource, as specified, and voluntarily posts the public record.

AB 1215 (Ting), which creates the California Open Data Act and the position of Chief Data Officer, and requires state agencies to make public data, as defined, available on an web portal, was held on this committee's Suspense file.

SB 573 (Pan), pending in this committee, requires the Governor to appoint a Chief Data Officer.

Analysis Prepared by: Chuck Nicol / APPR. / (916) 319-2081

Date of Hearing: July 15, 2015

ASSEMBLY COMMITTEE ON LOCAL GOVERNMENT

Brian Maienschein, Chair

SBPCA Bill Id:SB 272

Author:(Hertzberg) – As Amended Ver:July 6, 2015

SENATE VOTE: 37-0

SUBJECT: The California Public Records Act: local agencies: inventory.

SUMMARY: Requires local agencies, by July 1, 2016, to create a catalog of their enterprise systems, make the catalog publicly available, and post the catalog on their Internet Web sites. Specifically, this bill:

1. Requires each local agency, except a local educational agency, in implementing the California Public Records Act (CPRA), to create a catalog of enterprise systems.

2. Requires the catalog to be made publicly available upon request in the office of the person or officer designated by the agency’s legislative body, and to be posted in a prominent location on the local agency’s Internet Web site (website), if the agency has a website.

3. Requires the catalog to disclose a list of the enterprise systems utilized by the agency and, for each system, to disclose all of the following:

1. Current system vendor;

2. Current system product;

3. A brief statement of the system’s purpose;

4. A general description of categories or types of data;

5. The department that serves as the system’s primary custodian;

6. How frequently system data is collected; and,

7. How frequently system data is updated.

4. Provides that this bill shall not be interpreted to limit a person’s right to inspect public records, pursuant to the CPRA.

5. Provides the following definitions:

1. "Enterprise system" means a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is both of the following:

1. A multidepartmental system or a system that contains information collected about the public; and,

2. A system of record.

2. "System of record" means a system that serves as an original source of data within an agency.

6. Provides that an enterprise system shall not include any of the following:

1. Information technology security systems, including firewalls and other cybersecurity systems;

2. Physical access control systems, employee identification management systems, video monitoring, and other physical control systems;

3. Infrastructure and mechanical control systems, including those that control or manage street lights, or water or sewer functions;

4. Systems that would be restricted from disclosure pursuant to existing law, as specified, which exempts from the CPRA the disclosure of information security records that would reveal vulnerabilities of an information technology system or increase the potential for cyber attacks, as specified; and,

5. The specific records that the information technology system collects, stores, exchanges, or analyzes.

7. Provides that nothing in this bill shall be construed to permit public access to records held by an agency to which access is otherwise restricted by statute or to alter the process for requesting public records, as set forth in the CPRA.

8. Requires the local agency to complete and post the catalog required by this bill by July 1, 2016, and thereafter to update the catalog annually.

9. Makes a number of findings and declarations regarding new information technology, its use in government, California's role in "moving our nation forward in the world of technology," and the need to adopt standards to "ensure that data collection and publication are standardized, including uniform definitions for machine-readable data."

10. Finds and declares that Section 2 of the bill furthers, within the meaning of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, the purposes of that constitutional section as it relates to the right of public access to the meetings of local public bodies or the writings of local public officials and local agencies and declares, pursuant to paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, that the Legislature makes the following findings:

Because increased information about what data is collected by local agencies could be leveraged by the public to more efficiently access and better use that information, the act furthers the purpose of Section 3 of Article I of the California Constitution.

11. Provides that no reimbursement is required by this bill because the only costs that may be incurred by a local agency or school district under this act would result from a legislative mandate that is within the scope of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution.

EXISTING LAW:

1. Requires public agencies, pursuant to the CPRA, to make their records available for public inspection and, upon request, to provide a copy of a public record, unless the record is exempt from disclosure.
   
   

2. Requires a public agency to make non-exempt electronic public records available in any electronic format in which it holds the information or, if requested, in an electronic format used by the agency to create copies for its own or another agency’s use.

3. Authorizes a public agency to charge to the requester the direct cost of producing the electronic public record.

4. Requires the requester of the electronic record to bear the cost of producing a copy of the record, including the cost to construct a record, and the cost of programming and computer services necessary to produce a copy of the record if the public agency produces the electronic record only at regularly scheduled intervals or the request requires data compilation, extraction, or programming to produce the record.

5. Provides that a public agency is not required to release an electronic record in the electronic form in which it is held by the agency, if its release would jeopardize or compromise the security or integrity of the original record or of any proprietary software in which it is maintained.

6. Provides that nothing in the CPRA shall be construed to require the disclosure of an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. Unknown, likely significant costs to local agencies to compile information on enterprise systems that contain data collected about the public, post the catalog on agency websites, and make it available to the public (Local funds). These costs are not anticipated to be reimbursable from the state General Fund. See staff comments.

2. Potential costs in the low tens of thousands to the Commission on State Mandates (COSM). To the extent an affected local agency files a test claim for reimbursement of mandated costs, Commission legal staff would prepare a full analysis of the legal and factual issues raised for purposes of a determination by the COSM.

COMMENTS:

1. Bill Summary. This bill requires each local agency, in implementing the CPRA, to create a catalog of its enterprise systems, make that catalog publicly available in the office of the person or officer designated by the agency's legislative body, and post that catalog in a prominent location in the local agency's website, if it has one. The bill defines "enterprise system" to mean a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is both of the following: a multidepartmental system or a system that contains information collected about the public; and, a system of record. "System of record" means a system that serves as an original source of data within an agency.

For each enterprise system, the local agency must disclose all of the following:

1. Current system vendor;

2. Current system product;

3. A brief statement of the system’s purpose;

4. A general description of categories or types of data;

5. The department that serves as the system’s primary custodian;

6. How frequently system data is collected; and,

7. How frequently system data is updated.

The bill exempts the following from its requirements:

1. Information technology security systems, including firewalls and other cybersecurity systems;

2. Physical access control systems, employee identification management systems, video monitoring, and other physical control systems;

3. Infrastructure and mechanical control systems, including those that control or manage street lights, or water or sewer functions;

4. Systems that would be restricted from disclosure pursuant to existing law, as specified, which exempts from the CPRA the disclosure of information security records that would reveal vulnerabilities of an information technology system or increase the potential for cyber attacks, as specified; and,

5. The specific records that the information technology system collects, stores, exchanges, or analyzes.

Each local agency must complete and post the catalog by July 1, 2016, and update the catalog annually thereafter. This bill is sponsored by the author.

2. Author's Statement. According to the author, "Local government agencies throughout California possess a potentially powerful tool for improving the lives of Californians: data. In too many cases, however, local agencies – and the constituents they serve – do not know what data they have collected or how to access it. SB 272 will identify what information is being kept by local agencies, how it is maintained, and who is responsible. Publishing a catalog of this information will reveal how accessible and usable the information is for public review and analysis, and immediately empower Californians to utilize this information.

"There are thousands of local public agencies that collect information on critical government programs and services. The data include building permits and public parks to potholes and public transportation. Harnessing the power of this locally generated data could help spur economic growth, tackle major infrastructure issues and set millions of Californians on a path toward upward mobility. Properly gathered and clearly understood data would also help empower state and local agencies to collaborate more effectively and improve service delivery."

3. Background. The CPRA, enacted in 1968, requires public disclosure of public agency documents. The CPRA gives every person the right to inspect and obtain copies of all state and local government documents not exempt from disclosure. Recognizing that public agencies were increasingly relying on electronic documents, the Legislature approved
   AB 2799 (Shelley), Chapter 982, Statutes of 2000. Among other things, AB 2799 required public agencies, upon request, to disclose electronic records in an electronic format in which the agency held information, or in a format that had been used by the agency to create copies for its own use or for use by other public agencies.

Since that time, the Open Data movement has been rapidly growing in popularity and recognition, both nationally and in California. Computer technology has advanced to provide open format software, which allows electronic documents created and maintained by public agencies to be searched, indexed, and redacted electronically.

In 2009, in order to increase government agency accountability, promote informed public participation, and create economic opportunity through expanding access to information online in open formats, the United States Director of the Office of Management and Budget issued an Open Government Directive to federal government agencies. This Directive provided guidelines to public agencies responding to public requests under the Freedom of Information Act and instructed federal government agencies to “publish information online in an open format that can be retrieved, downloaded, indexed, and searched by commonly used web search applications.”

