Multiple Agency Fiscal Note Summary - 6281 2S SB, Personal data
Summary
A Multiple Agency Fiscal Note Summary for 6281 2S SB, titled Personal data, followed by individual fiscal notes. The summary lists estimated operating expenditures by agency, including 1,108,000 for the Office of Attorney General in each of the 2021-23 and 2023-25 columns and 16,160,000 for the Community and Technical College System in the 2023-25 column. The total row shows 20,691,135 in the 2023-25 column. It notes Fiscal note not available for The Evergreen State College and lists Non-zero but indeterminate cost and/or savings for two agencies under estimated cash receipts.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Multiple Agency Fiscal Note Summary - 6281 2S SB, Personal data.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2020-02-26-a26766-d217989-6281-fn-02-25-20-dae6c680bd/
, SHA-256 ddb2f7606f927ecdec54425ddd11ef1cab6fa4ec0d5caddf16faa5a5c8f22b82.Full text
Multiple Agency Fiscal Note Summary
Bill Number: 6281 2S SB Title: Personal data
Estimated Cash Receipts
Agency Name 2019-21 2021-23 2023-25
GF- State Total GF- State Total GF- State Total
Office of State Treasurer Non-zero but indeterminate cost and/or savings. Please see discussion.
Consolidated Technology Services Non-zero but indeterminate cost and/or savings. Please see discussion.
Total $ 0 0 0 0 0 0
Agency Name 2019-21 2021-23 2023-25
GF- State Total GF- State Total GF- State Total
Local Gov. Courts No fiscal impact
Loc School dist-SPI
Local Gov. Other
Local Gov. Total
Estimated Operating Expenditures
Agency Name 2019-21 2021-23 2023-25
FTEs GF-State Total FTEs GF-State Total FTEs GF-State Total
Administrative Office of .0 0 0 .0 0 0 .0 0 0
the Courts
Office of State Treasurer .0 0 0 .0 0 0 .0 0 0
Office of Attorney .0 0 0 3.6 1,108,000 1,108,000 3.6 1,108,000 1,108,000
General
Consolidated Technology .0 0 0 .0 0 0 .0 0 0
Services
University of Washington .0 0 0 .0 0 0 3.0 902,970 902,970
Washington State .0 0 0 .0 0 0 1.5 580,000 580,000
University
Washington State In addition to the estimate above,there are additional indeterminate costs and/or savings. Please see individual
University fiscal note.
Eastern Washington .0 0 0 .0 0 0 2.3 580,177 580,177
University
Eastern Washington In addition to the estimate above,there are additional indeterminate costs and/or savings. Please see individual
University fiscal note.
Central Washington .0 0 0 .0 0 0 4.0 726,430 726,430
University
The Evergreen State Fiscal note not available
College
Western Washington .0 0 0 .0 0 0 1.8 633,558 633,558
University
Western Washington In addition to the estimate above,there are additional indeterminate costs and/or savings. Please see individual
University fiscal note.
Community and .0 0 0 .0 0 0 .0 16,160,000 16,160,000
Technical College System
Total $ 0.0 0 0 3.6 1,108,000 1,108,000 16.2 20,691,135 20,691,135
FNPID: 60451
FNS029 Multi Agency rollup
Agency Name 2019-21 2021-23 2023-25
FTEs GF-State Total FTEs GF-State Total FTEs GF-State Total
Local Gov. Courts No fiscal impact
Loc School dist-SPI
Local Gov. Other
Local Gov. Total
Estimated Capital Budget Expenditures
Agency Name 2019-21 2021-23 2023-25
FTEs Bonds Total FTEs Bonds Total FTEs Bonds Total
Administrative Office of .0 0 0 .0 0 0 .0 0 0
the Courts
Office of State Treasurer .0 0 0 .0 0 0 .0 0 0
Office of Attorney .0 0 0 .0 0 0 .0 0 0
General
Consolidated Technology .0 0 0 .0 0 0 .0 0 0
Services
University of Washington .0 0 0 .0 0 0 .0 0 0
Washington State .0 0 0 .0 0 0 .0 0 0
University
Eastern Washington .0 0 0 .0 0 0 .0 0 0
University
Central Washington .0 0 0 .0 0 0 .0 0 0
University
The Evergreen State Fiscal note not available
College
Western Washington .0 0 0 .0 0 0 .0 0 0
University
Community and .0 0 0 .0 0 0 .0 0 0
Technical College System
Total $ 0.0 0 0 0.0 0 0 0.0 0 0
Estimated Capital Budget Breakout
Prepared by: Bryan Way, OFM Phone: Date Published:
(360) 902-0650 Preliminary 2/21/2020
FNPID: 60451
FNS029 Multi Agency rollup
Judicial Impact Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 055-Administrative Office
of the Courts
Part I: Estimates
X No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Expenditures from:
NONE
The revenue and expenditure estimates on this page represent the most likely fiscal impact. Responsibility for expenditures may be
subject to the provisions of RCW 43.135.060.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Legislative Contact Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Pam Kelly Phone: 360-705-5318 Date: 02/14/2020
Agency Approval: Ramsey Radwan Phone: 360-357-2406 Date: 02/14/2020
OFM Review: Gaius Horton Phone: (360) 902-0608 Date: 02/17/2020
158,883.00 Request # 6281 2SSB-1
Form FN (Rev 1/00) 1 Bill # 6281 2S SB
FNS061 Judicial Impact Fiscal Note
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact on the Courts
Please see attached Judicial Impact Note (JIN).
II. B - Cash Receipts Impact
II. C - Expenditures
III. A - Expenditure By Object or Purpose (State)
NONE
III. B - Expenditure By Object or Purpose (County)
NONE
III. C - Expenditure By Object or Purpose (City)
NONE
III. D - FTE Detail
NONE
III. E - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
158,883.00 Request # 6281 2SSB-1
Form FN (Rev 1/00) 2 Bill # 6281 2S SB
FNS061 Judicial Impact Fiscal Note
Part II: Narrative Explanation
This bill would establish consumer personal data rights and identifies responsibilities of
controllers and processors of personal data, including requirements related to commercial use
of facial recognition services.
