HOUSE BILL NO. 4898

September 03, 2019, Introduced by Reps. Chirkun, Elder, Sowerby, Camilleri, Clemente, Cherry, Sneller, Sabo, Lasinski, Brixie, Brenda Carter, Liberati, Tate, Rabhi, Stone, Manoogian, Pohutsky, Kennedy, Shannon, Garza, Gay-Dagnogo, Hope, Hood, Hertel, Witwer, Garrett, Ellison, Warren, Whitsett, Wittenberg, Kuppa, Pagan, Guerra, Bolden, Neeley, Cambensy, Jones, Haadsma, Hoadley, Hammoud, Cynthia Johnson, Greig, Coleman, Anthony, Yancey and Robinson and referred to the Committee on Commerce and Tourism.

"The management and budget act,"

by amending section 287 (MCL 18.1287), as amended by 2001 PA 71.

the people of the state of michigan enact:

Sec. 287. (1) The department shall maintain a records management program to provide for the development, implementation, and coordination of standards, procedures, and techniques for forms management, and for the creation, retention, maintenance, preservation, and disposition of the records of this state. All records of this state are and shall remain the property of this state and shall be preserved, stored, transferred, destroyed, disposed of, and otherwise managed pursuant to this act and other applicable provisions of law.

(2) In managing the records of this state, the department shall do all of the following:

(a) Establish, implement, and maintain standards, procedures, and techniques of records management throughout state agencies.

(b) Provide education, training, and information programs to state agencies regarding each phase of records management.

(c) Promote the establishment of a vital records program in each state agency by assisting in identifying and preserving records considered to be critically essential to the continued operation of state government or necessary to the protection of the rights and privileges of its citizens, or both. Preservation of designated vital records shall be accomplished by storing duplicate copies of the original records in a secure remote records center to assure retention of those records in the event of disaster and loss of original records.

(d) Operate a records center or centers for the purpose of providing maintenance, security, and preservation of state records.

(e) Provide centralized microfilming service and, after the effective date of rules promulgated under the records media reproduction act, 1992 PA 116, MCL 24.401 to 24.403, 24.406, to govern optical storage, service for off-site storage of optical discs as an integral part of the records management program.

(f) Provide safeguards against unauthorized or unlawful disposal, removal, or loss of state records.

(g) Initiate action to recover a state record that may have been removed unlawfully or without authorization.

(h) Establish retention and disposal schedules for the official records of each state agency with consideration to their administrative, fiscal, legal, and archival value.

(3) The department shall issue directives that provide for all of the following:

(a) The security of records maintained by state agencies.

(b) The establishment of retention and disposal schedules for all records in view of their administrative, fiscal, legal, and archival value.

(c) The submission of proposed retention and disposal schedules to the department of history, arts, and libraries, the auditor general, the attorney general, and the board for review and approval.

(d) The transfer of records from a custodian state agency to a state records center or to the custody of the department of history, arts, and libraries.

(e) The disposal of records pursuant to retention and disposal schedules, or the transfer of records to the custody of the department of history, arts, and libraries.

(f) The establishment of a records management liaison officer in each department to assist in maintaining a records management program.

(g) The cooperation of other state departments in complying with this act.

(h) The storage of records in orderly filing systems designed to make records conveniently accessible for use.

(4) The director of the department shall issue directives to all state agencies to have a database security breach policy in effect not later than October 1, 2019. As part of the database security breach policy, the department shall ensure all the following if the department determines that a database security breach has occurred in a database operated or maintained by a state agency:

(a) Assist state residents in obtaining and preparing the appropriate documentation to restore their credit due to that database security breach.

(b) Subject to available funds, pay all necessary expenses in restoring the credit of a state resident due to that database security breach.

(c) Within 72 hours of a state agency's discovering a data security breach, provide notice to each house of representatives member and each senate member, who represents the person who suffered the data security breach.