House bill NO. 47

P2#yIS1 INTRODUCED BY J. Dooling

By Request of the Department of Administration

A BILL FOR AN ACT ENTITLED: "AN ACT GENERALLY REVISING THE MONTANA INFORMATION TECHNOLOGY ACT; REVISING TERMINOLOGY; PROVIDING THE DEPARTMENT OF ADMINISTRATION SOLE AUTHORITY TO TERMINATE AN AGENCY'S INFORMATION TECHNOLOGY RESOURCE AND REQUIRING THE USE OF AN ALTERNATIVE INFORMATION TECHNOLOGY RESOURCE; and AMENDING SECTIONS 2-4-302, 2-6-1102, 2-17-505, 2-17-506, 2-17-512, 2-17-513, 2-17-514, 2-17-515, 2-17-516, 2-17-521, 2-17-523, 2-17-524, 2-17-526, 2-17-532, 2-17-533, 2-17-534, 2-17-546, 2-17-551, 2-17-552, 2-17-1101, 2-17-1102, 2-17-1103, 2-18-101, 7-22-2151, 10-3-106, 61-3-346, 61-3-347, 61-11-105, 75-10-805, AND 87-1-272, MCA.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:

Section 1. Section 2-4-302, MCA, is amended to read:

"2-4-302. Notice, hearing, and submission of views. (1) (a) Prior to the adoption, amendment, or repeal of any rule, the agency shall give written notice of its proposed action. The proposal notice must include a statement of either the terms or substance of the intended action or a description of the subjects and issues involved, the reasonable necessity for the proposed action, and the time when, place where, and manner in which interested persons may present their views on the proposed action. The reasonable necessity must be written in plain, easily understood language.

(b) The agency shall state in the proposal notice the date on which and the manner in which contact was made with the primary sponsor as required in subsection (2)(e). If the notification to the primary sponsor was given by mail, the date stated in the proposal notice must be the date on which the notification was mailed by the agency. If the proposal notice fails to state the date on which and the manner in which the primary sponsor was contacted, the filing of the proposal notice under subsection (2)(a) is ineffective for the purposes of this part and for the purposes of the law that the agency cites in the proposal notice as the authority for the proposed action.

(c) If the agency proposes to adopt, increase, or decrease a monetary amount that a person shall pay or will receive, such as a fee, cost, or benefit, the notice must include an estimate, if known, of:

(i) the cumulative amount for all persons of the proposed increase, decrease, or new amount; and

(ii) the number of persons affected.

(2) (a) The proposal notice must be filed with the secretary of state for publication in the register, as provided in 2-4-312. When the agency files the proposal notice with the secretary of state to prepare it for publication in the register, the agency shall concurrently send an electronic copy of the proposal notice to the appropriate administrative rule review committee. If the secretary of state requires formatting changes to the proposal notice before it may be published, the agency is not required to send another copy of the proposal notice to the committee. The requirement to concurrently send a copy of the proposal notice to the committee is fulfilled if the agency sends an electronic copy to each member of the staff of the appropriate rule review committee on the same day that the notice is filed with the secretary of state.

(b) (i) Except as provided in subsection (2)(b)(ii), within 3 days of publication, a copy of the published proposal notice must be sent to interested persons who have made timely requests to the agency to be informed of its rulemaking proceedings, and to the office of any professional, trade, or industrial society or organization or member of those entities who has filed a request with the appropriate administrative rule review committee when the request has been forwarded to the agency as provided in subsection (2)(c).

(ii) In lieu of sending a copy of the published proposal notice to an interested person who has requested the notice, the agency may, with the consent of that person, send that person an electronic notification that the proposal notice is available on the agency's website and an electronic link to the part of the agency's website or a description of the means of locating that part of the agency's website where the notice is available.

(iii) Each agency shall create and maintain a list of interested persons and the subject or subjects in which each person on the list is interested. A person who submits a written comment or attends a hearing in regard to proposed agency action under this part must be informed of the list by the agency. An agency complies with this subsection (2)(b)(iii) if it includes in the proposal notice an advisement explaining how persons may be placed on the list of interested persons and if it complies with subsection (7).

(c) The appropriate administrative rule review committee shall forward a list of all organizations or persons who have submitted a request to be informed of agency actions to the agencies that the committee oversees that publish rulemaking notices in the register. The list must be amended by the agency upon request of any person requesting to be added to or deleted from the list.

(d) The proposal notice required by subsection (1) must be published at least 30 days in advance of the agency's proposed action. The agency shall post the proposal notice on a state electronic digital access system or other electronic communications system available to the public.

(e) (i) When an agency begins to work on the substantive content and the wording of a proposal notice for a rule that initially implements legislation, the agency shall contact, as provided in subsection (8), the legislator who was the primary sponsor of the legislation to:

(A) obtain the legislator's comments;

(B) inform the legislator of the known dates by which each step of the rulemaking process must be completed; and

(C) provide the legislator with information about the time periods during which the legislator may comment on the proposed rules, including the opportunity to provide comment to the appropriate administrative rule review committee.

(ii) If the legislation affected more than one program, the primary sponsor must be contacted pursuant to this subsection (2)(e) each time that a rule is being proposed to initially implement the legislation for a program.

(iii) Within 3 days after a proposal notice covered under subsection (2)(e)(i) has been published as required in subsection (2)(a), a copy of the published notice must be sent to the primary sponsor contacted under this subsection (2)(e).

(3) If a statute provides for a method of publication different from that provided in subsection (2), the affected agency shall comply with the statute in addition to the requirements contained in this section. However, the notice period may not be less than 30 days or more than 6 months.

(4) Prior to the adoption, amendment, or repeal of any rule, the agency shall afford interested persons at least 20 days' notice of a hearing and at least 28 days from the day of the original notice to submit data, views, or arguments, orally or in writing. If an amended or supplemental notice is filed, additional time may be allowed for oral or written submissions. In the case of substantive rules, the notice of proposed rulemaking must state that opportunity for oral hearing must be granted if requested by either 10% or 25, whichever is less, of the persons who will be directly affected by the proposed rule, by a governmental subdivision or agency, by the appropriate administrative rule review committee, or by an association having not less than 25 members who will be directly affected. If the proposed rulemaking involves matters of significant interest to the public, the agency shall schedule an oral hearing.