Part II.A – Brief Description of what the Measure does that has fiscal impact on
the Courts
Section 4(2) – Would exempt State and local governments from the jurisdictional scope that is
defined in subsection (1)(a) and (b) of this section.
Section 11 – Would make any violation of this chapter not to serve as the basis for, or be
subject to, a private right of action under this chapter or under any other law.
II.B - Cash Receipt Impact
None
II.C – Expenditures
None, there would be no new private rights of action created as a result of this bill and this bill
would exempt government agencies from this act so there would be no impacts on public
records requests or other publicly available records.
JUDICIAL IMPACT FISCAL NOTE BILL# 6281 2SSB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 090-Office of State
Treasurer
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
Non-zero but indeterminate cost and/or savings. Please see discussion.
Estimated Operating Expenditures from:
NONE
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
form Parts I-V.
X If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Dan Mason Phone: (360) 902-8990 Date: 02/07/2020
Agency Approval: Dan Mason Phone: (360) 902-8990 Date: 02/07/2020
OFM Review: Ramona Nabors Phone: (360) 902-0547 Date: 02/12/2020
Form FN (Rev 1/00) 158,902.00 Request # 060-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2SSB 6281 creates the consumer privacy account, coupled with the general fund as the recipient of the earnings
from investments under RCW 43.84.092(4).
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
Projected cash flows are currently unavailable; therefore, estimated earnings from investments are
indeterminable.
There may be an impact on the debt service limitation calculation. Any change to the earnings credited to the
general fund will change, by an equal amount, general state revenues.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
NONE
III. B - Expenditures by Object Or Purpose
NONE
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
NONE
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Personal data 090-Office of State Treasurer
Form FN (Rev 1/00) 158,902.00 Request # 060-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
Part V: New Rule Making Required
Personal data 090-Office of State Treasurer
Form FN (Rev 1/00) 158,902.00 Request # 060-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 100-Office of Attorney
General
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 0.0 0.0 0.0 3.6 3.6
Account
General Fund-State 001-1 0 0 0 1,108,000 1,108,000
Total $ 0 0 0 1,108,000 1,108,000
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Stacia Hollar Phone: (360) 664-0865 Date: 02/12/2020
Agency Approval: Edd Giger Phone: 360-586-2104 Date: 02/12/2020
OFM Review: Gwen Stamey Phone: (360) 902-9810 Date: 02/14/2020
Form FN (Rev 1/00) 159,266.00 Request # 149-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
Section 1 provides that short title of this act is the Washington Privacy Act of 2019.
Section 2 sets forth the legislative intent.
Section 3 provides definitions.
Section 4 specifies the businesses covered by the act and excludes state and local governments and higher
education. It also addresses specified data, including health care and health care quality improvement
information, as excluded from the provisions of the act.
Section 5 sets forth the responsibility of certain positions within the businesses.
Section 6 establishes consumer rights under the act regarding the rights to access, correct, delete, transmit, and
opt out of the distribution of personal data. The bill details the process for controllers to respond to consumer
complaints including an appeal process and provides for the submission of information regarding a specific
appeal to the Attorney General with the consumer’s consent.
Section 7 addresses the processing of de-identified data or pseudonymous data.
Section 8 addresses the responsibilities of controllers relating to transparency, purpose specification, data
minimization, avoiding secondary use, security, nondiscrimination, sensitive data, and non-waiver of consumer
rights.
Section 9 requires the businesses to conduct and document risk assessments covering the processing of personal
data. The Attorney General may request disclosure of, and evaluate, such assessments if relevant to an
investigation.
Section 10 addresses the limitations and applicability of the act to other controller and processor actions.
Section 11 addresses business liability.
Section 12 grants the Attorney General the exclusive authority to enforce and provides injunctive relief and a
civil penalty of not more than $7,500 per violation.
Section 13 creates an appropriated Consumer Privacy Account for deposit of all civil penalties except for
recovery of Attorney General’s costs and fees.
Section 14 provides this chapter supersedes and preempts laws adopted by local entities regarding this subject.
Section 15 requires that by July 1, 2022, the Attorney General shall compile and submit to the Governor and
Legislature a report evaluating the liability and enforcement provisions of the act and any recommended changes.
Section 16 authorizes the Governor to enter into agreements with the governments of British Columbia, Oregon
Personal data 100-Office of Attorney General
Form FN (Rev 1/00) 159,266.00 Request # 149-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
and California for joint data-driven research initiatives.
Section 17 addresses use of facial recognition technology by businesses. Voluntary facial recognition services for
aviation passengers are exempt from this section. Images captured by airlines may not be retained for more than
24 hours. Upon request of the Attorney General, the airlines must certify that they are complying with this
retention requirement.
Section 18 provides that the chapter does not apply to higher education or non-profits until July 31, 2024.
Section 19 provides that certain sections constitute a new chapter in Title 19 RCW.
Section 20 provides an effective date of July 31, 2021.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
Attorney General's Office Consumer Protection division activities are funded with General Fund-State dollars.
No cash receipt impact. There is no client agency to bill for legal services.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
Attorney General's Office (AGO) Agency Assumptions:
1. Legal services associated with the enactment of this bill will begin on July 31, 2021.
2. The AGO Transportation & Public Construction division (TPC) has reviewed this bill and determined it will
not increase or decrease the division’s workload in representing Washington Technology Services (WaTech).
After discussions with the State Privacy Officer at WaTech, it has been determined that the proposed bill’s
requirement for WaTech to conduct a study and other miscellaneous tasks will not significantly increase the
division’s workload in representing WaTech. The amount of legal services, if any, will be nominal and can be
provided with existing resources.
Assumptions for the AGO Consumer Protection division (CPR) Legal Services:
1. AGO CPR activities are funded with General Fund-State dollars. CPR enforces the Consumer Protection Act
with respect to conduct that is made unlawful under RCW 19.86.020, which broadly prohibits unfair or deceptive
acts or practices in trade or commerce. CPR focus is on representations and failures to disclose terms and
conditions.
2. CPR assumes there will be no legal challenges to the statute.
3. CPR anticipates three full investigations per year. If investigations lead to unexpected litigation, it will result
in slight increased costs.