In 2013, President Obama signed Executive Order No. 13642, which established the Open Data Policy and required all newly generated government data to be made available in open, machine-readable formats in order to “promote continued job growth, Government efficiency, and the social good that can be gained from opening Government data to the public.”

4. California Open Data Portals. The California Health and Human Services Agency (CHHS) launched an Open Data Portal (portal) initiative in order to increase public access to one of the state’s most valuable assets – non-confidential health and human services data. According to the CHHS portal, "Its goals are to spark innovation, promote research and economic opportunities, engage public participation in government, increase transparency, and inform decision-making. 'Open Data' describes data that are freely available, machine-readable, and formatted according to national technical standards to facilitate visibility and reuse of published data.

"The portal offers access to standardized data that can be easily retrieved, combined, downloaded, sorted, searched, analyzed, redistributed and re-used by individuals, business, researchers, journalists, developers, and government to process, trend, and innovate. (It) puts tools for transparency, accountability, and innovation directly into the hands of Californians and others through a centralized, user-friendly interface. (The portal) provides users with a single point of entry to access CHHS departments’ publishable data. This increased visibility provides derivative value as the public is able to analyze and utilize publicly available (publishable) government data to better understand what is happening in government on all levels – federal, state, and local."

The CHHS also developed an Open Data Handbook (handbook), which provides guidelines to identify, review, prioritize and prepare publishable CHHS data for access by the public via the CHHS portal. The handbook is intended to serve both as an internal and external resource to any party that may be interested in improving the general public’s online access to data, and to provide an understanding of the processes by which CHHS makes its publishable data tables available. The handbook "focuses on general guidelines and thoughtful processes but also provides linked tools/resources that operationalize those processes."

The State Controller also has an open data website, which contains financial and statistical information for cities and counties around the state, allowing visitors to track spending, revenues, assets, and liabilities. The Controller's website contains more than 13 million fields of data for counties and cities over an eleven-year period, from 2002-2013.

5. Open Data and Cities. The National League of Cities in 2014 issued a report entitled, "City Open Data Policies: Learning by Doing." According to the report, "The White House launched its Open Government Initiative in 2013, including its Data.gov website, thus beginning the process of making government data more readily available. In the wake of this federal initiative, in partnership with communities, private companies, advocates, and the technology sector, cities have begun to innovatively pursue open data.

"As the primary providers of government services, cities collect and hold massive amounts
of data about crimes, waste management, transportation, education, housing, consumption, and more. Until recently, much of the inherent potential in this data has been untapped.
By making city data freely accessible, governments have not only improved their transparency, but have begun to use open data as a means to improve services and gather more information about communities…(However), open data is still a new concept to governments and practice models for implementation and design are lacking."

Several local jurisdictions in California have launched their own Open Data websites or portals. For example, the City of Los Angeles has a searchable website with information on the economy, public safety, environment, city services, city budget, events and culture, parks and libraries, and transportation. About three months after the launch of Los Angeles’ open data site, the city appointed its first Chief of Data officer.

As another example, AmLegal Decoder was deployed in San Francisco after the Mayor’s Office of Civic Innovation, The OpenGov Foundation and American Legal Publishing Corp. teamed up to transform and publish the city’s laws and legal and technical codes at SanFranciscoCode.org. AmLegal Decoder is open-source software that automatically updates SanFranciscoCode.org and delivers every newly codified city law accessible online for city employees, everyday citizens and anyone else who might need them.

In addition, the City of Long Beach has its own open data site, OpenUpLongBeach.com. Long Beach and Fresno have hosted open data events as well. The Open Knowledge Foundation also lists Sacramento, San Jose, Oakland, West Hollywood, Pasadena, Culver City, Santa Clarita, Bell, Manhattan Beach, San Diego, Burbank, Compton, and other California cities in its U.S. Cities Open Data Census.

6. Proposition 42. Proposition 42 was passed by voters on June 3, 2014, and requires all local governments to comply with the CPRA and the Ralph M. Brown Act (Brown Act) and with any subsequent changes to those Acts. Proposition 42 also eliminated reimbursements to local agencies for costs of complying with the CPRA and the Brown Act.

This bill contains language that says that the Legislature finds and declares that Section 2 of the bill furthers the purpose of the California Constitution as it relates to the right of public access to the meetings of local public bodies or the writings of local public officials and local agencies. Pursuant to paragraph (7) of subdivision (b) of Section 3 of Article I of the Constitution, the bill also includes a finding that says that " Because increased information about what data is collected by local agencies could be leveraged by the public to more efficiently access and better use that information, the act furthers the purpose of Section 3 of Article I of the California Constitution."

Section 4 of the bill specifies that no reimbursement for local agencies to implement the bill's provisions is necessary because "the only costs that may be incurred by a local agency or school district…would result from a legislative mandate that is within the scope of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution."

7. Related Legislation. AB 169 (Maienschein) establishes open format requirements for posting a public record if a local agency maintains an "open data" Internet Resource, as specified, and voluntarily posts the public record. AB 169 is pending in the Senate Appropriations Committee.

AB 1215 (Ting) creates the California Open Data Act and the position of Chief Data Officer, who is required to establish the California Open Data Standard (standard), as specified; requires state agencies to make public data, as defined, available on an Internet Web portal pursuant to that standard; and, allows a local government to adopt that standard. AB 1215 was held in the Assembly Appropriations Committee.

SB 573 (Pan) requires the Governor to appoint a Chief Data Officer, who is required to create a statewide open data portal, as defined, to provide public access to public data held by state agencies. SB 573 is pending in the Assembly Appropriations Committee.

8. Previous Legislation. SB 1002 (Yee) of 2012 would have required the State Chief Information Officer to conduct a study to determine the feasibility of providing electronic records in an open format. SB 1002 was vetoed with the following message:

The role of the State Chief Information Officer is to make sure that state government uses information technology efficiently and effectively – including providing public records electronically when possible. Another legislative report on electronic public records isn't necessary.

AB 2799 (Shelley), Chapter 982, Statutes of 2000, required public agencies, upon request, to disclose electronic records in an electronic format in which the agency held information or in a format that had been used by the agency to create copies for its own use or for other public agencies.

9. Arguments in Support. The Sunlight Foundation, in support, writes, "(A)chieving better public knowledge of the data that governments hold is at the very core of achieving open government in the 21st century. The Sunlight Foundation routinely emphasizes that open data means more than just accessing data the government has already chosen to publish –
   it also means knowing what information the government is aware it holds, what data the government isn't releasing, and how the government is prioritizing publication of its data assets. Through SB 272, California will increase public awareness of what datasets are held by local governments and take a critical step toward unlocking the power of local data across the state."

10. Arguments in Opposition. A coalition, including the California Association of Joint Powers Authorities, the California Police Chiefs Association, the California Special Districts Association, the California State Association of Counties, the California State Sheriffs' Association, the County Recorders Association of California, the League of California Cities, the Municipal Information Systems Association of California,, the Rural County Representatives of California, and the Urban Counties Caucus, who have an oppose, unless amended, position, writes:

"Our associations raised concerns about the serious cyber security risks that SB 272 presents by requiring the vendor name and product to be listed. Local agencies utilize electronic systems to manage information related to health and public safety services, utilities, and public works. There has been increased awareness of cyber security issues in recent years due to an increased number of system breaches and hacking threats. As currently written,
SB 272 would comprise the security of our systems jeopardizing the sensitive information within. We continue to require that instead of listing the product name, allow for a title or other identifier to be used. Regarding the vendor name, we are asking for an amendment to make it clear that it would be up to the information technology experts to make a determination under the exemption currently provided in the bill for cyber security. This would allow for the system to be referenced in a way that is not overly specific as to jeopardize security.

"The recent amendments to this bill have removed the previous Information Technology Systems definition and replaced (it) with language in previous versions which defines enterprise system for purposes of the catalog. These new amendments remove problematic language for local governments and provide some of the exemptions that we have requested. However there are two exemptions that we have requested that are not yet reflected in the July 6th version: 911 and emergency communications systems, and natural gas and electricity systems.

"In summary, we are requesting the following amendments to the July 6th version of

SB 272:

• Specifically list vendor in (Government Code Section) 6254.19 to allow information technology experts to decide as to whether it is a security risk.

• Include 911 and emergency services as well as natural gas and electricity to the list of exemptions."
  