(5) An agency may continue a hearing date for cause. In the discretion of the agency, contested case procedures need not be followed in hearings held pursuant to this section. If a hearing is otherwise required by statute, nothing in this section alters that requirement.

(6) If an agency fails to publish a notice of adoption within the time required by 2-4-305(7) and the agency again proposes the same rule for adoption, amendment, or repeal, the proposal must be considered a new proposal for purposes of compliance with this chapter.

(7) At the commencement of a hearing on the intended action, the person designated by the agency to preside at the hearing shall:

(a) read aloud the "Notice of Function of Administrative Rule Review Committee" appearing in the register; and

(b) inform the persons at the hearing of the provisions of subsection (2)(b) and provide them an opportunity to place their names on the list.

(8) (a) For purposes of contacting primary sponsors under subsection (2)(e), a current or former legislator who wishes to receive notice shall keep the current or former legislator's name, address, e-mail address, and telephone number on file with the secretary of state. The secretary of state may also use legislator contact information provided by the legislative services division for the purposes of the register. The secretary of state shall update the contact information whenever the secretary of state receives corrected information from the legislator or the legislative services division. An agency proposing rules shall consult the register when providing sponsor contact.

(b) An agency has complied with the primary bill sponsor contact requirements of this section when the agency has attempted to reach the primary bill sponsor at the legislator's address, e-mail address, and telephone number on file with the secretary of state pursuant to subsection (8)(a). If the agency is able to contact the primary sponsor by using less than all of these three methods of contact, the other methods need not be used.

(9) This section applies to the department of labor and industry adopting a rule relating to a commercial drug formulary as provided in 39-71-704. This section does not apply to the automatic updating of department of labor and industry rules relating to commercial drug formularies as provided in 39-71-704."

Section 2. Section 2-6-1102, MCA, is amended to read:

"2-6-1102. Department of administration -- powers and duties. (1) To ensure compatibility with the information technology systems of state government and to promote adherence to records management principles and best practices, the department of administration, in consultation with the secretary of state, shall establish standards for technological compatibility for state agencies for records management equipment or systems used to electronically capture, store, or retrieve public records through computerized, optical, or other electronic methods.

(2) The department of administration, in consultation with the secretary of state, shall approve all acquisitions of executive branch agency records management equipment or systems used to electronically capture, store, or retrieve public records through computerized, optical, or other electronic methods to ensure compatibility with the standards developed under subsection (1).

(3) The department of administration is responsible for the management and operation of equipment, systems, facilities, and processes integral to the department's central computer center and statewide telecommunications system information technology resources and the state telecommunications network."

Section 3. Section 2-17-505, MCA, is amended to read:

"2-17-505. Policy. (1) It is the policy of the state that information technology be used to improve the quality of life of Montana citizens by providing educational opportunities, creating quality jobs and a favorable business climate, improving government, and protecting individual privacy and the privacy of the information contained within information technology systems resources.

(2) It is the policy of the state that the development of information technology resources in the state must be conducted in an organized, deliberative, and cost-effective manner.

(3) It is the policy of the state that information technology is essential and vital to the people of the state of Montana, and the services, systems, and infrastructure are therefore considered to be an asset of the state.

(4) It is the policy of the state that commercial off-the-shelf information technology resources be used whenever feasible, rather than the commissioning of custom solutions.

(4)(5) The following principles must guide the development of state information technology resources:

(a) There are statewide information technology policies, standards, procedures, and guidelines policies, framework, controls, standards, procedures, and guidelines applicable to all state agencies and other entities using the state network an information technology resource.

(b) Mitigation of risks is a priority in order to protect individual privacy and the privacy of information contained within information technology systems resources as they become more interconnected and as the liabilities stemming from the risk to information technology, also known as cyber risk, have increased.

(c) Whenever feasible and not an undue cyber risk, common data is entered once and shared among government entities at any level or political subdivision.

(d) Third-party providers of data, such as citizens, businesses, and other government entities, are responsible for the accuracy and integrity of the data provided to government entities.

(e) Third-party providers of information technology resources, such as infrastructure as a service, platform as a service, and software as a service, shall comply with state security and information technology policies, risk management framework, controls, standards, procedures, and guidelines when providing information technology resources to government entities.

(e)(f) Government entities are required to conduct business through open, transparent processes to ensure accountability to the citizenry, and information technology provides access to information through simple and expeditious procedures.

(f)(g) In order to minimize unwarranted duplication, shared or similar information technology systems resources and data management applications are must be implemented and managed in a coordinated manner.

(g)(h) Planning and development of information technology resources are conducted in conjunction with budget development and approval.

(h)(i) Information technology systems resources are deployed aggressively whenever it can be shown that it will provide improved services to Montana citizens.

(i)(j) Public-private partnerships are used to deploy information technology systems resources when practical and cost-effective.

(j)(k) State information technology systems Information technology resources are developed in cooperation with the federal government and local governments with the objective of providing seamless access to information and services to the greatest degree possible.

(k)(l) State information technology systems Information technology resources are able to accommodate electronic digital transmissions between the state and its citizens, businesses, and other government entities, including providing financial incentives for citizens and businesses to use electronic digital government services.

(l)(m) State information technology systems Information technology resources are able to embrace the economics of digitized records to avoid duplication and transport costs.

(m)(n) Electronic Digital record creation, management, storage, and retrieval processes and procedures are used to create and deliver professional records management experiences for the citizens of Montana.

(n)(o) State information technology systems Information technology resources are able to embrace continuous process improvement initiatives in order to keep pace with new and emerging technologies and delivery channels in order to allow citizens to determine when, where, and how they interact with government agencies.

(5)(6) It is the policy of the state that the department must be accountable to the governor, the legislature, and the citizens of Montana."

Section 4. Section 2-17-506, MCA, is amended to read:

"2-17-506. Definitions. In this part, unless the context requires otherwise, the following definitions apply:

(1) "Board" means the information technology board established in 2-15-1021.

(2) "Central computer center" means any stand-alone or shared computer and associated equipment, software, facilities, and services administered by the department for use by state agencies.

(2) "Chief data privacy officer" means a person appointed by the department to serve as chief data policy advisor to the director of the department on privacy protection issues, including the implementation of data privacy protections, compliance with federal laws, regulations, and policies relating to data privacy, management of data privacy risks at the department, and development and evaluation of legislative, regulatory, and other policy proposals.