Personal data 100-Office of Attorney General
Form FN (Rev 1/00) 159,266.00 Request # 149-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
4. Increased volume of consumer complaints will be handled within existing resources.
5. No private right of action will result in higher expectations and demands for CPR or higher costs.
6. Companies will be very resistant to investigations and investigations will be time-consuming.
7. Frequent (at least 36 per year) communications with companies to inquire of practices without investigations.
8. The AGO assumed $65,000 per fiscal year (FY) in investigation costs to include, but are not limited to:
A. $15,000 per FY for investigation deposition costs and state-wide travel.
B. $50,000 per FY for investigation document management costs (e-discovery).
9. Total workload impact in FY 2022 and in each FY thereafter: 1.17 Assistant Attorney General (AAG), 0.59
Legal Assistant (LA), 0.33 Investigator (INV), and 1.17 Paralegal (PL) at a cost of $554,000 per FY (this includes
investigation costs of $65,000 per FY).
Note: Agency administration support FTEs are included in the tables below, using a Management Analyst 5 as a
representative classification.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 1,108,000 1,108,000
Total $ 0 0 0 1,108,000 1,108,000
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 3.6 3.6
A-Salaries and Wages 626,000 626,000
B-Employee Benefits 216,000 216,000
C-Professional Service Contracts
E-Goods and Other Services 220,000 220,000
G-Travel 38,000 38,000
J-Capital Outlays 8,000 8,000
Total $ 0 0 0 1,108,000 1,108,000
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
Job Classification Salary FY 2020 FY 2021 2019-21 2021-23 2023-25
Assistant Attorney General-Seattle 110,256 1.2 1.2
Legal Assistant 3-Seattle 64,944 0.6 0.6
Management Analyst 5 88,644 0.3 0.3
Paralegal 2-Seattle 70,608 1.2 1.2
Senior Investigator-Seattle 92,652 0.3 0.3
Total FTEs 3.6 3.6
Personal data 100-Office of Attorney General
Form FN (Rev 1/00) 159,266.00 Request # 149-1
FNS063 Individual State Agency Fiscal Note 4 Bill # 6281 2S SB
III. D - Expenditures By Program (optional)
Program FY 2020 FY 2021 2019-21 2021-23 2023-25
Consumer Protection Division (CPR) 1,108,000 1,108,000
Total $ 1,108,000 1,108,000
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 100-Office of Attorney General
Form FN (Rev 1/00) 159,266.00 Request # 149-1
FNS063 Individual State Agency Fiscal Note 5 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 163-Consolidated
Technology Services
Part I: Estimates
X No Fiscal Impact
Estimated Cash Receipts to:
Non-zero but indeterminate cost and/or savings. Please see discussion.
Estimated Operating Expenditures from:
NONE
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Wendy Armstrong Phone: 360-407-8977 Date: 02/11/2020
Agency Approval: Tim Gallivan Phone: (360) 407-8215 Date: 02/11/2020
OFM Review: Bryan Way Phone: (360) 902-0650 Date: 02/12/2020
Form FN (Rev 1/00) 158,884.00 Request # 6281 2SSB-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2SSB 6281 creates the Washington Privacy Act. This is a private industry/consumer directed bill that creates
consumer rights regarding data handling practices of private businesses. The Act does not apply to local and state
governments, personal data sets regulated by certain federal laws, or employment records. The Act does apply to
legal entities that control or process data of more than 100,000 consumers and/or derive 50 percent of gross
revenue from the sale of personal information. Consumer rights created by the bill include the right of data:
access, correction, deletion, portability, and opt out provisions. The law will be enforced by the Attorney
General’s Office (AGO) consumer protection division. The bill also includes facial recognition provisions and
regulates facial recognition technology use by private businesses.
Section 2(6) encourages OPDP to monitor the development of universal privacy controls that communicate a
consumer’s affirmative choice to opt out of processing personal data concerning the consumer for purposes of
targeted advertising, sale of personal data or similar profiling of the consumer. This section will increase the
workload for the OPDP. It is assumed that OPDP can absorb and reprioritize the workload within its base
budget.
Changes to 2SSB 6281 (from SSB 6281) include:
•Section 2(7): New subsection allows institutions of higher education and nonprofit corporations to delay
compliance with this Act for three years. Consolidated Technology Services (WaTech) does not anticipate this
change will have an impact.
•Section 18: New subsection exempts institutions of higher education or nonprofit corporations from this Act
until July 31, 2024.
Changes to SSB 6281 (from SB 6281) included:
•Section 2(6): New subsection encouraging OPDP to monitor the development of universal privacy controls that
communicate a consumer’s affirmative choice to opt out of processing personal data concerning the consumer for
purposes of targeted advertising, sale of personal data or similar profiling of the consumer. WaTech does not
anticipate this change will have an impact.
•Section 15: Removes requirement to conduct a study on the development of technology, such as a browser
setting, browser extension, or global device setting, indicating a consumer's affirmative, freely given, and
unambiguous choice to opt out of the processing of personal data for the purposes of targeted advertising, the sale
of personal data, or profiling in furtherance of decisions that produce legal effects concerning consumers or
similarly significant effects concerning consumers. The requirement to submit a report of its findings and
recommendations to the Governor and appropriate committees by October 31, 2021 has also been removed. This
change removes the impacts WaTech reported on SB 6281.
*OPDP is a division of the Office of the Chief Information Officer (OCIO) in Consolidated Technology Services
(WaTech).
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
Indeterminate.