  

1. Double-Referral. This bill was heard by the Judiciary Committee on June 30, 2015, where it passed with a 10-vote.

REGISTERED SUPPORT / OPPOSITION:

Support

American Civil Liberties Union of California

American Federation of State, County and Municipal Employees, AFL-CIO

Associated Builders and Contractors of California

Building Owners and Managers Association of California

California Asian Pacific Chamber of Commerce

California Broadcasters Association

California Business Properties Association

California Business Roundtable

California Forward Action Fund

California League of Food Processors

California Manufacturers & Technology Association

California Professional Firefighters

California Retailers Association

Commercial Real Estate Development Association

Family Business Association

Firearms Policy Coalition

International Council of Shopping Centers

Los Angeles County Business Federation

National Federation of Independent Businesses

San Diego Regional Data Library

San Francisco Technology Democrats

Sunlight Foundation

Urban Strategies Council

Concerns

City of Roseville

Opposition

California Association of Joint Powers Authorities (unless amended)

California Municipal Utilities Association

California Police Chiefs Association (unless amended)

Opposition (continued)

California Special Districts Association (unless amended)

California State Association of Counties (unless amended)
California State Sheriffs' Association (unless amended)

Cites of Camarillo and Diamond Bar

County Recorders Association of California (unless amended)

Desert Water Agency

El Dorado Irrigation District

League of California Cities (unless amended)

Municipal Information Systems Association of California (unless amended)

Rowland Water District

Rural County Representatives of California (unless amended)

Urban Counties Caucus (unless amended)

Analysis Prepared by: Angela Mapp / L. GOV. / (916) 319-3958

Date of Hearing: June 30, 2015

ASSEMBLY COMMITTEE ON JUDICIARY

Mark Stone, Chair

SBPCA Bill Id:SB 272

Author:(Hertzberg) – As Amended Ver:June 25, 2015

SENATE VOTE: 37-0

SUBJECT: The California Public Records Act: local agencies: inventory

KEY ISSUES:

1. Should A local agencY, other than a school district, be required to create, post online, and Annually update a catalog of the systems that it uses to collect and manage data?

2. DO the benefits of this bill justify the potential costs to local agencies and the risk, however small, that posting vendor and product details could expose system vulnerabilities?

3. Given that the purpose of Public records ACT is to promote access to existing documents, as opposed to requiring the creation of new documents, should this bill be codified somewhere other than in the public records Act?

SYNOPSIS

The bill, according to the author, is intended to be a "first step" in a more ambitious effort to bring the data management practices of local governments into the digital age and provide government, business, and private citizens with open access to a growing body of government-collected information. Specifically, this bill would require a local agency, other than a school district, to create a "catalog" of all information technology systems that it uses to manage data. The bill does not require the disclosure of particular records or data sets; rather, it requires a local agency to essentially make an inventory and, based on this inventory, create and post online a catalog of its data management systems, hardware, and software applications. The catalog would include specified pieces of information, including the identity of the system vendor and system product. The author hopes that this catalog will provide the state with an inventory of the systems currently used by local agencies, so as to better plan and facilitate the development of more open, accessible, integrated, and modern data management systems. The bill is supported by a broad coalition of business and labor groups who believe that easily accessible and open data will spur economic growth and improve government services. The bill is opposed by the local agencies that would be required by the bill to create these catalogs. Opponents argue that the costs of creating these catalogs will exceed the benefits; that the bill is vague about what "systems" local agencies must include in the catalog; that revealing vendors, products, and custodians of data in the catalog could expose system vulnerabilities and increase security threats; and that the measure imposes a mandate on local government but avoids state reimbursement by inserting the requirement in the Public Records Act. As noted in the analysis, many areas of concern about the bill remain, but may be resolvable. However, because the author and stakeholders have been unable to reach agreement on these concerns, the Committee encourages the author to continue working with the opposition. The bill will be heard in the Assembly Local Government should it pass out of this Committee.

SUMMARY: Requires a local agency to create a catalog of information technology systems, as defined, and to make the catalog publicly accessible, as specified. Specifically, this bill:

1. Makes legislative findings and declarations relating to the changing manner in which government data is gathered and maintained; the greater use and volume of electronic data; and the need to make this data accessible in a manner consistent with the California Public Records Act.

2. Requires a local agency to create a catalog of its information technology systems, as defined, and to make that catalog publicly available upon request in the office of the clerk of the agency's legislative body. Requires the local agency to post the catalog in a prominent location on its Internet Web site, if the agency has a Website.

3. Requires the catalog to disclose a list of the information technology systems used by the agency and, for each system, disclose all of the following:

   1. Current system vendor.

   2. Current system product.

   3. A brief statement of the system's purpose.

   4. A general description of categories and types of system data.

   5. The department that serves as the primary custodian of system data.

   6. How frequently system data is collected and updated.

4. Defines "information technology systems" to mean hardware and software that collect, store, exchange, and analyze information that the agency uses. However, “information technology system” shall not include any of the following:

   1. Information technology security systems, including firewalls and other cybersecurity systems.

   2. Systems that would be restricted from disclosure under Government Code Section 6254.19, which generally exempts from disclosure any record that would expose the vulnerabilities of an information technology system of a public agency.

   3. The specific records that the information technology system collects, stores, exchanges, or analyzes.

5. Requires local agencies to complete the catalog required by this bill, and post it online, no later July 1, 2016; thereafter, the agency shall update the catalog annually.

EXISTING LAW:

1. Provides, under the Public Records Act, that all public agency records are open to public inspection upon request, unless the records are otherwise exempt from public disclosure. (Government Code Section 6250 et seq. All further statutory references are to this code, unless otherwise indicated.)

2. Requires a public agency to make non-exempt electronic public records available to the public in any electronic format in which it holds the information or, if requested, in an electronic format used by the agency to create copies for its own or other agency's use. However, a public agency is not required to release an electronic record in an electronic form if its release would jeopardize or compromise the security or integrity of the original record or of any proprietary software in which it is maintained. (Section 6253.9.)

3. Provides that nothing in the Public Records Act shall be construed to require the disclosure of an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency. (Section 6254.19.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: California's Public Records Act (PRA) requires that the documents and "writings" of a public agency be open and available for public inspection, unless they are exempt from disclosure. (Sections 6250-6270.) The PRA is premised on the principle that "access to information concerning the conduct of the people’s business is a fundamental and necessary right of every person in this state." A "public record" is defined to mean "any writing containing information relating to the conduct of the public’s business prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics." A "writing" is defined, in turn, to include any "handwriting, typewriting, printing, photostating, photographing, photocopying, transmitting by electronic mail or facsimile, and every other means of recording upon any tangible thing any form of communication or representation, including letters, words, pictures, sounds, or symbols, or combinations thereof, and any record thereby created, regardless of the manner in which the record has been stored." (Sections 6250-6252.)

Public Record Access in the Digital Age. Since the PRA was enacted in 1968, public agencies have increasingly created and maintained records in electronic formats that can be searched, indexed, copied, downloaded, and analyzed in countless and creative ways. Reflecting this new reality, AB 2799 (Chapter 982, Statutes of 2000) required local agencies to disclose non-exempt electronic records, where they existed, in an electronic format, so long as doing so would not compromise the integrity of the record. Importantly, AB 2799 clarified that “Nothing in this section shall be construed to require the public agency to reconstruct a record in an electronic format if the agency no longer has the record available in an electronic format.” (Section 6253.9(c).) Similar efforts to promote disclosure of electronic records have occurred at the federal level. For example, in 2012 President Obama signed a U.S. Office of Management and Budget memorandum directing federal agencies to publish information online and in formats that can be easily accessed, searched, and downloaded online using common browsers and search engines. The executive memorandum declares that "by December 31, 2019, all permanent electronic records in Federal agencies will be managed electronically to the fullest extent possible for eventual transfer [to the National Archives and Records Administration] in an electronic format." (See OMB, Memorandum M-12-18, August 24, 2012. (https://www.whitehouse.gov/sites/default/files/omb/memoranda/2012/m-12-18.pdf)

California has made similar efforts in recent years, albeit with limited success. For example, SB 1002 (Yee, 2012) originally set out to establish a statewide, integrated, open data portal. In its final version, however, the bill more modestly required the state's Chief Information Officer to conduct a study in order to evaluate how the state might go about providing the public with access to electronic records in an open, standardized, and readily accessible format. This measure was vetoed by Governor Brown, who noted in his veto message that he believed a legislatively-mandated study was not necessary to achieve this objective.