(3)(3) "Chief information officer" means a person appointed by the director of the department to carry out the duties and responsibilities of the department relating to information technology.

(4) "Commercial off-the-shelf information technology resources" means commercially available information technology resources that are ready-made, are primarily configurable, and can be adapted after purchase to meet the needs of the state.

(4)(5) "Data" means any information stored on information technology resources.

(5)(6) "Department" means the department of administration established in 2-15-1001.

(7) "Digital" means electronic data and the information technology resources used to store, retrieve, and send data.

(6)(8) "Electronic Digital access system" means a system capable of making data accessible by means of an information technology facility in a voice, video, or electronic data form, including but not limited to the internet resource.

(7)(9) "Information technology resource" means any hardware, software, and associated services, and infrastructure including state and third-party platforms, networks, systems, or facilities, used to store or transmit information in any form, including voice, video, and electronic data.

(8)(10) "Long-range information technology capital project" means a discrete long-range information technology system or application, including the replacement or upgrade to existing systems.

(9)(11) "Private safety agency" has the same meaning as provided in 10-4-101.

(10)(12) "Public safety agency" has the same meaning as provided in 10-4-101.

(11)(13) "State agency" means any entity of the executive branch, including the university system.

(12)(14) "Statewide State telecommunications network" means any telecommunications facilities, circuits, equipment, software, and associated contracted services information technology resources administered by the department for the transmission of voice, video, or electronic data from one device to another."

Section 5. Section 2-17-512, MCA, is amended to read:

"2-17-512. Powers and duties of department. (1) The department is responsible for carrying out the planning and program responsibilities for information technology for state government, except the national guard. The department shall:

(a) encourage and foster the development use of new and innovative information technology within state government;

(b) promote, coordinate, and approve the procurement or development and sharing of shared information technology application software, management systems, and information that provide similar functions for multiple state agencies;

(c) cooperate with the office of economic development to promote economic development initiatives based on information technology;

(d) establish and enforce a state strategic information technology plan as provided for in 2-17-521;

(e) establish and enforce statewide information technology policies, framework, controls, and standards, procedures, and guidelines;

(f) review and approve state agency information technology plans provided for in 2-17-523;

(g) coordinate with the office of budget and program planning to evaluate budget requests that include information technology resources. The department shall make recommendations to the office of budget and program planning for the approval or disapproval of information technology budget requests, including an estimate of the useful life of the asset proposed for purchase and whether the amount should be expensed or capitalized, based on state accounting policy established by the department. An unfavorable recommendation must be based on a determination that the request is not provided for in the approved agency information technology plan provided for in 2-17-523.

(h) staff the information technology board provided for in 2-15-1021;

(i) fund the administrative costs of the information technology board provided for in 2-15-1021;

(j) review the use of information technology resources for all state agencies;

(k) review and approve state agency specifications and procurement methods for the acquisition of information technology resources;

(l) review, approve, and sign all state agency contracts and shall review and approve other formal agreements for information technology resources provided by the private sector and other government entities;

(m) broker, operate, and maintain a central computer center information technology resources for the use of state government, political subdivisions, and other participating entities under terms and conditions established by the department;

(n) operate and maintain a statewide state telecommunications network for the use of state government, political subdivisions, and other participating entities under terms and conditions established by the department;

(o) ensure that the statewide state telecommunications network is properly maintained. The department may establish a centralized maintenance program for the statewide state telecommunications network.

(p) coordinate public safety communications on behalf of public and private safety agencies as provided for in 2-17-543 through 2-17-545;

(q) manage the state 9-1-1 program as provided for in Title 10, chapter 4, part 3;

(r) provide electronic access to digital information and services of the state as provided for in 2-17-532;

(s) provide assistance to the legislature, the judiciary, the governor, and state agencies relative to state and interstate information technology matters;

(t) establish rates and other charges for services provided by the department;

(u) accept federal funds granted by congress or by executive order and gifts, grants, and donations for any purpose of this section;

(v) dispose of personal property owned by it in a manner provided by law when, in the judgment of the department, the disposal best promotes the purposes for which the department is established;

(w) implement this part and all other laws for the use of information technology in state government;

(x) provide a biennial report to the state administration and veterans' affairs interim committee and to the legislature as provided in 5-11-210 on the information technology activities of the department; and

(y) represent the state with public and private entities on matters of information technology.; and

(z) provide full oversight authority over all custom-developed code for all state agencies.

(2) If it is in the state's best interest, the department may contract with qualified private organizations, foundations, or individuals to carry out the purposes of this section.

(3) The director of the department shall appoint the chief information officer to assist in carrying out the department's information technology duties."

Section 6. Section 2-17-513, MCA, is amended to read:

"2-17-513. Duties of board. The board shall:

(1) provide a forum to:

(a) guide state agencies, the legislative branch, the judicial branch, and local governments in the development and deployment of intergovernmental information technology resources;

(b) share information among state agencies, local governments, and federal agencies regarding the development of information technology resources;

(2) advise the department:

(a) in the development of cooperative contracts for the purchase of information technology resources;

(b) regarding the creation, management, and administration of electronic digital government services and information on the internet;

(d) on the priority of government services to be provided electronically digitally;

(e) on convenience fees prescribed in 2-17-1102 and 2-17-1103, if needed, for electronic digital government services; and

(f) on any other aspect of providing electronic digital government services;

(3) review and advise the department on:

(a) statewide information technology standards and policies policies, framework, controls, standards, procedures, and guidelines;

(b) the state strategic information technology plan;

(d) rates and other charges for services established by the department as provided in 2-17-512(1)(t);

(e) requests for exceptions as provided for in 2-17-515;

(f) notification of proposed exemptions by the university system and office of public instruction as provided for in 2-17-516;

(g) action taken by the department as provided in 2-17-514(1) for any activity that is not in compliance with this part;

(h) the implementation of major information technology projects and advise the respective governing authority of any issue of concern to the board relating to implementation of the project; and

(i) financial reports, management reports, and other data as requested by the department;

(4) study state government's present and future information technology needs and advise the department on the use of emerging technology in state government;

(5) request information and reports that it considers necessary from any entity using or having access to the statewide state telecommunications network or central computer center information technology resources;

(6) assist in identifying, evaluating, and prioritizing potential departmental and interagency electronic digital government services;

(7) serve as a central coordination point for electronic digital government services provided by the department and other state agencies;

(8) study, propose, develop, or coordinate any other activity in furtherance of electronic digital government services as requested by the governor or the legislature; and

(9) prepare and submit to the state administration and veterans' affairs interim committee in accordance with 5-11-210 a report including but not necessarily limited to a summary of the board's activities, a review of the electronic government program established under part 11 of this chapter, and any key findings and recommendations that the board presented to the department."

