Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
Data privacy reporting tightened; ombudsman role narrowed and ADA suit rules amended
Summary
League presenters summarized data privacy amendments requiring municipal privacy reports (retained five years), delayed contract clause implementation to 2027, new breach‑notification triggers, and changes narrowing the ombudsman role to mediation and requiring CAO review before referral; SB68 curbs abusive ADA website suits by requiring 90‑day cure notices.
Presenters described several session actions affecting municipal data handling, privacy complaints and litigation exposure.
Jared said cities must continue developing privacy reports and now must submit them annually (deadline moved to Dec. 1 or Dec. 31 in the bill presentation) to the Office of Data Privacy and retain reports for five years. A prior proposal to require contractors to adopt the same privacy obligations in contracts was delayed to July 1, 2027 to allow more negotiation and to account for sole‑source vendors who may not accept contractual equivalents.
New breach notifications were added with emphasis on unauthorized or security‑based incidents rather than inadvertent staff errors, and the Legislature directed a transparency study on law‑enforcement related high‑risk technology (biometrics, license plate readers) to report to the interim committee on government operations by Nov. 2027.
Jared said ombudsman authority was narrowed: the ombudsman may mediate complaints but cannot expand into records auditing or privacy‑auditor roles; data‑privacy complaints must first be routed to the municipality’s chief administrative officer (CAO) for review and resolution before being sent to the ombudsman.
Carson described SB68 as limiting abusive ADA website litigation: a suit is presumed abusive unless the filer provided 90 days to cure and municipalities found the claim abusive may recover attorney fees, costs and sanctions. Presenters characterized SB68 as intended to deter serial, money‑driven ADA suits while preserving the ability to remedy genuine accessibility problems.
Next steps: municipalities should track Office of Data Privacy rulemaking, involve law enforcement in transparency study conversations, inventory contracts for potential future clause requirements, and ensure CAO processes are prepared to receive and attempt early resolution of privacy complaints.