In the current legislative session, four bills have been introduced that seek to foster "open data" by one means or another. Two of these bills apply to state agencies: SB 573 (Pan) would have the Governor appoint a Chief Data Office to, among other things, create a statewide "open data portal," thereby creating a single point of entry to access data from several state agencies. This bill is currently in the Assembly Accountability and Administrative Review Committee. Similarly, AB 1215 (Ting) would have created the California Open Data Act to require state agencies to make public data available on an Internet Web portal. That bill, however, was held in the Assembly Appropriations Committee. One other bill, in addition to the one which is the subject of this analysis, applies to local agencies. AB 169 (Maienschein) requires any local agency (other than a school district) that posts an electronic public record on its Internet Web site to post the record in a format that allows the record to be retrieved, downloaded, indexed, and searched by a commonly used Internet search application. That bill is awaiting hearing in the Senate Judiciary Committee.

Purpose of this Bill. The bill presently before this Committee, SB 272, is the other bill this session that applies to local agencies. The bill's legislative findings and declarations indicate the measure seeks to move government toward "a more effective digital future" by assisting access to government data through "online portals." However, unlike the bills discussed above, the substantive provisions of SB 272 do not actually require (or even encourage) local agencies to make existing records more accessible (i.e. in an electronic format), much less create open data portals. Instead, the author states that SB 272 constitutes a first step toward that a larger "open data" goal. Specifically, SB 272 would require a local agency (other than a school district) to create a "catalog" of its "information technology systems" – that is, the various hardware and software programs that it uses for data management purposes. The bill also requires the catalog to be posted on the agency's Internet Website, if it has one. The catalog would identify the system used by the agency and include the following information: (1) the current system vendor; (2) the current system product; (3) a brief statement of the system's purpose; (4) a general description of the categories and types of data used in the system; (5) the department that serves as the custodian of the system data; (6) how frequently system data is collected; and (7) how frequently system data is updated.

Definition of "Information Technology System" A Work In Progress. A prior version of this bill required a local agency to create a catalog of the "enterprise systems" that it uses. However, many stakeholders representing local agencies reasonably expressed that the definition of "enterprise system" in the bill was vague and uncertain. The Committee's search of the Internet and other sources turned up no consistent definition of the term "enterprise systems," although several definitions collectively suggested an “integrated” information technology system that an "enterprise" (a private or public sector entity) uses to manage data across its several departments or divisions. The term "enterprise system" is not used elsewhere in statute. A more common and familiar term, "information technology system," is used in the PRA. As most recently amended, this bill uses the term "information technology system," rather than "enterprise system." It defines "information technology system" to mean the hardware and software that the agency uses to collect, store, exchange, and analyze the information that it collects. Perhaps more significantly, the bill excludes certain items from the definition of "information technology system," specifically information technology security systems, including firewalls and other cybersecurity systems; records that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency; and the specific records that the information technology system collects, stores, exchanges, or analyzes.

Although the definition of "information technology system" in this bill remains too opened-ended, according to the opponents of this bill, the overall purpose of the catalog is intended to create an inventory of the computer systems, including especially data management hardware and software, that a local agency use to handle the data it collects. Opponents fear the existing definition is still "overly broad and would require that agencies list systems that are for internal purposes" that would not be of use to persons seeking access to public records. As noted below, the author and stakeholders may wish to continue refining the definition of "information technology system" if the bill passes out of this Committee and is referred to the Assembly Local Government Committee.

Outstanding Issues and Concerns. This bill has been the subject of numerous discussions between the author's office, Committee staff, and associations representing local government entities throughout the state. Although the most recent amendments address many of the concerns of local agency representatives, significant issues remain unresolved. The most important concerns and sources of opposition relate to determining which "information technology systems" must be included in the catalog; whether vendor name and system product must be included in the catalog; which local government office should be in charge of creating and maintaining the catalog; and whether or not the bill is properly placed in the Public Records Act. More generally, opponents question whether the uncertain benefits of the legislation are worth the time and money that will be necessary for local agencies to comply with the bill's provisions. The remainder of this analysis takes up these issues in turn and recommends that the author commit to working with stakeholders to address these concerns if the bill moves out of this Committee and to the Assembly Local Government Committee.

Limiting Scope of "Information Technology Systems" to the Agency's "Core Services." Opponents argue that the catalog should be restricted to those "information technology systems" that serve the "core functions" or "core services" of the local agency. They argue that without such a limitation the catalog could become unwieldy, as the agency would be required to include every piece of hardware and every software application that has been downloaded onto every one of the agency’s computers. For example, an Excel spreadsheet for routine internal office operations could be construed as an "information technology system" under this bill.

The problem with this proposal, however, is that "core services" and "core functions" can be just as vague and uncertain as "information technology system" or "enterprise system." The Urban Counties Caucus has suggested to Committee staff that "core services" could be defined as those which are "essential to the public's health and safety." For a county, this could include roads, jail, law enforcement, public mental health and other social services. However, because different agencies provide different services, it would be difficult to develop a definition of what constitutes "core services" for all agencies. Nonetheless, opponents are probably correct that the existing definition is too broad and would need to be limited in some way. The Committee urges the author to continue working with stakeholders to develop a more circumscribed definition of "information technology systems" if the bill moves forward.

Inclusion of System Vendor and System Product. Another major issue concerns whether an agency should be required to include the system vendor and product in the catalog it creates and posts on its Website. Several of the letters of opposition contend that including this information will create a cybersecurity risk. Opponents claim that providing this information will make it easier for hackers and malware distributors, who are familiar with the vulnerabilities unique to certain brands of software or hardware, to breach or otherwise compromise agency systems and databases. The author correctly points out, however, that contracts with service providers are already subject to public records requests, and therefore hackers who wanted to get this information could do so under existing law. Opponents reasonably counter that the catalog will make it considerably easier for hackers by obviating the need for multiple and often time-consuming request for public records and giving hackers the information that they need in a single location. In addition, hackers may be reluctant to make public record requests that will leave a trail of their activity. Finally, opponents contend that contracts do not always contain the most up-to-date information, as updates and new products may be uploaded to the system without a change in the contract. However, even if the security risk is small, the Committee may wish to inquire how knowing vendor and product information will help the public better access public records. Members of the public generally want access to public records, not the name of the vendor that operates the system managing those records.

Who is Responsible for the Catalog? This bill requires that the catalog be available upon request "in the office of the clerk of the agency's legislative body." If the clerk is responsible for making the catalog available upon request, then presumably the clerk is also responsible for maintaining the catalog in its office and, presumably, keeping the catalog up to date. The California Association of Clerks and Elections Officials (CACEO) opposes this bill, unless it is amended, and one of the association’s requested amendments is for the bill to leave it up to the legislative body to determine which public entity or official shall have responsibility for maintaining and updating the catalog and responding to requests. In some cases, the legislative body may choose to assign responsibility to the clerks. In other cases, it may opt to assign responsibility to a Chief Information Office, or an IT specialist. At any rate, it seems reasonable for the legislative body to assign the responsibility for maintaining the catalog and making it available upon request to the party it chooses, who may or may not be the clerk of the legislative body.

Should this bill be placed in the Public Records Act? Although the intent language in this bill proclaims that it serves the purposes of the Public Records Act and Section 3 of Article 1 of the California Constitution, this claim may be open to debate. As an opponent of this bill concisely states, "SB 272 deals with a listing of data systems. CPRA deals with records."

The purpose of the PRA is to ensure that people have the right to access “the writings of public officials and agencies.” Although the PRA does not say so expressly, it is clear from the legislative history of the PRA, case law interpreting the PRA, and the overall statutory scheme that the purpose of the PRA is to give people access to existing documents that are created and maintained by a public agency in the normal course of its business. (As discussed in Rogers v. Superior Court (1993) 19 Cal.App.4th 469, agencies are not required to recreate documents that have been destroyed or discarded, and thus it would seem to follow that agencies cannot be required to create documents that do not already exist.)  To be sure, this case law has focused on the agency’s obligation to the demands of a requester, not to the demands of the Legislature.  But since PRA was enacted in 1968, it has hewed to this purpose by addressing required disclosures and exemptions the existing documents created and maintained by public agencies; the Legislature has not, under the PRA, required an agency to create new documents.

This proposal appears to expand the purpose of the PRA by requiring the creation of new documents. The Committee could not find any other provision of the PRA that requires an agency to create a document in this manner. More revealingly, provisions of the Government Code that do require the creation of documents are not included within the sections that constitute the Public Records Act (Sections 6250-6270, which constitute Chapter 3.5 of Title 1, Division 7 of the Government Code), even though those provisions may be tangentially related to public records and information practices. For example, Government Code Section 11015.5 requires every state agency that collects personal information electronically on the Internet, as specified, to prominently display specified information about the types of personal information it collects and the purpose for which the information is collected. The section that would be created by this bill appears to have more in common with this provision than it does with the provisions of the Public Records Act dealing with existing records.