Section 7. Section 2-17-514, MCA, is amended to read:

"2-17-514. Department -- enforcement responsibilities. (1) If the department determines that an agency is not in compliance with the state strategic information technology plan provided for in 2-17-521, the agency information technology plan provided for in 2-17-523, or the statewide information technology policies, framework, controls, and standards, procedures, and guidelines provided for in 2-17-505 and 2-17-512, the department may cancel or modify any contract, project, or activity that is not in compliance.

(2) Prior to taking action provided for in subsection (1), the department shall review with the board any activities that are not in compliance.

(2) If the department determines that an agency is not in compliance with the state security policies, framework, controls, standards, procedures, and guidelines provided for in 2-17-534, the department may take appropriate action, in its sole discretion, up to and including terminating the information technology resource and requiring the use of an alternative information technology resource.

(3) Any contract entered into by an agency that includes information technology resources must include language developed by the department that references the department's enforcement responsibilities provided for in subsection (1). A contract that does not contain the required language is considered to be in violation of state law and is voidable pursuant to subsection (1). The language developed by the department may not be varied pursuant to 18-4-224."

Section 8. Section 2-17-515, MCA, is amended to read:

"2-17-515. Granting exceptions to state agencies. Subject to 2-17-516, the department may grant exceptions to any policy, standard, or other requirement of this part if it is in the best interests of the state of Montana. The department shall inform the board governor, the office of budget and program planning, and the legislative finance committee of all exceptions that are granted and of the rationale for granting the exceptions. The department shall maintain written documentation that identifies the terms and conditions of the exception and the rationale for the exception. If an exception is granted, the department shall provide the written documentation in accordance with 5-11-210."

Section 9. Section 2-17-516, MCA, is amended to read:

"2-17-516. Exemptions -- department of justice -- secretary of state -- university system -- state auditor -- office of public instruction -- national guard. (1) Unless the proposed activities would detrimentally affect the operation of the central computer center or the statewide any information technology resource or the state telecommunications network, the office of public instruction, the office of the state auditor, and the secretary of state are exempt from 2-17-512(1)(k) and (1)(l).

(2) Unless the proposed activities would detrimentally affect the operation of the central computer center or the statewide any information technology resource or the state telecommunications network, the department of justice and the university system are exempt from:

(a) the enforcement provisions of 2-17-512(1)(d) and (1)(e) and 2-17-514;

(b) the approval provisions of 2-17-512(1)(f), 2-17-523, and 2-17-527;

(d) the provisions of 2-17-512(1)(k) and (1)(l).

(3) The department, upon notification of proposed activities by the The department of justice, the secretary of state, the university system, or the office of the state auditor, and the office of public instruction, shall notify the department of proposed activities by using the department's approved process, and the department shall determine if the central computer center or the statewide any information technology resource or the state telecommunications network would be detrimentally affected by the proposed activity.

(4) (a) For purposes of this section, a proposed activity affects the operation of the central computer center or the statewide any information technology resource or the state telecommunications network if it detrimentally affects the processing workload, reliability, cost of providing service, or support service requirements of the central computer center or the statewide any information technology resource or the state telecommunications network or fails to meet the minimum security policies and standards set by the department.

(b) Potential loss of revenue from fees paid by the department of justice, the secretary of state, the university system, the office of the state auditor, or the office of public instruction for not utilizing services offered by the department are not considered a detrimental effect to the statewide telecommunications network or central computer center any information technology resource or the state telecommunications network. If the department of justice, the secretary of state, the university system, the office of the state auditor, or the office of public instruction does not utilize a service program after the department's rate was set for the biennium, the agency shall continue to pay any fees associated with the service or program for the remainder of the biennium.

(5) When reviewing proposed activities of the university system, the department shall consider and make reasonable allowances for the unique educational needs and characteristics and the welfare of the university system as determined by the board of regents.

(6) When reviewing proposed activities of the office of public instruction, the department shall consider and make reasonable allowances for the unique educational needs and characteristics of the office of public instruction to communicate and share data with school districts.

(7) When reviewing proposed activities of the department of justice or the office of the state auditor, the department shall consider and make reasonable allowances for the unique safety and security needs and characteristics of the department of justice or the office of the state auditor to communicate and share data with federal, state, and local law enforcement entities.

(8) Section 2-17-512(1)(u) may not be construed to prohibit the university system from accepting federal funds or gifts, grants, or donations related to information technology or telecommunications.

(9) The national guard, as defined in 10-1-101(3), is exempt from 2-17-512."

Section 10. Section 2-17-521, MCA, is amended to read:

"2-17-521. State strategic information technology plan -- biennial report. (1) The department shall prepare a state strategic information technology plan. The department shall seek the advice of the board in the development of the plan.

(2) The plan must:

(a) reflect the policies as set forth in 2-17-505 and 2-17-512 and be in accordance with statewide standards and policies, framework, controls, standards, procedures, and guidelines established by the department;

(b) establish the statewide mission, goals, and objectives for the use of information technology, including goals for electronic access to government records, information, and services; and

(c) establish the strategic direction for how state agencies will develop and use information technology resources to provide state government services.

(3) The department shall update the plan as necessary. The plan and any updates must be distributed as provided in 2-17-522.

(4) The department shall prepare a biennial report on information technology based on agency information technology plans and performance reports required under 2-17-524 and other information considered appropriate by the department. The biennial report must include:

(a) an analysis of the state's information technology infrastructure, including its value, condition, and capacity;

(b) an evaluation of performance relating to information technology;

(d) an inventory of state information services, equipment, and proprietary software information technology resources;

(e) agency budget requests for major projects; and

(f) other information as determined by the department or requested by the governor or the legislature."

Section 11. Section 2-17-523, MCA, is amended to read:

"2-17-523. Agency information technology plans -- policy. (1) Each state agency is required to develop and maintain an agency information technology plan. The agency information technology plans must reflect the content and format requirements specified in 2-17-524.

(2) An agency information technology plan must be submitted to and approved by the department as described in 2-17-527.

