Missouri SB 880: Creates the position of chief data officer

Bill Text

SECOND REGULAR SESSION
SENATE BILL NO. 880
100TH GENERAL ASSEMBLY
INTRODUCED BY SENATOR ROWDEN.
Read 1st time January 14, 2020, and ordered printed.
ADRIANE D. CROUSE, Secretary.
4095S.03I
AN ACT
To amend chapter 37, RSMo, by adding thereto one new section relating to the
protection of information controlled by state agencies.
Be it enacted by the General Assembly of the State of Missouri, as follows:
Section A. Chapter 37, RSMo, is amended by adding thereto one new
2 section, to be known as section 37.060, to read as follows:
37.060. 1. (1) There is hereby created within the office of
2 administration the position of chief data officer, who shall be appointed
3 by the commissioner of administration and shall report to the chief
4 information officer or, in the absence of a chief information officer, the
5 commissioner of administration.
6 (2) The chief data officer is authorized to oversee each state
7 agency's management of electronic data for purposes of evaluating
8 appropriate management and security of the data.
9 (3) The chief data officer may require each state agency to:
10 (a) Classify its electronic data into levels of sensitivity identified
11 by the chief data officer and regularly review and update such
12 classifications;
13 (b) Develop, adopt, and regularly update a written policy for
14 responding to breaches and suspected breaches of the agency's
15 electronic data;
16 (c) Develop, adopt, and regularly update a written policy for the
17 proper disposal, consistent with chapter 109, of the agency's electronic
18 data, including requiring the agency to use the office of
19 administration's electronic waste contract for that purpose;
20 (d) Adopt data collection standards and procedures identified by
21 the chief data officer; and

SB 880 2
22 (e) Develop, adopt, and regularly update other policies and
23 procedures the chief data officer deems necessary to evaluate
24 appropriate management and security of the agency's electronic data.
25 2. (1) Each state agency is responsible for identifying its various
26 types of electronic data, the location of such data, and the level of
27 security required for each type of data.
28 (2) Each state agency shall communicate the information
29 described in subdivision (1) of this subsection to the chief data officer
30 and shall provide updated information as necessary for the chief data
31 officer to evaluate the security of the agency's electronic data.
32 3. Each state agency shall cooperate with the chief data officer
33 in implementing this section. The chief data officer may provide
34 guidance to a state agency in fulfilling the functions described in this
35 section.
36 4. In the absence of a chief data officer, the commissioner of
37 administration, or his or her designee, may exercise the authority
38 granted in this section.
39 5. Nothing in this section shall be construed as:
40 (1) Waiving sovereign immunity against the state, any agency of
41 the state, or any officer or employee of the state; or
42 (2) Creating a cause of action against the state, any agency of the
43 state, or any officer or employee of the state.
44 6. The office of administration may promulgate rules to
45 implement the provisions of this section. Any rule or portion of a rule,
46 as that term is defined in section 536.010, that is created under the
47 authority delegated in this section shall become effective only if it
48 complies with and is subject to all of the provisions of chapter 536 and,
49 if applicable, section 536.028. This section and chapter 536 are
50 nonseverable and if any of the powers vested with the general assembly
51 pursuant to chapter 536 to review, to delay the effective date, or to
52 disapprove and annul a rule are subsequently held unconstitutional,
53 then the grant of rulemaking authority and any rule proposed or
54 adopted after August 28, 2020, shall be invalid and void.
T