Personal data 163-Consolidated Technology Services
Form FN (Rev 1/00) 158,884.00 Request # 6281 2SSB-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
Section 13 establishes the Consumer Privacy Account and authorizes the Attorney General’s Office (AGO) to
bring action to assess civil penalties. All receipts, less recovery of AGO costs, shall be deposited into the
Consumer Privacy Account and may only be used for the purposes of the OPDP. The amount of revenue that
may be collected per Section 13 is unknown.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
WaTech does not have enough data to make reliable assumptions regarding the level of participation required to
meet the provisions of Section 2 Part 6 of this bill; it is assumed WaTech can absorb the staff costs for this
proposed bill in its base budget if the workload of other enacted legislation does not exceed current staffing
levels.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
NONE
III. B - Expenditures by Object Or Purpose
NONE
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
NONE
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 163-Consolidated Technology Services
Form FN (Rev 1/00) 158,884.00 Request # 6281 2SSB-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 360-University of
Washington
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 0.0 0.0 0.0 0.0 3.0
Account
General Fund-State 001-1 0 0 0 0 902,970
Total $ 0 0 0 0 902,970
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Kelsey Rote Phone: 2065437466 Date: 02/14/2020
Agency Approval: Kelsey Rote Phone: 2065437466 Date: 02/14/2020
OFM Review: Breann Boggs Phone: (360) 902-0659 Date: 02/17/2020
Form FN (Rev 1/00) 159,667.00 Request # 2020-91-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2S SB 6281 provides Washington residents with the consumer personal data rights of access, correction, deletion,
data portability, and opt out of the processing of personal data for specified purposes; specifies the thresholds a
business must satisfy for the requirements set forth in this act to apply; identifies certain controller
responsibilities such as transparency, purpose specification, and data minimization; requires controllers to
conduct data protection assessments under certain conditions; authorizes enforcement exclusively by the attorney
general; and provides a regulatory framework for the commercial use of facial recognition services such as
testing, training, and disclosure requirements.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
If this bill were to pass, the UW would need to collaborate with the AGO to clarify what personal data at UW are
and are not governed by the bill. We assume there are exemptions for human subjects research, healthcare,
student data, employment data, and others. However, the scope may still include personal data collected from
prospective students, parents, job applicants, alumni, donors, event participants, ticket holders, youth in youth
programs, library patrons, and more. Once the balance is determined, then the UW would need to develop and
maintain:
1. Processes and procedures consumers request associated with their data
2. Privacy notices for various types of activities
3. Consent forms for various types of activities
4. Data protection assessments for various types of activities
5. Operational processes for addressing concerns, investigations, etc.
In order to fulfill the above requirements, the UW Privacy Office would need to procure a system to, at
minimum:
1. Identify what personal data is held where and for what purpose
2. Obtain consent from individuals
3. Assess the benefits and risks of certain activities
4. Track and respond to consumer request
We anticipate the following costs in FY25 and each year thereafter (unless otherwise noted) in order to comply
with the language of the bill:
Salaries & Wages
• 1.0 FTE Privacy Program Manager (annual full-time salary $120,000, benefits rate 32.1%)
• 1.0 FTE Privacy Program Specialist (annual full-time salary $80,000, benefits rate 32.1%)
Personal data 360-University of Washington
Form FN (Rev 1/00) 159,667.00 Request # 2020-91-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
• 1.0 FTE Programmer (annual full-time salary $105,000, benefits rate 32.1%) for system support, online
training, web development
• 1.0 FTE Project Manager (annual full-time salary $75,000, benefits rate 32.1%) temporary two year position
in FY25 and FY26
Goods & Services
• Privacy program system $80,000 per year
• Operational costs for supplies, equipment, training materials, and other items $20,000 per year
We estimate the total cost to comply with this bill would be approximately $601,980 in FY25.
Given that we would need some time to prepare for the July 2024 date wherein the bill would apply to higher
education institutions, we anticipate a ramp up period that would involve half of the FY25 costs in FY24.
Complying with the bill would therefore cost $300,990 in FY24.
HOWEVER, there may be other additional legal costs, costs for our medical/hospital system, and costs for other
areas and departments. These are unknown at this time, but could be significant.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 0 902,970
Total $ 0 0 0 0 902,970
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 3.0
A-Salaries and Wages 570,000
B-Employee Benefits 182,970
C-Professional Service Contracts
E-Goods and Other Services 150,000
G-Travel
J-Capital Outlays
M-Inter Agency/Fund Transfers
N-Grants, Benefits & Client Services
P-Debt Service
S-Interagency Reimbursements
T-Intra-Agency Reimbursements
9-
Total $ 0 0 0 0 902,970
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
Job Classification Salary FY 2020 FY 2021 2019-21 2021-23 2023-25
Privacy Program Manager 120,000 0.8
Privacy Program Specialist 80,000 0.8
Programmer 105,000 0.8
Project Manager 75,000 0.8
Total FTEs 3.0
Personal data 360-University of Washington
Form FN (Rev 1/00) 159,667.00 Request # 2020-91-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 360-University of Washington
Form FN (Rev 1/00) 159,667.00 Request # 2020-91-1
FNS063 Individual State Agency Fiscal Note 4 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 365-Washington State
University
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 0.0 0.0 0.0 0.0 1.5
Account
General Fund-State 001-1 0 0 0 0 580,000
Total $ 0 0 0 0 580,000
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Chris Jones Phone: 509-335-9682 Date: 02/17/2020
Agency Approval: Chris Jones Phone: 509-335-9682 Date: 02/17/2020
OFM Review: Breann Boggs Phone: (360) 902-0659 Date: 02/20/2020
Form FN (Rev 1/00) 159,557.00 Request # 2020-86-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2S SB 6281 creates the Washington Privacy Act, which provides Washington residents with the consumer
personal data rights of access, correction, deletion, data portability, and the right to opt out of the processing of
personal data for specified purposes; specifies the thresholds a business must satisfy for the requirements set
forth in this act to apply; identifies certain controller responsibilities such as transparency, purpose specification,
and data minimization; requires controllers to conduct data protection assessments under certain conditions;
authorizes enforcement exclusively by the attorney general; and provides a regulatory framework for the
commercial use of facial recognition services such as testing, training, and disclosure requirements.
Section 5 describes the responsibilities according to role; it specifies that that processors shall implement and
maintain reasonable security procedures and practices; ensure that each person processing personal data is subject
to a duty of confidentiality; and processors shall engage a subcontractor only after providing the controller with
an opportunity to object and pursuant to a written contract in accordance with Section 5 (5). Processing by a
processor shall be governed by a contract between the controller and the processor that is binding on both parties.
The processor shall, upon request of the controller, delete or return all personal data to the controller at the end of
the provision of services.
