BILL ANALYSIS

C.S.H.B. 4207

By: Giddings

State Affairs

Committee Report (Substituted)

BACKGROUND AND PURPOSE

The Texas Public Information Act (TPIA) allows for protection of current and former governmental employees’ social security numbers, home addresses, home telephone numbers, and similar information about family members.  However, dates of birth of active and former employees of governmental bodies are currently available to the public under the Texas Attorney General’s interpretation of TPIA.   This information includes the dates of birth of employees of state agencies, local governments, school districts, and universities.  Under TPIA, any governmental employee’s name, title, sex, ethnicity, dates of employment, employing agency, salary, and other similar information is publicly available.  Requiring the release of governmental employees’ dates of birth puts current and former employees at a greater risk for identity theft.  One of the ways dates of birth can be used by identity thieves is in the creation of a fake driver’s license using the victim’s name and birth date.  A counterfeit driver’s license allows the thief to open checking accounts, write hot checks, and engage in other types of theft.

One of the past arguments for releasing dates of birth has been to ensure that employees with the same names can be distinguished from each other.  However employees can be distinguished using non-social-security-based unique numeric identifiers.  Age and other less sensitive identifying information can also be used to distinguish employees.

Identity theft not only affects individuals, but it also increases the cost of doing business in Texas.  The process of identity theft starts with the misappropriation of personal information, which can be obtained from individuals, businesses, or even government.  Governmental bodies, including universities, are not immune to data security breaches.  There needs to be a review of the types of sensitive personal information held by Texas governmental entities, and stakeholders need to be involved in the review.  Such a review and analysis would provide the legislature an in-depth view of the types of information held by governmental entities and would provide insight into any associated issues. 

C.S.H.B. 4207 includes an exact date of birth as one of the categories of sensitive personal information that can be protected from public release.  The bill requires the comptroller to perform an analysis of the amount and types of personally identifiable information held by Texas governmental entities.  The bill requires a report to the legislature on the analysis, containing recommendations on legislation, by December 1, 2010, and authorizes the comptroller to establish a task force to assist in the review and analysis. 

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

C.S.H.B. 4207 amends open records provisions of the Government Code to except from public availability the date of birth, excluding the month and year, of a current or former official or employee of a governmental body that is collected or maintained in a governmental body's personnel, payroll, or employment records.  The bill authorizes a governmental body, when disclosing information and without having to request an open records decision from the attorney general, to redact the date of birth, excluding the month and year, of a current or former official or employee of a governmental body from any information collected or maintained in a governmental body's personnel, payroll, or employment records.

C.S.H.B. 4207 establishes temporary provisions, set to expire September 1, 2011, relating to personally identifiable information collected by state governmental bodies and an analysis of the subject by the comptroller of public accounts, assisted by a task force.  The bill defines "personally identifiable information" to include any information collected by a state governmental body that may be used to distinguish or track the individual's identity or that may be linked to the individual, such as the individual's name, social security number, date of birth, location of birth, mother's maiden name, biometric records, medical information, educational information, financial information, and employment information.  The bill defines "state governmental body."

C.S.H.B. 4207 requires the comptroller to perform an analysis of the amount and types of personally identifiable information collected by each state governmental body.  The bill specifies that a state governmental body, by providing public information that is confidential or otherwise excepted from required disclosure under law to the comptroller to perform the required analysis, does not waive or affect the confidentiality of the information for purposes of state or federal law or waive the right to assert exceptions to required disclosure of the information in the future. The bill authorizes the comptroller to establish a task force to assist and advise the comptroller in performing the required analysis and to adopt a plan of operations for the task force including qualifications of its members.  The bill prohibits the comptroller and task force, except as otherwise provided, from disclosing to a requestor or the public any information submitted to the comptroller in relation to the study of personally identifiable information collected by state governmental bodies.

C.S.H.B. 4207 authorizes the comptroller to appoint as many members to the task force as the comptroller determines necessary, and in making such appointments to consider any appropriate factor including a person's expertise.  The bill requires the task force to include a member each from the judiciary, the Department of Information Resources, the Department of Public Safety, and the Health and Human Services Commission, and a member each employed by an institution of higher education, a financial institution, and an information services company. The bill establishes certain restrictions on task force membership, including a prohibition of member compensation from the state.

C.S.H.B. 4207 requires the comptroller, not later than December 1, 2010, to file a report with the presiding officer of each house of the legislature that identifies the personally identifiable information collected by each state governmental body.  The bill requires the report to contain the comptroller's recommendations for legislation regarding personally identifiable information collected by a state governmental body, including recommendations on whether each state governmental body should continue to collect or maintain personally identifiable information, whether to amend the open records law to further limit the types of personally identifiable information that may be withheld from disclosure, and the effect of the recommendations.

EFFECTIVE DATE

September 1, 2009.

COMPARISON OF ORIGINAL AND SUBSTITUTE

C.S.H.B. 4207 differs from the original by applying the exception to certain open records provisions to the date of birth, excluding the month and year, rather than to the date of birth, without the exclusion, as in the original. The bill adds clarifying provisions, not in the original, applying the exception specifically to such information as collected or maintained in a governmental body's personnel, payroll, or employment records. The substitute differs from the original by making the same changes in provisions authorizing the redaction of certain items from information disclosed under public information requests.

C.S.H.B. 4207 adds provisions not in the original to specify that a state governmental body, by providing public information to the comptroller of public accounts for the required analysis, does not waive or affect the confidentiality of the information or waive the right to assert exceptions to required disclosure in the future.  The substitute adds provisions not in the original to prohibit the comptroller and task force from disclosing to a requestor or the public any information submitted to them by a governmental body.

C.S.H.B. 4207 differs from the original by authorizing the comptroller to adopt a plan of operation for the task force, and to consider any appropriate factor in making appointments to the task force, rather than requiring those actions as in the original.  The substitute adds a provision not in the original to include a member employed by an information services company to the required membership of the task force.