The placement of this bill’s language in the PRA is likely an attempt to avoid the creation of a reimbursable local mandate. The California Constitution provides that whenever the Legislature or any state agency mandates a new program or higher level of service on a local government, the state shall reimburse the local government for the costs of that program or increased level of service. (Cal. Const. art. XIII B, Section 6 [Also See Section 17514, which codifies this principle].) However, Proposition 42 amended the state constitution to eliminate the state’s responsibility to pay local governments for the costs that they incur in complying with the Public Records Act. Historically those costs have included the relatively modest burden of locating and physically retrieving existing documents if and when a public record request is made. Copying costs may be offset by modest fees collected from the requester, so long as the fees do not exceed the actual costs of copying documents.

Since Proposition 42 was approved by the voters in 2014, there is more at stake for local governments when it comes to legislative proposals for amending the PRA. Most notably, in its official analysis of Proposition 42, the Legislative Analyst's Office warned of the possibility that the state legislature might be tempted to place new mandates in the Public Records Act in order to avoid reimbursing local governments. Specifically, the LAO summary wrote the following when estimating the potential costs to local governments:

Potential Effect on Local Costs: The measure could also change the future behavior of state officials. This is because under Proposition 42, the state could make changes to the Public Records Act and it would not have to pay local governments for their costs. Thus, state officials might make more changes to this law than they would have otherwise. In this case, local governments could incur additional costs—potentially in the tens of millions of dollars annually in the future. [Emphasis added.]

Unlike past amendments to the Public Records Act, this bill does not exempt a category of public records from disclosure, remove an existing exemption, or require the disclosure of an existing document. Indeed, the bill says nothing about what records should or should not be disclosed, which is the primary purpose of the Public Records Act. Rather, this bill would require local agencies to conduct an inventory of their information technology systems and put it in the form of a new catalog that must contain specified information without reimbursing the agencies for the cost of doing so.

Conclusion: If this bill moves forward, the Committee encourages the author, opponents, and concerned stakeholders to consider the following before the bill is heard in the Local Government Committee:

1. Whether to place further parameters around the definition of "information technology systems."

2. Whether it is necessary to include the system vendor and system product in the catalog.

3. Whether the legislative body should be free to identify an appropriate custodian of the catalog.

4. Whether the exemption for a "school district" should be changed to the broader, but more commonly used, "local educational agency."

ARGUMENTS IN SUPPORT: According to the author, "Local government agencies throughout California possess a potentially powerful tool for improving the lives of Californians: data. In too many cases, however, local agencies – and the constituents they serve – do not know what data they have collected or how to access it. SB 272 will identify what information is being kept by local agencies, how it is maintained, and who is responsible. Publishing a catalog of this information will reveal how accessible and usable the information is for public review and analysis, and immediately empower Californians to utilize this information." The author believes that harnessing the power of this data "could help spur economic growth, tackle major infrastructure issues and set millions of Californians on a path toward upward mobility. Properly gathered and clearly understood data would also help empower state and local agencies to collaborate more effectively and improve service delivery."

A broad coalition of business groups and trade associations, led by the California Manufacturers & Technology Association, supports SB 272 because they say it will promote "open and accessible local government practices." The coalition believes that SB 272 is "a critical first step in the process of providing uniformity in understanding where we are today with regard to data collection systems. SB 272 moves California forward in modernizing open government in California."

California Forward Action Fund (CFAF) believes that "this bill will modernize California's approach to the California Public Records Act and allow local governments to embrace open data in a smart, measured way." CFAF contends that Proposition 42 "paved the way for more innovation in local government record disclosure and created energy to have cities, counties, special districts to embrace open data principles. However, policy makers must be careful and deliberate about local government data as to not burden systems and staff with new state requirements. SB 272 finds that balance."

Several other groups, from organized labor to the high-technology business sector, support this bill because they believe that requiring local agencies to create catalogs of their data management systems will somehow lead to an integrated and open data system, spur economic growth, and "empower" local agencies to "work together more effectively and to intelligently allocate resources to better deliver public services."

ARGUMENTS IN OPPOSITION: Several associations representing cities, counties, special districts, and an array of other local agencies oppose this bill. All but one of the groups or associations that originally only submitted letters of "concern" have changed their position to "oppose unless amended."

The California Association of Clerks and Elections Officials (CACEO) oppose this bill unless amended to address a number of its concerns. First, the clerks oppose automatically designating the "clerk of the agency's legislative body" as the custodian of the agency's catalog. CACEO argues that, depending upon the locality, the clerks, who may or may not be knowledgeable about information systems, may not be the most appropriate agency official to be responsible for the catalog. CACEO therefore recommends that SB 272 be amended to authorize the legislative body to designate the official that it deems most appropriate. This "could be the IT director, chief information officer or other appropriate official" to "act as custodian of the completed catalog, and make the catalog available to the public."

CACEO is also "deeply concerned", especially in light of Proposition 42, "that SB 272 would create yet another unfunded mandate on local agencies" by placing its provisions in the PRA. CACEO "sees no nexus between the subject of SB 272 and the subject dealt with in the California Public Records Act. SB 272 merely deals with listing of data systems. The CPRA deals with records . . . Amending the CPRA in the manner that SB 272 proposes would create confusion and a measure of conflict with the CPRA as to what constitutes an identifiable record." Therefore, CACEO believes that "SB 272 should be added to the Government Code as a body of law separate from the CPRA."

The Urban Counties Caucus (UCC), the Rural County Representatives of California (RCRC), and the California State Sheriffs Association (CSAA), who originally wrote a joint letter of "concern," now oppose this bill unless amended to, among other things, narrow the definition of "information technology systems" to include only the systems used to perform "core services." They also ask the author to remove the "system vendor" and "system product" from the catalog requirements. In support of this proposed amendment, they write that "County IT experts have raised a concern with asking for the name of the vendor and the product version. Many of our modern county software applications are connected to the Internet to provide on-line services to residents and therefore could be vulnerable to malicious hacking. It is unclear what the public benefit would be in providing the name of the vendor and the product version. We have also heard from an FBI cyber security expert that providing this type of information should be a concern for municipalities." UCC, RCRC, and CSAA, like many other local government stakeholders, also oppose placing the provisions of this bill in the PRA. They write: "Since the passage of Proposition 42, local agencies cannot receive reimbursement for the costs to comply with the California Public Records Act. Therefore, the new requirements in SB 272 would be unfunded and could be costly for counties to comply. To provide a catalogue of all these systems could be time-consuming and it is unclear what benefit much of this information would provide to the general public."

Finally, SB 272 was opposed by many school districts and other local educational agencies, for many of the same reasons articulated by other opponents. However, given that the most recent amendments exempt school districts from the bill, they will apparently remove their opposition to the bill, although at the time of this writing only one entity – the California Association of School Administrators – has formally removed its opposition.

REGISTERED SUPPORT / OPPOSITION:

Support

AFSCME

Associated Builders and Contractors of California

Building Owners and Contractors of California

California Asian Pacific Chamber of Commerce

California Broadcasters Association

California Business Properties Association

California Business Roundtable

California Forward Action Fund

California League of Food Processors

California Manufacturers & Technology Association

California Professional Firefighters

California Retailers Association

Commercial Real Estate Development Association

Family Business Association

Firearms Policy Coalition

International Council of Shopping Centers

Los Angeles Business Federation

National Federation of Independent Businesses

San Diego Regional Data Library

San Francisco Technology Democrats

Sunlight Foundation

Urban Strategies Council

Concern

City of Roseville

Opposition

Association of California Water Agencies

California Association of Clerks and Election Officials

California Association of School Business Officials

California County Superintendents Educational Services Association

California Municipal Utilities Association

California Police Chiefs Association

California State Association of Counties

California State Sheriffs Association

City of Camarillo

City of Diamond Bar

Desert Water Agency

El Dorado Irrigation District

League of California Cities

Los Angeles Unified School District

Madera County Board of Supervisors

Municipal Information Systems Association of California

Newhall County Water District

Orange County Department of Education

Rowland Water District

Rural County Representatives of California

San Diego Unified School District

Urban County Caucuses

Analysis Prepared by: Thomas Clark / JUD. / (916) 319-2334

 THIRD READING  

Bill No: SB 272

Author: Hertzberg (D), et al.