Section 6 defines consumer personal data rights: the right of access, right to correction, right to deletion, right to
data portability, and the right to opt out.
Section 8 describes the responsibilities of controllers, including providing consumers with an accessible and
meaningful privacy notice. It also describes responsibilities related to transparency, purpose specification, data
minimization, avoiding secondary use, security, nondiscrimination, sensitive data, and non-waiver of consumer
rights.
Section 9 requires controllers to conduct data protection assessments on certain activities involving personal data.
Section 10 describes the limitations and applicability of the bill's provisions.
Section 17 concerns the appropriate use of facial recognition services and data by controllers and processors.
Per Section 18, the bill requirements would not apply to institutions of higher education until July 31, 2024.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
2SSB 6281 has both determinate and indeterminate costs for WSU. Indeterminate costs are driven by lack of
clarity around what constitutes personal data, who constitutes consumers and how often data protection
assessments are required. Legal and software costs will be incurred but to what degree is indeterminate without
Personal data 365-Washington State University
Form FN (Rev 1/00) 159,557.00 Request # 2020-86-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
greater clarity.
Determinate impacts include core staffing needed to build up a Privacy Office and Program for the development
of business processes, procedures and forms, including privacy notices and consent forms; handling customer
requests; and conducting investigations.
WSU estimates the following staff and resources will be needed in order to be compliant with this bill:
- 1.0 Permanent FTE Privacy Program Manager (annual salary $110,000, benefits rate 35.0%)
- 1.0 Permanent FTE Privacy Analyst (annual salary $90,000, benefits rate 35.0%)
- Data Protection Assessment (assumes $85,000 one-time for initial assessment)
- Personal Data Discovery Application ($90,000 one-time; $30,000 annual recurring cost)
For purposes of the fiscal note, WSU is assuming six months of costs to occur in FY24 in order to ensure
compliance once the bill takes effect in July 2024 for institutions of higher education.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 0 580,000
Total $ 0 0 0 0 580,000
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 1.5
A-Salaries and Wages 300,000
B-Employee Benefits 105,000
C-Professional Service Contracts 85,000
E-Goods and Other Services 90,000
G-Travel
J-Capital Outlays
M-Inter Agency/Fund Transfers
N-Grants, Benefits & Client Services
P-Debt Service
S-Interagency Reimbursements
T-Intra-Agency Reimbursements
9-
Total $ 0 0 0 0 580,000
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
Job Classification Salary FY 2020 FY 2021 2019-21 2021-23 2023-25
Privacy Analyst 90,000 0.8
Privacy Program Manager 110,000 0.8
Total FTEs 1.5
III. D - Expenditures By Program (optional)
NONE
Personal data 365-Washington State University
Form FN (Rev 1/00) 159,557.00 Request # 2020-86-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 365-Washington State University
Form FN (Rev 1/00) 159,557.00 Request # 2020-86-1
FNS063 Individual State Agency Fiscal Note 4 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 370-Eastern Washington
University
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 0.0 0.0 0.0 0.0 2.3
Account
General Fund-State 001-1 0 0 0 0 580,177
Total $ 0 0 0 0 580,177
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Alexandra Rosebrook Phone: (509) 359-7364 Date: 02/20/2020
Agency Approval: Alexandra Rosebrook Phone: (509) 359-7364 Date: 02/20/2020
OFM Review: Breann Boggs Phone: (360) 902-0659 Date: 02/21/2020
Form FN (Rev 1/00) 159,256.00 Request # 2020-63-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2S SB 6281 creates the Washington Privacy Act, which provides Washington residents with the consumer
personal data rights of access, correction, deletion, data portability, and the right to opt out of the processing of
personal data for specified purposes; specifies the thresholds a business must satisfy for the requirements set
forth in this act to apply; identifies certain controller responsibilities such as transparency, purpose specification,
and data minimization; requires controllers to conduct data protection assessments under certain conditions;
authorizes enforcement exclusively by the attorney general; and provides a regulatory framework for the
commercial use of facial recognition services such as testing, training, and disclosure requirements.
Section 5 describes the responsibilities according to role; it specifies that that processors shall implement and
maintain reasonable security procedures and practices; ensure that each person processing personal data is subject
to a duty of confidentiality; and processors shall engage a subcontractor only after providing the controller with
an opportunity to object and pursuant to a written contract in accordance with Section 5 (5). Processing by a
processor shall be governed by a contract between the controller and the processor that is binding on both parties.
The processor shall, upon request of the controller, delete or return all personal data to the controller at the end of
the provision of services.
Section 6 defines consumer personal data rights: the right of access, right to correction, right to deletion, right to
data portability, and the right to opt out.
Section 8 describes the responsibilities of controllers, including providing consumers with an accessible and
meaningful privacy notice. It also describes responsibilities related to transparency, purpose specification, data
minimization, avoiding secondary use, security, nondiscrimination, sensitive data, and non-waiver of consumer
rights.
Section 9 requires controllers to conduct data protection assessments on certain activities involving personal data.
Section 10 describes the limitations and applicability of the bill's provisions.
Section 17 concerns the appropriate use of facial recognition services and data by controllers and processors.
Per Section 18, the bill requirements would not apply to institutions of higher education until July 31, 2024.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
The proposed bill does not identify what personal data that higher education institutions collect that would be
subject to the identified requirements. Eastern would need to consult with the attorney general's office to identify
how this bill applies to us. Upon determining the data Eastern would need to develop additional processes and
Personal data 370-Eastern Washington University
Form FN (Rev 1/00) 159,256.00 Request # 2020-63-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
procedures to ensure compliance with the identified requirements.
Eastern will need the following staff and resources to be compliant with this proposed bill:
- 1 FTE IT Data Management Sr Specialist annual salary $109,000 and benefits $35,970 (33%)
- 1 FTE Programmer annual salary $88,500 and benefits $29,205 (33%)
- 1 FTE Program Manager annual salary $100,000 and benefits $33,000 (33%)
- Privacy tracking and retention software licenses estimated at $100,000 per year.