(3) New investments in information technology resources can be included in the governor's budget only if the project is contained in the approved technology is in the agency information technology plan and is in support of the state information technology strategic plan."

Section 12. Section 2-17-524, MCA, is amended to read:

"2-17-524. Agency information technology plans -- form and content -- performance reports. (1) Each agency's information technology plan must include but is not limited to the following:

(a) a statement of the agency's mission, goals, and objectives for information technology, including a discussion of how the agency uses or plans to use information technology to provide mission-critical services to Montana citizens and businesses;

(b) an explanation of how the agency's mission, goals, and objectives for information technology support and conform to the state strategic information technology plan required in 2-17-521;

(i) includes sufficient information to fully support state-level review and approval activities; and

(ii) will serve as the basis for subsequent planning and performance measures;

(d) an evaluation of the baseline profile that identifies real or potential deficiencies or obsolescence of the agency's information technology resources and capabilities;

(e) a list of new projects technology strategies and resources required to meet the objectives of the agency's information technology plan. The investment required for the new projects and resources must be developed using life-cycle cost analysis, including the initial investment, maintenance, and replacement costs, and must fulfill or support an agency's business requirements.

(f) when feasible, estimated schedules and funding required to implement identified projects; and

(g) any other information required by law or requested by the department, the governor, or the legislature.

(2) Each agency's information technology plan must project activities and costs over a 6-year time period, consisting of the biennium during which the plan is written or updated and the 2 subsequent bienniums.

(3) Each agency shall prepare and submit to the department a biennial performance report that evaluates progress toward the objectives articulated in its information technology plan. The report must include:

(a) an evaluation of the agency's performance relating to information technology;

(b) an assessment of progress made toward implementing the agency information technology plan; and

(4) State agencies shall prepare agency information technology plans and biennial performance reports using standards, elements, forms, and formats specified by the department."

Section 13. Section 2-17-526, MCA, is amended to read:

"2-17-526. Information technology project budget summary. (1) (a) The office of budget and program planning, in cooperation with the department, shall prepare a statewide summary of:

(i) proposed major new information technology projects strategic objectives contained in the state budget; and

(ii) proposed major information technology projects purchases or implementation impacting another state agency or branch of government to be funded within the current operating budgets, including replacement of or upgrade to existing systems.

(b) The office of budget and program planning and the department shall jointly determine the criteria for classifying a project as a major information technology project.

(2) The information technology project strategic objective summary must include:

(a) a listing by institution, agency, or branch of all proposed major information technology projects purchases or implementations described in subsection (1). Each proposed project purchase or implementation included on the list must include:

(i) a description of what would be accomplished by completing the project purchase or implementation;

(ii) a list of the existing information technology applications for all branches of government that may be impacted by the project purchase or implementation;

(iii) an estimate, prepared in consultation with the impacted agencies, of the costs and resource impacts on existing information technology applications;

(iv) the estimated cost of the project purchase or implementation;

(v) the source for funding the project purchase or implementation, including funds within an existing operating budget or a new budget request; and

(vi) the estimated cost of operating information technology systems resources.

(b) a listing of internal service rates proposed for providing information technology services. Each internal service rate included on the list must include:

(i) a description of the services provided; and

(ii) a breakdown, aggregated by fund type, of requests included in the state budget to support the rate.

(c) any other information as determined by the budget director or the department or as requested by the governor or the legislature.

(3) The information technology project summary must be presented to the legislative fiscal analyst in accordance with 17-7-111(4)."

Section 14. Section 2-17-532, MCA, is amended to read:

"2-17-532. Establishment. (1) The department shall establish and maintain appropriate electronic access systems information technology resources for state agencies to use to provide direct electronic for use in access to information and services by citizens, businesses, and other government entities. State agencies shall establish electronic digital access systems that meet minimum technical standards established by the department. Agencies involved in communicating information or providing services to the public shall use these systems to provide appropriate information to the public, including but not limited to:

(a) descriptions of agency functions, including contact information;

(b) agency program services provided to citizens, businesses, and other government entities;

(d) rulemaking notices;

(e) board vacancy notices as required by 2-15-201;

(f) agency reports mandated by statute;

(g) parks reports required by 23-1-110;

(h) requests for bids or proposals; and

(i) public meeting notices and agendas.

(2) The purpose of electronic digital access systems is to encourage the practice of providing for direct citizen, business, and other government entity access to state computerized information and services information technology resources."

Section 15. Section 2-17-533, MCA, is amended to read:

"2-17-533. Responsibilities. (1) The department shall:

(a) establish policies, framework, controls, standards, and procedures, and guidelines for the electronic digital access systems;

(b) establish appropriate services to support state agencies' use of the electronic digital access systems; and

(c) develop user-friendly systems for entities regularly interacting with state government, including but not limited to citizens, businesses, and other government entities, and promote the systems' use to reduce copying and mailing costs for state government and as a means to obtain information and services faster and in a more cost-effective manner.

(2) The department shall provide security to protect the integrity of its electronic digital access systems.

(3) Each department is responsible for ensuring the integrity and appropriateness of the information that it places in the electronic digital access systems.

(4) The department shall provide for an equitable method for recovering the cost of operating the electronic digital access systems that the department provides."

Section 16. Section 2-17-534, MCA, is amended to read:

"2-17-534. Security responsibilities of department. The department is responsible for providing centralized management and coordination of state policies for security of data and information technology resources and shall:

(1) establish and maintain the minimum security standards and policies, framework, controls, standards, procedures, and guidelines to implement 2-15-114, including the physical security of the central computer center, statewide telecommunications network, and backup facilities consistent with these standards information technology resources and the state telecommunications network;

(2) establish guidelines to assist agencies in identifying information technology personnel occupying positions of special trust or responsibility or sensitive locations;

(3) establish standards and policies for the exchange of data between any agency information technology resource and any other state agency, private entity, or public entity to ensure that exchanges do not jeopardize data security and confidentiality;

(4) coordinate and provide for a training program regarding security of data and information technology resources to serve governmental technical and managerial needs;

(5) include appropriate security requirements in the specifications for solicitation of state contracts for procuring data and information technology resources; and

(6) upon on request, provide technical and managerial assistance relating to information technology security."

Section 17. Section 2-17-546, MCA, is amended to read:

"2-17-546. Exemption of criminal justice information network -- exception. The provisions of this part do not apply to the criminal justice information network or its successor except for the provisions dealing with the purchase, maintenance, and allocation of telecommunication facilities service delivery. However, the department of justice shall cooperate with the department to coordinate the telecommunications networks services of the state."