Amended: 4/6/15

Vote: 21

SENATE GOVERNANCE & FIN. COMMITTEE: 7-0, 4/15/15

AYES: Hertzberg, Nguyen, Bates, Beall, Hernandez, Lara, Pavley

SENATE JUDICIARY COMMITTEE: 7-0, 4/21/15

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/4/15

AYES: Lara, Bates, Beall, Hill, Leyva, Mendoza, Nielsen

SUBJECT: The California Public Records Act: local agencies: inventory

SOURCE: Author

DIGEST: This bill requires local governments to catalog, and make publicly available, information about their data systems.

ANALYSIS:

Existing law, the California Public Records Act (CPRA), requires public records to be open to inspection during office hours and gives every person a right to inspect public records, with specific exceptions. The CPRA also specifies procedures for requesting copies of public records.

This bill:

1. Requires local agencies, in implementing the CPRA, to create a catalog of enterprise systems.

2. Defines “enterprise system” as a system that is both:

   1. A multi-departmental system or a system that contains information collected about the public.

2. A system of record.

3. Defines “system of record” as a system that serves as an original source of data within an agency.

4. Requires that the catalog prepared by each local agency must:

1. List the enterprise systems utilized by the agency.

2. Disclose, for each enterprise system, all of the following:

1. Current system vendor.

2. Current system product.

3. A brief statement of the system’s purpose.

4. A general description of categories, modules, or layers of data.

5. The department that serves as the system’s primary custodian.

6. How frequently system data is collected.

7. How frequently system data is updated.

8. Be made publicly available in a specified manner.

5. States that its provisions must not be interpreted to limit a person’s right to inspect public records pursuant to the provision of the CPRA.

6. Contains legislative findings and declarations regarding the potential benefits of expanded public access to electronic data gather and maintained by local agencies.

Comments

1) Purpose of the bill. Government agencies are rapidly expanding their use of computer technologies to conduct the public’s business, including budgeting, mapping, and issuing permits. Much of the electronic data that local governments throughout California possess can be a powerful tool for improving the lives of Californians. Harnessing the power of local data will help to make government more transparent and accountable to the public, foster collaboration among agencies to deliver public services more efficiently and effectively, and support policies that generate economic growth and improve California communities. However, members of the public too often are not aware of what data local governments collect, the format the data is in, or the location where the data is stored. Similarly, a lack of information about local agencies’ data systems may impede efforts among local agencies to collaborate on projects to standardize and share public data sets. By requiring local governments to share information about their enterprise data systems, SB 272 takes a significant step towards making California local government data more accessible to the public.

2) Who pays? The Legislative Counsel’s Office says that SB 272 imposes a state-mandated local program because it requires local government officials to perform additional duties related to creating and publicly releasing a catalog of enterprise systems. The California Constitution generally requires the state government to reimburse the costs of new or expanded state mandated local programs. However, on June 3, 2014, California voters approved Proposition 42, which amended the California Constitution to require local agencies to comply with the CPRA. Proposition 42 also requires local agencies to comply with any subsequent statutory enactment amending the Public Records Act that contains specified findings that the newly enacted statute furthers specified constitutional provisions guaranteeing public access to public agency meetings and records. SB 272 contains legislative findings that the bill furthers the purpose of Section 3 of Article I of the California Constitution “[b]ecause increased information about what data is collected by local agencies could be leveraged by the public to more efficiently access and better use that information.” As a result, SB 272 disclaims the state’s responsibility for reimbursing local governments’ costs of complying with the bill’s requirements.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

• Unknown, likely significant costs to local agencies to compile information on enterprise systems that contain data collected about the public, post the catalog on agency websites, and make it available to the public (Local funds). These costs are not anticipated to be reimbursable from the state General Fund.
  
  

• Potential costs in the low tens of thousands to the Commission on State Mandates (COSM). To the extent an affected local agency files a test claim for reimbursement of mandated costs, Commission legal staff would prepare a full analysis of the legal and factual issues raised for purposes of a determination by the COSM.

SUPPORT: (Verified 5/4/15)

American Federation of State, County, and Municipal Employees, AFL-CIO

Associated Builders and Contractors of California

California Asian Pacific Chamber of Commerce

California Broadcasters Association

California Business Properties Association

California Business Roundtable

California Manufacturers and Technology Association

California Professional Firefighters

Firearms Policy Coalition

National Federation of Independent Business

San Diego Regional Data Library

San Francisco Technology Democrats

Sunlight Foundation

Urban Strategies Council

OPPOSITION: (Verified 5/4/15)

None received

Prepared by: Brian Weinberger / GOV. & F. / (916) 651-4119

5/6/15 16:16:16

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

SB 272 (Hertzberg) - The California Public Records Act: local agencies: inventory

This bill does not meet the criteria for referral to the Suspense File.

Bill Summary:

SB 272 would require a local agency to create a catalog of “enterprise systems” utilized by the agency, make the catalog available to the public upon request in the agency’s offices, and to post the catalog on the agency’s website.

Fiscal Impact:

• Unknown, likely significant costs to local agencies to compile information on enterprise systems that contain data collected about the public, post the catalog on agency websites, and make it available to the public (Local funds). These costs are not anticipated to be reimbursable from the state General Fund. See staff comments.
  
  

• Potential costs in the low tens of thousands to the Commission on State Mandates (COSM). To the extent an affected local agency files a test claim for reimbursement of mandated costs, Commission legal staff would prepare a full analysis of the legal and factual issues raised for purposes of a determination by the COSM.

Background:

The California Public Records Act (CPRA) requires public records to be open to inspection during office hours and gives every person a right to inspect public records, with specific exceptions. The CRPA also specifies procedures for requesting copies of public records. State and local agencies are required to make records available in any electronic format that holds the information, if a person requests the records in an electronic format, unless release of the record in that form would jeopardize or compromise the security or integrity of the original record or of any proprietary software in which it is maintained.

Existing law, the California Constitution, declares that the people have the right of access to information concerning the conduct of the people’s business, and requires that the meetings of public bodies and the writings of public officials be open to public scrutiny. The voters approved Proposition 42 in June of 2014, which amended the Constitution to require local agencies to comply with the CPRA and the Ralph M. Brown Act, and with any subsequent statutory enactment amending either act, enacting a successor act, or amending any successor act that contains findings demonstrating that the statutory enactment furthers the purposes of these constitutional provisions. Proposition 42 also amended the Constitutional requirements to disclaim state reimbursement for local mandates contained within the scope of the CPRA and Ralph M. Brown Act.

Proposed Law:

SB 272 would require local agencies, in implementing the CPRA, to create a catalog of enterprise systems, which are defined as systems that are both a system of record that serves as an original source of data within an agency, and a multi-departmental system that contains information collected about the public.

The bill requires that the catalog prepared by each local agency must do the following:

• List the enterprise systems utilized by the agency.

• Disclose, for each enterprise system, all of the following:

  • Current system vendor.

  • Current system product.

  • A brief statement of the system’s purpose.

  • A general description of categories, modules, or layers of data.

  • The department that serves as the system’s primary custodian.

  • How frequently system data is collected.

  • How frequently system data is updated.

• Be made publicly available in a specified manner.

Related Legislation:

SB 573 (Pan), which was approved by the Senate Governmental Operations Committee with amendments on April 28, 2015, would require the Governor to appoint a Chief Data Officer and, among other things, would create the statewide “open data portal” to provide public access to data sets from state agencies, as specified.

Staff Comments:

Although state law already guarantees the public’s right to access electronic records that are not otherwise exempt from disclosure, it can be difficult for members of the public to know exactly what types of data local governments collect, what formats the data are in, and where the data are stored. This bill is intended to provide the public with information regarding the systems used by local agencies to collect and manage data and public records collected about the public.

This bill is likely to impose significant costs in the aggregate on over 4,000 local agencies (cities, counties, and special districts) to compile and periodically update information on enterprise systems that contain data collected about the public, post the catalog on agency websites, and make it available to the public. SB 272 contains legislative findings that the bill furthers the purpose of Section 3 of Article I of the California Constitution “[b]ecause increased information about what data is collected by local agencies could be leveraged by the public to more efficiently access and better use that information.” As a result, SB 272 disclaims the state’s responsibility for reimbursing local governments’ costs of complying with the bill’s requirements.