As stated in Section 18 of the proposed bill these requirements would be implement July 31, 2024. Eastern
anticipates the indeterminate costs would start in FY2024 for a July implementation. We are anticipating 6
months of these costs would beginning in FY24 with the full year beginning for FY25.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 0 580,177
Total $ 0 0 0 0 580,177
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 2.3
A-Salaries and Wages 282,914
B-Employee Benefits 147,263
C-Professional Service Contracts
E-Goods and Other Services 150,000
G-Travel
J-Capital Outlays
M-Inter Agency/Fund Transfers
N-Grants, Benefits & Client Services
P-Debt Service
S-Interagency Reimbursements
T-Intra-Agency Reimbursements
9-
Total $ 0 0 0 0 580,177
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
Job Classification Salary FY 2020 FY 2021 2019-21 2021-23 2023-25
IT Data Management Sr. Specialist 109,000 0.8
Program Manager 100,000 0.8
Programmer 88,500 0.8
Total FTEs 2.3
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
Personal data 370-Eastern Washington University
Form FN (Rev 1/00) 159,256.00 Request # 2020-63-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 370-Eastern Washington University
Form FN (Rev 1/00) 159,256.00 Request # 2020-63-1
FNS063 Individual State Agency Fiscal Note 4 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 375-Central Washington
University
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 0.0 0.0 0.0 0.0 4.0
Account
General Fund-State 001-1 0 0 0 0 726,430
Total $ 0 0 0 0 726,430
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Lisa Plesha Phone: (509) 963-1233 Date: 02/18/2020
Agency Approval: Lisa Plesha Phone: (509) 963-1233 Date: 02/18/2020
OFM Review: Breann Boggs Phone: (360) 902-0659 Date: 02/20/2020
Form FN (Rev 1/00) 159,451.00 Request # 2S SB 6281-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2S SB 6281 would give Washingtonians the consumer personal data rights of access, correction, deletion, data
portability, and opt out of personal data processing for specific purposes. Thresholds that a business must satisfy
to be in compliance with this bill are set forth and certain controller responsibilities are defined, such as
transparency, data minimization, and data purpose specification. The bill would require controllers of data to
conduct protection assessments and would authorize enforcement by the attorney general of the state of
Washington. Additionally, regulations around the commercial use of facial recognition services would be
established for activities such as testing, training, and disclosure.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
The bill language is not clear on what personal consumer data that CWU is in control of that would be subject to
compliance under this bill proposal and CWU would need to consult with the attorney general's office to make
that determination. Once the data is identified that would be subject to compliance under this bill, CWU would
need to develop and maintain certain processes and procedures associated with consumer data requests, privacy
notices and consent forms, the data protection assessments specified in the bill language and processes for
responding to concerns, investigations, and remediation.
Additionally, CWU would need to be able to identify what type of personal data is retained and for what purpose,
obtain consent from individuals to retain said data, assess whether data should be retained or not, and track and
respond to customer requests.
Because CWU would not be required to comply with this legislation until July 2024, we anticipate costs
associated with determining the aforementioned procedural and system developments for retaining and tracking
the data as well as the development of necessary consent forms and privacy notices to cost as follows:
1 FTE IT Security Senior Specialist ($112,000 annual salary + 33% benefits rate)
1 FTE IT Security Expert ($129,000 annual salary + 33% benefits rate)
1 FTE IT Data Management Journey ($101,000 + 33% benefits rate)
1 FTE IT Project Manager/Senior Manager ($129,000 annual salary + 33% benefits rate)
Privacy tracking and retention software license ~$100,000
With a 6 month preparation period prior to implementation, CWU would split the total costs itemized above over
FY24 and FY25 with a total cost to comply of $726,430
Personal data 375-Central Washington University
Form FN (Rev 1/00) 159,451.00 Request # 2S SB 6281-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 0 726,430
Total $ 0 0 0 0 726,430
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 4.0
A-Salaries and Wages 471,000
B-Employee Benefits 155,430
C-Professional Service Contracts
E-Goods and Other Services 100,000
G-Travel
J-Capital Outlays
M-Inter Agency/Fund Transfers
N-Grants, Benefits & Client Services
P-Debt Service
S-Interagency Reimbursements
T-Intra-Agency Reimbursements
9-
Total $ 0 0 0 0 726,430
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
Job Classification Salary FY 2020 FY 2021 2019-21 2021-23 2023-25
IT Data Management Journey 101 1.0
IT Project Manager/Senior Manager 129,000 1.0
IT Security Expert 129,000 1.0
IT Security Senior Specialist 112,000 1.0
Total FTEs 4.0
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 375-Central Washington University
Form FN (Rev 1/00) 159,451.00 Request # 2S SB 6281-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 380-Western Washington
University
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 0.0 0.0 0.0 0.0 1.8
Account
General Fund-State 001-1 0 0 0 0 633,558
Total $ 0 0 0 0 633,558
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Kristen Stouder Phone: (360) 650-2811 Date: 02/21/2020
Agency Approval: Ted Castro Phone: (360) 650-4694 Date: 02/21/2020
OFM Review: Breann Boggs Phone: (360) 902-0659 Date: 02/21/2020
Form FN (Rev 1/00) 159,820.00 Request # -1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
2S SB 6281 provides Washington residents with the consumer personal data rights of access, correction, deletion,
data portability, and top out of the processing of personal data for specified purposes; specifies the thresholds a
business must satisfy for the requirements set forth in this act to apply; identifies certain controller
responsibilities such as transparency, purpose specification, and data minimization; requires controllers to
conduct data protection assessments under certain conditions; authorizes enforcement exclusively by the attorney
general; and provides a regulatory framework for the commercial use of facial recognition services such as
testing, training and disclosure requirements.
Section 5 describes the responsibilities according to role. The bill requires that processors implement and
maintain security procedures and practices, and ensures that persons processing personal data are subject to
confidentiality. Section 5 requires a binding contract between the controller and processor when a processor
engages in processing of data.
Section 6 defines consumer personal data rights which includes the right of access, right to correction, right to
deletion, right to data portability, and the right to opt out.