Section 18. Section 2-17-551, MCA, is amended to read:

"2-17-551. Definitions. As used in 2-17-550 through 2-17-553, the following definitions apply:

(1) "Collect" means the gathering of personally identifiable information about a user of an internet service, online service, or website by or on behalf of the provider or operator of that service or website by any means, direct or indirect, active or passive, including:

(a) an online request for the information by the provider or operator, regardless of how the information is transmitted to the provider or operator;

(b) the use of an online service to gather the information; or

(2) "Governmental entity" means the state and political subdivisions of the state.

(3) "Government website operator" or "operator" means a governmental entity that operates a website located on the internet or an online service and or social media presence or uses any digital means of providing digital services that collects or maintains personal information from or about the users of or visitors to the website or online service or on whose behalf information is collected or maintained.

(4) "Internet" means, collectively, the myriad of computer and telecommunications facilities, including equipment and operating software, that comprise the interconnected worldwide network of networks that use the transmission control protocol/internet protocol or any predecessor or successor protocols to communicate information of all kinds by wire or radio.

(5) "Online" means any activity regulated by 2-17-550 through 2-17-553 that is effected by active or passive use of an internet connection, regardless of the medium by or through which the connection is established.

(6) "Personally identifiable information" means individually identifiable information about an individual collected online, including:

(a) a first and last name;

(b) a residence or other physical address, including a street name and name of a city or town;

(d) a telephone number;

(e) a social security number; or

(f) unique identifying information that an internet service provider or a government website operator collects and combines with any information described in subsections (6)(a) through (6)(e).

(7) "Political subdivision" means any county, city, municipal corporation, school district, or other political subdivision or public corporation.

(8) "State" means the state of Montana or any office, department, agency, authority, commission, board, institution, hospital, college, university, or other instrumentality of the state."

Section 19. Section 2-17-552, MCA, is amended to read:

"2-17-552. Collection of personally identifiable information -- requirements. (1) A government website operator may not collect personally identifiable information online from a website user unless the operator complies with the provisions of this section.

(2) (a) A government website operator shall ensure that the website the information delivery system or platform:

(a)(i) identifies who operates the website system;

(b)(ii) provides the address and telephone number at which the operator may be contacted as well as an electronic both physical and electronic means for contacting the operator; and

(c)(iii) generally describes the operator's information practices, including policies to protect the privacy of the user and the steps taken to protect the security of the collected information.; and

(b) If the department determines that an agency is not in compliance with the state security policies, framework, controls, standards, procedures, and guidelines provided for in 2-17-534, the department may take appropriate action, in its sole discretion, up to and including terminating the information technology resource and requiring the use of an alternative information technology resource.

(3) In addition to the requirements of subsection (2)(a), if the personally identifiable information may be used for a purpose other than the express purpose of the website for the collection or may be given or sold to a third party, except as required by law, then the operator shall ensure that the website information technology resource includes:

(a) a clear and conspicuous notice to the user that the information collected could be used for other than the purposes of the website collection;

(b) a general description of the types of third parties that may obtain the information; and

(c) a clear, conspicuous, and easily understood online procedure requiring an affirmative expression of the user's permission before the information is collected."

Section 20. Section 2-17-1101, MCA, is amended to read:

"2-17-1101. Short title. This part may be cited as the "Montana Electronic Digital Government Services Act"."

Section 21. Section 2-17-1102, MCA, is amended to read:

"2-17-1102. Definitions. As used in this part, unless the context requires otherwise, the following definitions apply:

(1) "Convenience fee" means a fee charged to recover the costs of providing electronic digital government services.

(2) "Costs" means the overall costs that the department may incur to provide electronic digital government services, including the costs of contracts entered into with private entities to assist in providing electronic digital government services.

(3) "Department" means the department of administration provided for in 2-15-1001.

(4) "Infrastructure" means the underlying technology necessary to provide electronic digital government services."

Section 22. Section 2-17-1103, MCA, is amended to read:

"2-17-1103. Responsibilities of department for electronic digital government. (1) The department shall:

(a) provide the ability for state agencies to offer electronic digital government services by providing a reasonable and secure infrastructure;

(b) provide a point of entry for electronic digital government services to achieve a single face of government;

(c) encourage a common look and feel for all electronic digital government services for the benefit of the customers of the services;

(d) set technological standards for electronic digital government services;

(e) use technology that enables the greatest number of customers to obtain access to electronic digital government services;

(f) promote the benefits of electronic digital government services through educational, marketing, and outreach initiatives;

(g) promote transparency in information management; and

(h) share and coordinate information with political subdivisions whenever possible.

(2) To fulfill the responsibilities in subsection (1), the department may contract with private entities. The department may charge convenience fees and may allow private entities to collect the convenience fees on selected electronic digital government services in order to provide funding for the support and furtherance of electronic digital government services.

(3) The department or a private entity under a contract as provided in subsection (2) may not use any data associated with providing electronic digital government services for any purpose that is not provided for by law."

Section 23. Section 2-18-101, MCA, is amended to read:

"2-18-101. Definitions. As used in parts 1 through 3 and part 10 of this chapter, the following definitions apply:

(1) "Agency" means a department, board, commission, office, bureau, institution, or unit of state government recognized in the state budget.

(2) "Base salary" means the base hourly pay rate annualized paid to an employee, excluding overtime and longevity.

(3) "Benchmark" means a representative position in a specific occupation that is used to illustrate the application of the job evaluation factor used to classify the occupation.

(4) "Blue-collar pay plan" means a strictly negotiated classification and pay plan consisting of unskilled or skilled labor, trades, and crafts occupations.

(5) "Board" means the board of personnel appeals established in 2-15-1705.

(6) "Broadband classification plan" means a job evaluation method that measures the difficulty of the work and the knowledge or skills required to perform the work.

(7) "Broadband pay plan" means a pay plan using a pay hierarchy of broad pay bands based on a classification plan, including market midpoint and occupational wage ranges.

(8) "Compensation" means the annual or hourly wage or salary and includes the longevity allowance provided in 2-18-304 and leave and holiday benefits provided in part 6 of this chapter.

(9) "Competencies" means sets of measurable and observable knowledge, skills, and behaviors that contribute to success in a position.