Staff notes that a local agency may submit a test claim on any statute that it alleges imposes a state-mandate, regardless of legislative findings.   If one were submitted, Commission staff would prepare a full analysis of the legal and factual issues raised for determination by the Commission.  The courts have found that a finding of the Legislature is not determinative of the mandate issue, which must be determined by the Commission reviewing the statute de novo. Costs for COSM staff to prepare a legal analysis would depend upon the issues raised by a particular claim. 

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015 - 2016 Regular Session

Bill No: SB 272 (Author:Hertzberg)

Amended: Version: April 6, 2015

Hearing Date: April 21, 2015

Fiscal: Yes

Urgency: No

Consultant: TMW

SUBJECT

The California Public Records Act: local agencies: inventory

DESCRIPTION

The California Public Records Act requires state and local agencies to make public records available for inspection by the public, with specified exceptions. This bill would require each local agency to create a catalog of enterprise systems, as defined, post that catalog on the local agency’s Internet Web site, and make the catalog publicly available upon request in the office of the clerk of the agency’s legislative body.

BACKGROUND

The California Public Records Act (CPRA), enacted in 1968, requires public disclosure of public agency documents. The CPRA gives every person the right to inspect and obtain copies of all state and local government documents not exempt from disclosure. (Gov. Code Sec. 6253.) In recognition of the increased reliance by public agencies on electronic documents, the Legislature enacted AB 2799 (Shelley, Ch. 982, Stats. 2000), which, among other things, required public agencies, upon request, to disclose electronic records in an electronic format in which the agency held information or in a format that had been used by the agency to create copies for its own use or for other public agencies.

Since 2000, computer technology has advanced to provide open format software whereby electronic documents created and maintained by public agencies can be searched, indexed, and redacted electronically. In 2009, in order to increase government agency accountability, promote informed public participation, and create economic opportunity through expanding access to information online in open formats, the United States Director of the Office of Management and Budget issued an Open Government Directive to federal government agencies. (Peter R. Orszag, Director, Executive Office of the President, Office of Management and Budget, Memorandum for the Heads of Executive Departments and Agencies, Open Government Directive, Dec. 8, 2009, p. 2.) This Directive provided guidelines to public agencies responding to public requests under the Freedom of Information Act and instructed federal government agencies to “publish information online in an open format that can be retrieved, downloaded, indexed, and searched by commonly used web search applications.” (Id.)

In 2013, President Obama signed Executive Order No. 13642, which established the Open Data Policy and required all newly generated government data to be made available in open, machine-readable formats in order to “promote continued job growth, Government efficiency, and the social good that can be gained from opening Government data to the public.” (Exec. Order No. 13642, 78 Fed.Reg. 28111 (May 9, 2013).)

This bill seeks to further the purpose of those orders by requiring each local agency to create a catalog of enterprise systems, post that catalog on the local agency’s Internet Web site, and make the catalog publicly available upon request in the office of the clerk of the agency’s legislative body. This bill would define “enterprise system” to mean a multidepartmental system or system that contains information collected about the public and a system of record, which serves as an original source of data within the agency.

This bill was heard by the Senate Governance and Finance Committee on April 15, 2015, and passed out on a vote of 7-0.

CHANGES TO EXISTING LAW

Existing law, the California Constitution, declares the people’s right to transparency in government. (“The people have the right of access to information concerning the conduct of the people’s business, and therefore, the meetings of public bodies and the writings of public officials and agencies shall be open to public scrutiny....”) (Cal. Const., art. I, Sec. 3.)

Existing law, the California Public Records Act (CPRA), governs the disclosure of information collected and maintained by public agencies. (Gov. Code Sec. 6250 et seq.) Generally, all public records are accessible to the public upon request, unless the record requested is exempt from public disclosure. (Gov. Code Sec. 6254.) There are 30 general categories of documents or information that are exempt from disclosure, essentially due to the character of the information, and unless it is shown that the public’s interest in disclosure outweighs the public’s interest in non-disclosure of the information, the exempt information may be withheld by the public agency with custody of the information.

Existing law provides that public records are open to inspection at all times during the office hours of the state or local agency and every person has a right to inspect any public record, except as specified. Any reasonably segregable portion of a record shall be available for inspection by any person requesting the record after deletion of the portions that are exempted by law. (Gov. Code Sec. 6253(a).)

Existing law requires a public agency to make non-exempt electronic public records available in any electronic format in which it holds the information or, if requested, in an electronic format used by the agency to create copies for its own or other agency’s use. (Gov. Code Sec. 6253.9(a)(1).)

Existing law provides that a public agency is not required to release an electronic record in the electronic form in which it is held by the agency if its release would jeopardize or compromise the security or integrity of the original record or of any proprietary software in which it is maintained. (Gov. Code Sec. 6253.9(f).)

This bill would require each local agency to create a catalog of enterprise systems and make the catalog publicly available upon request in the office of the clerk of the agency’s legislative body.

This bill would require that catalog to be posted in a prominent location on the local agency’s Internet Web site, if the agency has an Internet Web site.

This bill would require the catalog to disclose a list of the enterprise systems utilized by the agency and, for each system, including all of the following information:

• current system vendor;

• current system product;

• a brief statement of the system’s purpose;

• a general description of categories, modules, or layers of data;

• the department that serves as the system’s primary custodian;

• how frequently system data is collected; and

• how frequently system data is updated.

This bill would prohibit an interpretation of this bill that would limit a person’s right to inspect public records.

This bill would provide the following definitions:

• “enterprise system” means a system that is both of the following:

  • a multidepartmental system or a system that contains information collected about the public; and

  • a system of record; and

• “system of record” means a system that serves as an original source of data within an agency.

This bill would make various related legislative findings and declarations.

COMMENT

1. Stated need for the bill

The author writes:

[There is a l]ack of access regarding data and information collected by local government. SB 272 requires local agencies to create a catalog of enterprise systems used to manage data and information.

2. Requiring public disclosure of local agency enterprise system catalog

Existing law, the California Public Records Act (CPRA), requires a public agency to make non-exempt electronic public records available in any electronic format in which it holds the information or, if requested, in an electronic format used by the agency to create copies for its own or other agency’s use. (Gov. Code Sec. 6253.9(a)(1).) This bill would require a local agency to catalog its enterprise system, which is the overall combination of computer hardware and software that a business uses to organize and run its operations, and make that catalog publicly available in the office of the local agency’s clerk and on the agency’s Internet Web site, if the agency has an Internet Web site.

The author states that for many Californians, the only contact with government is through local public agencies, which provide various services to their communities. The author argues that, because of the volume and diversity of information local agencies collect across the state, open data efforts at the local level are important to improving the relationship people have with government.

The California Manufacturers & Technology Association (CMTA), in support, states that making comparisons across jurisdictions or over time, avoiding double counting, and sorting through information can be difficult, or even impossible under the current public disclosure framework. CMTA argues that lawmakers, the public, and academics need good, reliable data from public agencies, but not all public information is collected, stored, or accessible in open and consistent formats.

The American Federation of State, County and Municipal Employees, AFL-CIO, in support, states that the inventories required by this bill would include who maintains the information and how often the data is collected and would allow both the local government and the public to better understand how local government serves all Californians. The San Francisco Technology Democrats argue that “harnessing the power of locally generated data would help spur economic growth, help tackle major infrastructure issues, empower local agencies through properly gathered and clearly understood data, and better equip oversight entities to make informed decisions, and inspire confidence in those they serve.” The Firearms Policy Coalition, in support, notes that the public’s access to public records is not only necessary to a strong democracy, but is an enshrined public right, and encourages similar reforms that would apply to state agencies and the Legislative Open Records Act.

Notably, the federal government has already instructed federal agencies to provide public access to electronic agency information in an open format. In an effort to increase government agency accountability and promote informed public participation, the United States Director of the Office of Management and Budget issued an Open Government Directive (Directive) to federal public agencies responding to public requests under the Freedom of Information Act. (See Peter R. Orszag, Director, Executive Office of the President, Office of Management and Budget, Memorandum for the Heads of Executive Departments and Agencies, Open Government Directive, Dec. 8, 2009.)

The Directive instructed federal government agencies to “publish information online in an open format that can be retrieved, downloaded, indexed, and searched by commonly used web search applications.” (Id. at p. 2.) The Directive defines “open format” to mean “one that is platform independent, machine readable, and made available to the public without restrictions that would impede the re-use of that information.”

To that end, this bill would require an enterprise system catalog to be posted in a prominent location on the local agency’s Internet Web site, if the agency has an Internet Web site. That catalog would include a list of the enterprise systems utilized by the local agency as follows:

• current system vendor;

• current system product;

• a brief statement of the system’s purpose;

• a general description of categories, modules, or layers of data;

• the department that serves as the system’s primary custodian;

• how frequently system data is collected; and

• how frequently system data is updated.