Section 8 defines the responsibilities of controllers, including providing consumers with an accessible and
meaningful privacy notice, data transparency, purpose specification, data minimization, security,
nondiscrimination, sensitive data, and non-waiver of consumer rights for controllers.
Section 9 requires controllers to conduct data protection assessments involving personal data.
Section 10 describes limitations and applicability of the bill's provisions.
Section 17 concerns the appropriate use of facial recognition services and data by controllers and processors.
Section 18 states that the requirements in this bill do not apply to institutions of higher education until July 31,
2024.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
The language in 2S SB 6281 is unclear regarding what types of consumer data apply to Western Washington
University that would be subject to compliance under this bill. WWU would need to consult with the attorney
general's office to clarify what types of data fall under the regulations in this bill. The bill indicates that there are
exemptions for student and employment data but it is unclear what other kinds of data WWU maintains that are
subject to requirements of this bill. Further, it is unclear what WWU's role is in terms of if WWU is considered a
processor, a controller, or both depending on the situation.
Personal data 380-Western Washington University
Form FN (Rev 1/00) 159,820.00 Request # -1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
Once data are identified as subject to the requirements of this bill, WWU would need to develop, implement,
and maintain policies and procedures consistent with the bill regarding consumer data requests, privacy notices
and consent forms, the data protection assessments specified in the bill language and processes for responding to
concerns, investigations, and remediation. WWU would also need to identify what types of personal data are
retained and for what purposes, obtain consent from individuals to retain those data, evaluate whether or not data
should be retained, and manage responses to consumer requests.
In order to comply with the requirements of this bill, WWU expects costs associated with developing procedures
and systems to identify: the types of personal data the institution maintains and for what purpose, if those data
are subject to the requirements in this law, develop consent forms and privacy notices, and track and respond to
consumer requests.
We expect the following one-time costs starting in FY2024 to be in compliance by the start of FY2025:
•.25 FTE Senior Systems Analyst/Programmer (annual salary $93,000 benefits rate of 31%)
•.25 FTE IT Project Manager (annual salary $90,000, benefits rate of 32%)
•.5 FTE Program Manager - Security (IT) (Annual salary $100,000 benefits rate 40%)
•1.0 FTE Privacy Specialist/Analyst (annual salary $80,000, benefits rate 32%)
•Data Protection Assessment ($85,000, one-time initial assessment contract with consultant)
•Privacy program application ($90,000 one-time)
In FY2025 and thereafter, we expect the following recurring costs:
•.5FTE Program Manager - Security (IT) (Annual salary $100,000 benefits rate 40%)
•1.0 FTE Privacy Specialist/Analyst (annual salary $80,000, benefits rate 32%)
•$30,000 ongoing licensing for privacy program application
Per OFM guidance for past fiscal notes, we have not adjusted salaries for future increases, which are likely to be
approximately 10% higher in FY24 than current salary rates listed.
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 0 633,558
Total $ 0 0 0 0 633,558
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
Personal data 380-Western Washington University
Form FN (Rev 1/00) 159,820.00 Request # -1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years 1.8
A-Salaries and Wages 315,750
B-Employee Benefits 112,808
C-Professional Service Contracts 85,000
E-Goods and Other Services 120,000
G-Travel
J-Capital Outlays
M-Inter Agency/Fund Transfers
N-Grants, Benefits & Client Services
P-Debt Service
S-Interagency Reimbursements
T-Intra-Agency Reimbursements
9-
Total $ 0 0 0 0 633,558
In addition to the estimates above, there are additional indeterminate costs and/or savings. Please see discussion.
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
Job Classification Salary FY 2020 FY 2021 2019-21 2021-23 2023-25
IT Project Manager 90,000 0.1
Privacy Specialist/Analyst 80,000 1.0
Program Manager - Security (IT) 100,000 0.5
Senior Systems Analyst/Programmer 93,000 0.1
Total FTEs 1.8
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 380-Western Washington University
Form FN (Rev 1/00) 159,820.00 Request # -1
FNS063 Individual State Agency Fiscal Note 4 Bill # 6281 2S SB
Individual State Agency Fiscal Note
Bill Number: 6281 2S SB Title: Personal data Agency: 699-Community and
Technical College System
Part I: Estimates
No Fiscal Impact
Estimated Cash Receipts to:
NONE
Estimated Operating Expenditures from:
FY 2020 FY 2021 2019-21 2021-23 2023-25
Account
General Fund-State 001-1 0 0 0 0 16,160,000
Total $ 0 0 0 0 16,160,000
Estimated Capital Budget Impact:
NONE
The cash receipts and expenditure estimates on this page represent the most likely fiscal impact. Factors impacting the precision of these estimates,
and alternate ranges (if appropriate), are explained in Part II.
Check applicable boxes and follow corresponding instructions:
If fiscal impact is greater than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete entire fiscal note
X
form Parts I-V.
If fiscal impact is less than $50,000 per fiscal year in the current biennium or in subsequent biennia, complete this page only (Part I).
Capital budget impact, complete Part IV.
Requires new rule making, complete Part V.
Legislative Contact: Sarian Scott Phone: 360-786-7729 Date: 02/07/2020
Agency Preparation: Brian Myhre Phone: 360-704-4413 Date: 02/20/2020
Agency Approval: Cherie Berthon Phone: 360-704-1023 Date: 02/20/2020
OFM Review: Breann Boggs Phone: (360) 902-0659 Date: 02/21/2020
Form FN (Rev 1/00) 159,388.00 Request # 62-1
FNS063 Individual State Agency Fiscal Note 1 Bill # 6281 2S SB
Part II: Narrative Explanation
II. A - Brief Description Of What The Measure Does That Has Fiscal Impact
Briefly describe by section number, the significant provisions of the bill, and any related workload or policy assumptions, that have revenue or
expenditure impact on the responding agency.
This bill would create consumer rights regarding the data handling practices of private businesses.
Section 3
Provides for definitions used in the bill including definitions for; consumer, controller, facial recognition service,
processor, sensitive data and third party.