(10) "Department" means the department of administration created in 2-15-1001.

(11) (a) Except in 2-18-306, "employee" means any state employee other than an employee excepted under 2-18-103 or 2-18-104.

(b) The term does not include a student intern.

(12) "Job evaluation factor" means a measure of the complexities of the predominant duties of a position.

(13) "Job sharing" means the sharing by two or more persons of a position.

(14) "Market midpoint" means the median base salary that other employers pay to employees in comparable occupations as determined by the department's salary survey of the relevant labor market.

(15) "Occupation" means a generalized family of positions having substantially similar duties and requiring similar qualifications, education, and experience.

(16) "Occupational wage range" means a range of pay, including a minimum, market midpoint, and maximum salary, for a specific occupation that is most consistent with the pay being offered by competing employers for fully competent employees within that occupation. The salary for an employee may be less than the minimum salary.

(17) "Pay band" means a wide salary range covering a number of different occupations. Pay bands are used for reporting and analysis purposes only.

(18) "Pay progression" means a process by which an employee's compensation may be increased, based on documented factors determined by the department, to bring the employee's compensation to a higher rate within the occupational wage range of the employee.

(19) "Permanent employee" means an employee who is designated by an agency as permanent, who was hired through a competitive selection process unless excepted from the competitive process by law, and who has attained or is eligible to attain permanent status.

(20) "Permanent status" means the state an employee attains after satisfactorily completing an appropriate probationary period.

(21) "Personal staff" means those positions occupied by employees appointed by the elected officials enumerated in Article VI, section 1, of the Montana constitution or by the public service commission as a whole.

(22) "Position" means a collection of duties and responsibilities currently assigned or delegated by competent authority, requiring the full-time, part-time, or intermittent employment of one person.

(23) "Program" means a combination of planned efforts to provide a service.

(24) "Seasonal employee" means a permanent employee who is designated by an agency as seasonal, who performs duties interrupted by the seasons, and who may be recalled without the loss of rights or benefits accrued during the preceding season.

(25) "Short-term worker" means a person who:

(a) may be hired by an agency without using a competitive hiring process for an hourly wage established by the agency;

(b) may not work for the agency for more than 90 days in a continuous 12-month period;

(d) may not be hired into a permanent position by the agency without a competitive selection process;

(e) is not eligible to earn the leave and holiday benefits provided in part 6 of this chapter; and

(f) may be discharged without cause.

(26) "Student intern" means a person who:

(a) has been accepted in or is currently enrolled in an accredited school, college, or university and may be hired by an agency in a student intern position without using a competitive selection process;

(b) is not eligible for permanent status;

(d) must be covered by the hiring agency's workers' compensation insurance;

(e) is not eligible to earn the leave and holiday benefits provided for in part 6 of this chapter; and

(f) may be discharged without cause.

(27) (a) "Telework" means a flexible work arrangement where in which a designated employee may work from:

(i) home within the state of Montana or an alternative worksite within the state of Montana 1 or more days a week instead of physically traveling to a central workplace; or

(ii) an alternative worksite outside the state of Montana limited to:

(A) employees who are mental health professionals as defined in 27-1-1101 involved in psychological or psychiatric evaluations and treatment;

(B) employees engaged in providing services related to information technology resources as defined in 2-17-506;

(D) employees who are engaged in providing services related to economic development outside the state and whose work duties require the employees to reside out of state.

(b) The office of budget and program planning must approve a designated employee's alternative worksite outside the state of Montana before the employee begins work.

(28) "Temporary employee" means an employee who:

(a) is designated as temporary by an agency for a definite period of time not to exceed 12 months;

(b) performs duties on a temporary basis;

(d) is terminated at the end of the employment period; and

(e) is not eligible to become a permanent employee without a competitive selection process."

Section 24. Section 7-22-2151, MCA, is amended to read:

"7-22-2151. Cooperative agreements. (1) A state agency that controls land within a district, including the department of transportation; the department of fish, wildlife, and parks; the department of corrections; the department of natural resources and conservation; and the university system, shall enter into a written agreement with the board. The agreement must specify mutual responsibilities for integrated noxious weed management on state-owned or state-controlled land within the district. The agreement must include the following:

(a) an integrated noxious weed management plan, which must be updated biennially;

(b) a noxious weed management goals statement;

(d) a provision requiring a biennial performance report by the board to the state weed coordinator in the department of agriculture, on a form to be provided by the state weed coordinator, regarding the success of the plan.

(2) The board and the governing body of each incorporated municipality within the district shall enter into a written agreement and shall cooperatively plan for the management of noxious weeds within the boundaries of the municipality. The board may implement management procedures described in the plan within the boundaries of the municipality for noxious weeds only. Control of nuisance weeds within the municipality remains the responsibility of the governing body of the municipality, as specified in 7-22-4101.

(3) A board may develop and carry out its noxious weed management program in cooperation with boards of other districts, with state and federal governments and their agencies, or with any person within the district. The board may enter into cooperative agreements with any of these parties.

(4) Each agency or entity listed in subsection (1) shall submit a statement or summary of all noxious weed actions that are subject to the agreement required under subsection (1) to the state weed coordinator and shall post a copy of the statement or summary on a state electronic digital access system."

Section 25. Section 10-3-106, MCA, is amended to read:

"10-3-106. Communications. (1) The division shall coordinate whatever means exist for rapid and efficient communications in time of emergency or disaster.

(2) The division shall, in cooperation with the department of administration, consider the desirability of supplementing communications resources or of integrating them into a comprehensive state or state-federal telecommunications or other communications system or network.

(3) The division shall, in cooperation with the department of administration and local political subdivisions, evaluate the possibility of multipurpose use of communications systems or networks for general state and local governmental purposes.

(4) The division shall assist political subdivisions in the orderly development of telecommunications systems complementary to the statewide state telecommunications network."

Section 26. Section 61-3-346, MCA, is amended to read:

"61-3-346. County motor vehicle computer committee. (1) There is a county motor vehicle computer committee.

(2) The committee is allocated to the department of justice for administrative purposes only as provided in 2-15-121.