The Sunlight Foundation, in support, argues that “[p]ublic provision of this information is critical for improving the use of valuable public data [because] . . . better public knowledge of the data that governments hold is at the very core of achieving open government in the 21st century. The Sunlight Foundation routinely emphasizes that open data means more than just accessing data the government has already chosen to publish — it also means knowing what information the government is aware it holds, what data the government isn’t releasing, and how the government is prioritizing publication of its data assets.

3. Concerns raised

The Urban Counties Caucus and Rural County Representatives of California have expressed concern that: (1) there are no definitions of the terminology used in the bill specific to various computer systems including modules and layers of data; (2) there are no specific timelines for compliance and no mention of what this information will be used for in the future; (3) because of the recent passage of Proposition 42, local agencies will not be reimbursed for the mandates in this bill, which will bill costly to counties, especially those with multiple systems in the many programs and services they provide; (4) this bill will be time consuming and it is unclear what benefit this information would provide to the general public; and (5) there are security concerns with providing the name of the vendor and the product version because many of the county software applications are connected to the Internet to provide on-line services to residents and could, therefore, be vulnerable to malicious hacking.

Support: American Federation of State, County and Municipal Employees, AFL-CIO; Associated Builders and Contractors of California; California Business Roundtable; California Broadcasters Association; California Manufacturers & Technology Association; California Professional Firefighters; Firearms Policy Coalition; National Federation of Independent Business; San Diego Regional Data Library; San Francisco Technology Democrats; Sunlight Foundation; Urban Strategies Council

Opposition: None Known

HISTORY

Source: Author

Related Pending Legislation:

SB 573 (Pan, 2015), among other things, would create the statewide open data portal, as defined, to provide public access to data sets from agencies within the state. The bill would require any data published on the statewide open data portal or other open data portal operated by an agency to comply with all state and federal privacy laws and regulations, and make the statewide open data portal available, at no cost, to local agencies interested in using the statewide open data portal to publish its own data. SB 573 is set for hearing on April 28, 2015, in the Senate Governmental Organization Committee.

AB 1215 (Ting, 2015), among other things, would enact the California Open Data Act and require state agencies to make public data, as defined, available on an Internet Web portal and authorize a local government to adopt that standard. AB 1215 would require each state agency, on or before July 1, 2016, to submit a strategic plan and a strategic enterprise application plan, as specified, to the Chief Data Officer and to post the reports on the Internet Web portal. AB 1215 would also require specified legal policies for public data to be posted on the Internet Web portal. AB 1215 is currently in the Assembly Privacy and Consumer Protection Committee.

AB 169 (Maienschein, 2015) would require a local agency, except a school district, that chooses to post a public record on its Internet Web site to post the public record in a format that meets specified requirements, including, among others, that the format is able to be retrieved, downloaded, indexed, and searched by a commonly used Internet search application. AB 169 is currently in the Assembly Appropriations Committee.

Prior Legislation: SB 1002 (Yee, 2012) would have enacted the California Open Data Standard and required a state or local agency to make electronic data or an electronic document available to the public in an open format, as defined. That provision was subsequently removed to instead require the State Chief Information Officer to conduct a study to determine the feasibility of providing electronic records in an open format. SB 1002 was vetoed by Governor Brown because he believed that another legislative report on electronic public records was unnecessary.

Prior Vote: Senate Governance and Finance Committee (Ayes 7, Noes 0)

**************

SENATE COMMITTEE ON GOVERNANCE AND FINANCE

Senator Robert M. Hertzberg, Chair

2015 - 2016 Regular

LOCAL GOVERNMENT DATA SYSTEMS

Requires local governments to catalog, and make publicly available, information about their data systems.

Background and Existing Law

The California Public Records Act (CPRA) requires public records to be open to inspection during office hours and gives every person a right to inspect public records, with specific exceptions. The Public Records Act also specifies procedures for requesting copies of public records. When a person seeks a record in an electronic format, an agency must, upon request, make the information available in any electronic format in which it holds the information (AB 2799, Shelley, 2000).

Although state law already guarantees the public’s right to access electronic records that are not otherwise exempt from disclosure, it can be difficult for members of the public to know exactly what types of data local governments collect, what formats the data are in, and where the data are stored. Advocates for government transparency and open data want legislators to make it easier for the public to identify what electronic records they can request from local governments pursuant to the California Public Records Act.

Proposed Law

Senate Bill 272 requires local agencies, in implementing the California Public Records Act, to create a catalog of enterprise systems.

SB 272 defines “enterprise system” as a system that is both:

• A multi-departmental system or a system that contains information collected about the public.

• A system of record.

The bill defines “system of record” as a system that serves as an original source of data within an agency.

SB 272 requires that the catalog prepared by each local agency must:

• List the enterprise systems utilized by the agency.

• Disclose, for each enterprise system, all of the following:

  • Current system vendor.

  • Current system product.

  • A brief statement of the system’s purpose.

  • A general description of categories, modules, or layers of data.

  • The department that serves as the system’s primary custodian.

  • How frequently system data is collected.

  • How frequently system data is updated.

• Be made publicly available in a specified manner.

SB 272 states that its provisions must not be interpreted to limit a person’s right to inspect public records pursuant to the provision of the California Public Records Act.

The bill contains legislative findings and declarations regarding the potential benefits of expanded public access to electronic data gather and maintained by local agencies.

State Revenue Impact

No estimate.

Comments

1. Purpose of the bill. Government agencies are rapidly expanding their use of computer technologies to conduct the public’s business, including budgeting, mapping, and issuing permits. Much of the electronic data that local governments throughout California possess can be a powerful tool for improving the lives of Californians. Harnessing the power of local data will help to make government more transparent and accountable to the public, foster collaboration among agencies to deliver public services more efficiently and effectively, and support policies that generate economic growth and improve California communities. However, members of the public too often are not aware of what data local governments collect, the format the data is in, or the location where the data is stored. Similarly, a lack of information about local agencies’ data systems may impede efforts among local agencies to collaborate on projects to standardize and share public data sets. By requiring local governments to share information about their enterprise data systems, SB 272 takes a significant step towards making California local government data more accessible to the public.

2. Definitions needed. Some of the terms used in SB 272 are ambiguous and not defined elsewhere in state law. For example, the requirement that a catalog of enterprise systems must describe categories, modules, or layer of data may need to be explained in more detail. Similarly, the bill’s definition of an enterprise system as including a system that contains information collected about the public may be open to different interpretations. To ensure that SB 272’s provisions are implemented uniformly in the manner intended, the Committee may wish to consider amending SB 272 to provide more specific definitions of what is meant by the phrases “categories, modules, or layers of data” and “information collected by the public.”

3. Deadlines matter. SB 272 requires local governments to catalog information about their enterprise systems, but doesn’t specify when the catalog must be completed and made available to the public. The Committee may wish to consider amending SB 272 to specify a date by which local governments must comply with the bill’s provisions.

4. Who pays? The Legislative Counsel’s Office says that SB 272 would impose a state-mandated local program because it requires local government officials to perform additional duties related to creating and publicly releasing a catalog of enterprise systems. The California Constitution generally requires the state government to reimburse the costs of new or expanded state mandated local programs. However, on June 3, 2014, California voters approved Proposition 42, which amended the California Constitution to require local agencies to comply with the California Public Records Act. Proposition 42 also requires local agencies to comply with any subsequent statutory enactment amending the Public Records Act that contains specified findings that the newly enacted statute furthers specified constitutional provisions guaranteeing public access to public agency meetings and records. SB 272 contains legislative findings that the bill furthers the purpose of Section 3 of Article I of the California Constitution “[b]ecause increased information about what data is collected by local agencies could be leveraged by the public to more efficiently access and better use that information.” As a result, SB 272 disclaims the state’s responsibility for reimbursing local governments’ costs of complying with the bill’s requirements.

5. Double-referred. The Senate Rules Committee has ordered a double-referral of SB 272 --- first to the Senate Governance & Finance Committee which has policy jurisdiction over state laws relating to local governments, and then to the Senate Judiciary Committee, which plans to hear the bill at its April 21 hearing.

Support and Opposition

(4/9/15)

Support: American Federation of State, County, and Municipal Employees, AFL-CIO; California Business Roundtable; California Professional Firefighters; San Francisco Technology Democrats; Sunlight Foundation.

Opposition: Unknown.

-- END --