Section 4
Specifies that the bill applies to legal entities that conduct business in Washington or who produce products or
services that are targeted to residents of the state and satisfy at least one of the following:
• Controls or processes the personal data of one hundred thousand consumers or more in a calendar year
• Derives over fifty percent of gross revenue from the sale of personal data and processes or controls personal
data of twenty-five thousand consumers or more
Certain information is exempt from requirements in the bill including data maintained for employment records
purposes.
Section 5
Describes the responsibilities according to role; it specifies that that processors shall implement and maintain
reasonable security procedures and practices; ensure that each person processing personal data is subject to a duty
of confidentiality; and processors shall engage a subcontractor only after providing the controller with an
opportunity to object and pursuant to a written contract in accordance with Section 5 (5). Processing by a
processor shall be governed by a contract between the controller and the processor that is binding on both parties.
The processor shall, upon request of the controller, delete or return all personal data to the controller at the end of
the provision of services.
Section 6
Defines consumer personal data rights: the right of access, right to correction, right to deletion, right to data
portability, and the right to opt out.
Section 8
Describes the responsibilities of controllers, including providing consumers with an accessible and meaningful
privacy notice. It also describes responsibilities related to transparency, purpose specification, data minimization,
avoiding secondary use, security, nondiscrimination, sensitive data, and non-waiver of consumer rights.
Section 9
Requires controllers to conduct data protection assessments on certain activities involving personal data.
Section 10
Describes the limitations and applicability of the bill's provisions.
Section 17
Concerns the appropriate use of facial recognition services and data by controllers and processors.
Personal data 699-Community and Technical College System
Form FN (Rev 1/00) 159,388.00 Request # 62-1
FNS063 Individual State Agency Fiscal Note 2 Bill # 6281 2S SB
Section 18
Specifies the bill requirements would not apply to institutions of higher education until July 31, 2024.
II. B - Cash receipts Impact
Briefly describe and quantify the cash receipts impact of the legislation on the responding agency, identifying the cash receipts provisions by section
number and when appropriate the detail of the revenue sources. Briefly describe the factual basis of the assumptions and the method by which the
cash receipts impact is derived. Explain how workload assumptions translate into estimates. Distinguish between one time and ongoing functions.
No cash receipts impact.
II. C - Expenditures
Briefly describe the agency expenditures necessary to implement this legislation (or savings resulting from this legislation), identifying by section
number the provisions of the legislation that result in the expenditures (or savings). Briefly describe the factual basis of the assumptions and the
method by which the expenditure impact is derived. Explain how workload assumptions translate into cost estimates. Distinguish between one time
and ongoing functions.
The bill would result in fiscal impacts.
The State Board for Community and Technical Colleges (SBCTC), along with colleges in the system, would need
to collaborate with the Office of Attorney General to clarify what personal data is governed by the bill. The scope
may still include personal data collected from prospective students, parents, job applicants, alumni, donors, event
participants, ticket holders, youth in youth programs, library patrons, and more. Once the scope is determined, a
Privacy Office and Program would need to be created and staffed at each college for the development of business
processes, procedures and forms, including privacy notices and consent forms; handling customer requests; and
conducting investigations.
In order to fulfill the above requirements, it is estimated the following staff and resources will be needed:
SBCTC
1.0 FTE – Privacy Program Manager ($120,000 salary & benefits)
At Each College
1.0 FTE – Privacy Program Manager ($120,000 salary & benefits)
1.0 FTE – IT Specialist 5 ($120,000 salary & benefits)
Privacy tracking software license ($30,000 annual recurring cost)
Data Protection Assessment (assumes $65,000 one-time for initial assessment in FY24)
Given that some time would be needed to prepare for the July 2024 (FY25) date when the bill would apply to
higher education institutions, there would be a ramp up period in FY24.
SBCTC Costs
FY24 – $60,000 staff
FY25 onward – $120,000
Cost per college
FY24 – $120,000 staff + $15,000 software + 65,000 data assessment = $200,000
FY25 onward – $240,000 + $30,000 software = $270,000
TOTAL COSTS
FY24 – ($60,000 SBCTC) + ($200,000 X 34 colleges) = $6,860,000
FY25 onward – ($120,000 SBCTC) + ($270,000 X 34 colleges) = $9,300,000
Personal data 699-Community and Technical College System
Form FN (Rev 1/00) 159,388.00 Request # 62-1
FNS063 Individual State Agency Fiscal Note 3 Bill # 6281 2S SB
Part III: Expenditure Detail
III. A - Operating Budget Expenditures
Account Account Title Type FY 2020 FY 2021 2019-21 2021-23 2023-25
001-1 General Fund State 0 0 0 0 16,160,000
Total $ 0 0 0 0 16,160,000
III. B - Expenditures by Object Or Purpose
FY 2020 FY 2021 2019-21 2021-23 2023-25
FTE Staff Years
A-Salaries and Wages 9,345,000
B-Employee Benefits 3,075,000
C-Professional Service Contracts 2,210,000
E-Goods and Other Services 1,530,000
G-Travel
J-Capital Outlays
M-Inter Agency/Fund Transfers
N-Grants, Benefits & Client Services
P-Debt Service
S-Interagency Reimbursements
T-Intra-Agency Reimbursements
9-
Total $ 0 0 0 0 16,160,000
III. C - Operating FTE Detail: List FTEs by classification and corresponding annual compensation. Totals need to agree with total FTEs in
Part I and Part IIIA
NONE
III. D - Expenditures By Program (optional)
NONE
Part IV: Capital Budget Impact
IV. A - Capital Budget Expenditures
NONE
IV. B - Expenditures by Object Or Purpose
NONE
IV. C - Capital Budget Breakout
Identify acquisition and construction costs not reflected elsewhere on the fiscal note and describe potential financing methods
NONE
Part V: New Rule Making Required
Personal data 699-Community and Technical College System
Form FN (Rev 1/00) 159,388.00 Request # 62-1
FNS063 Individual State Agency Fiscal Note 4 Bill # 6281 2S SB
File and source
- File
- 2020-02-26_a26766_d217989_6281-fn-02-25-20.pdf
- Size
- 1,522,820 bytes
- SHA-256
- ddb2f7606f927ecdec54425ddd11ef1cab6fa4ec0d5caddf16faa5a5c8f22b82
- Original
- No public link identified.