(3) The committee consists of:

(a) an employee of the department of administration, appointed by the director of the department justice information technology division, appointed by the attorney general;

(b) two county treasurers, appointed by the Montana county treasurers association; and

Section 27. Section 61-3-347, MCA, is amended to read:

"61-3-347. Duties of county motor vehicle computer committee. (1) The county motor vehicle computer committee shall:

(a) establish the requirements and specifications for the county motor vehicle computer system to be used by county treasurers and the department of justice to register and renew the registration of motor vehicles, boats, snowmobiles, and off-highway vehicles;

(b) approve the purchase of computer equipment, including peripherals, to be used for the registration and renewal of the registration of motor vehicles, boats, snowmobiles, and off-highway vehicles;

(c) approve the procedures for the development of the county motor vehicle computer system provided for in 61-3-345 and for training in the use of that system.

(2) As used in this section, "computer system" means the county motor vehicle application system and does not include the central computer centers or imply that the department of administration is responsible for establishing policy and operating and maintaining central computer centers the county motor vehicle computer system."

Section 28. Section 61-11-105, MCA, is amended to read:

"61-11-105. Release of information -- fees. (1) Subject to the limitations of this section, the department shall, upon request, furnish a person the individual Montana driving record of a driver or licensee, containing the following data:

(a) the driver's or licensee's name, driver's license number, and date of birth;

(b) driver's license status, including the license type and any endorsements, the license issue date, license restrictions, any suspensions, revocations, or cancellations that have been imposed against the driver or licensee, and the license expiration date;

(d) traffic accidents in which the driver or licensee was involved.

(2) The department may not enter into any agreement to disclose or sell, in bulk, any data contained in an individual Montana driving record unless the requester of the information provides the department with the names, driver's license numbers, and dates of birth of the drivers or licensees from whose records a change in license status or conviction activity is to be reported.

(3) (a) The department may not disclose personal information or highly restricted personal information from an individual Montana driving record, except as permitted or required under 61-11-507, 61-11-508, or 61-11-509.

(b) The department may not disclose medical certification status, driver self-certification status, or medical certificate information from a CDLIS driver record as part of an individual Montana driving record except as expressly authorized under 49 CFR 384.225.

(4) Information relating to a traffic accident that did not involve a conviction, as defined in 61-11-203, may not be released by the department unless the release is requested or approved by a party involved in the accident or is required by court order or a duly executed subpoena.

(5) (a) Subject to the requirements of subsection (6) and except as provided in subsection (5)(b), a fee of $4 must be paid for each individual Montana driving record requested. A fee of $10 must be paid if a certified Montana record, as provided in 61-11-102(7), is requested. A fee of 6 cents must be paid for each individual Montana driving record that is searched by the department to report to a requester a change in license status or conviction activity from one or more individual Montana driving records.

(b) An individual Montana driving record must be provided without charge to any criminal justice agency, as defined in 44-5-103, or other state or federal agency.

(6) In addition to the fees required in 61-11-510(3) and subsection (5) of this section, an individual Montana driving record or any report compiled from one or more individual Montana driving records that are electronically digitally transmitted to a requester by an authorized agent as provided in 61-3-116 or through a point of entry for electronic digital government services are subject to the convenience fee provided for in 2-17-1103 or 61-3-116.

(7) The department may require a requester, other than a federal, state, or local government agency, seeking one or more individual Montana driving records or any data otherwise contained in one or more individual Montana driving records in electronic digital format to use an authorized agent as provided in 61-3-116 or a point of entry for electronic digital government services to obtain the record or data."

Section 29. Section 75-10-805, MCA, is amended to read:

"75-10-805. State government waste reduction and recycling program. (1) In order to progress toward achieving the waste reduction targets identified in 75-10-803, each state agency, the legislature, and the university system shall:

(a) prepare a waste reduction and recycling plan to reduce the solid waste generated by state government. This plan must be submitted to the department and must include, at a minimum, provisions for the composting of yard wastes and the recycling of office and computer paper, cardboard, used motor oil, used oil filters, and other materials produced by the state for which recycling markets exist or may be developed.

(b) establish and implement a waste reduction and recycling program; and

(i) the use of electronic digital access systems;

(ii) the transfer of information in electronic rather than paper form; and

(iii) other applications of computer technology.

(2) The plan must be evaluated every 5 years and updated as necessary."

Section 30. Section 87-1-272, MCA, is amended to read:

"87-1-272. Future fisheries improvement program -- funding priority -- reports required. (1) In order to enhance future fisheries through natural reproduction, the department shall establish and implement a statewide voluntary program that promotes fishery habitats and spawning areas for the rivers, streams, and lakes of Montana's fisheries.

(2) When projects are suggested by the future fisheries review panel, the department shall, through a public hearing process and with the approval of the commission, prioritize projects that have been recommended by the review panel to be funded. Emphasis must be given to projects that enhance the historic habitat of native fish species. The department shall fund and implement the program regarding the long-term enhancement of streams and streambanks, instream flows, water leasing, lease or purchase of stored water, and other voluntary programs that deal with wild fish and aquatic habitats. A project conducted under the future fisheries improvement program may not restrict or interfere with the exercise of any water rights or property rights of the owners of streambeds and property adjacent to streambeds, streambanks, and lakes. The fact that a program project has been completed on private property does not create any right of public access to the private property unless that right is granted voluntarily by the property owner.

(3) The department shall work in cooperation with private landowners, conservation districts, irrigation districts, local officials, anglers, and other citizens to implement the future fisheries improvement program. Any department employee who is employed under this section to facilitate contact with landowners must have experience in commercial or irrigated agriculture. The department shall encourage the use of volunteer labor and grants, matching grants, and private donations to accomplish program purposes. The department may use contracted services:

(a) for negotiations with landowners, local officials, citizens, and others;

(b) for coordination with other agencies that may be involved in projects conducted under this section; and

(4) Funds expended under this section may be used only for projects for the protection of the fisheries resource that have been identified by the review panel established in 87-1-273 and approved by the commission and may not be used for the acquisition of any interest in land.

(5) (a) The department shall report to the commission on the progress of the future fisheries improvement program every 12 months and post a copy of the report on a state electronic digital access system to ensure public access to the report.

(b) The department shall also present a detailed report to the legislature in accordance with 5-11-210 on the progress of the future fisheries improvement program. The legislative report must include the department's program activities and expenses since the last report and the project schedules and anticipated expenses for the ensuing 10 years' implementation of the future fisheries improvement program.

(c) In order to implement 87-1-273 and this section, the department may expend revenue from the future fisheries improvement program for up to two additional full-time employees."