RD42 - Report of the Joint Commission on Technology and Science

Executive Summary:
Created by the 1997 General Assembly through House Bill 2138, JCOTS is a permanent legislative commission charged to study all aspects of technology and science, to promote the development of technology and science in the Commonwealth of Virginia through sound public policies, and to report its findings annually to the Governor and the General Assembly (See Chapter 11 of Title 30 of the Code of Virginia, § 30-85 et seq.). JCOTS, which consists of twelve legislators (seven Delegates and five Senators), submits its seventh report today.

JCOTS’ 2003-2004 work plan identified four issues for study through the establishment and work of advisory committees, co-chaired by JCOTS members: Consumer Protection; Cyberlaw; Integrated Government; and the Hard Sciences. The work plan also identified new issues to be introduced at Commission meetings through testimony and presentations – homeland security and the use of DNA and forensics in criminal investigations-- as well as other issues to be monitored throughout the year -- privacy of personal information in court documents and taxes on Internet sales.

JCOTS adopted the findings and recommendations of its advisory committees and submits them for consideration.

Advisory Committee on Consumer Protection

The Advisory Committee on Consumer Protection was charged with reviewing and recommending changes to the consumer protection laws of the Commonwealth and their application to electronic commerce transactions.

The Committee received briefings on the consumer protection services and resources offered by the Office of the Attorney General and the Office of Consumer Affairs, the agencies that provide the two main avenues for consumer redress in Virginia. The Committee also learned about efforts to address confidential information in court documents and electronic filings. Among those efforts are the Model Written Policy Governing Access to Court Records and the Uniform Real Property Electronic Recordation Act. The Commission will be addressing these issues for many years to come.

As part of its study, the Committee focused on several bills referred to the Commission by the House Committee on Science and Technology during the 2003 Session and continued until the 2004 Session. The Committee discussed House Bill No. 1887 (Patron – May) on workplace privacy and House Bill No. 2564 (Patron – Scott) on electronic credit card transactions. Building upon the General Assembly’s efforts to limit the distribution of confidential information in court records, the Committee also discussed a proposal to restrict social security numbers on land records.

With several concerns raised about the workplace privacy proposal and given the current efforts by other organizations, the Committee declined to make any legislative recommendations on this topic. The proposal on social security numbers on land records met a similar fate for the same reasons. However, after discussing the credit card transaction issue and receiving public comment, the Committee recommended an alternative to HB 2564 the applied the proposal to all circumstances regardless of the medium, but limited its application to the claims and defenses of the Fair Credit Billing Act.

Advisory Committee on Cyberlaw

The Advisory Committee on Cyberlaw was charged with reviewing the laws of the Commonwealth regarding their applicability to the information age and beyond, and recommending appropriate changes. The Committee focused on two major issues, the Uniform Computer Information Transactions Act (UCITA) and identity theft.

UCITA represents the first comprehensive uniform computer information licensing law. The Act uses the accepted and familiar principles of contract law. It sets the rules for creating electronic contracts and the use of electronic signatures for contract adoption, thereby making computer information transactions as well grounded in the law as traditional transactions. Since Virginia enacted UCITA in 2000, the Nation Conference of Commissioners on Uniform State Laws (NCCUSL), one of the original drafters of the law, has amended the underlying uniform law. In fact, several of NCCUSL's recent amendments to UCITA arose from changes Virginia made as a result of the work of JCOTS.

Among the major provisions of the recommendations was a provision specifically excluding insurance services transactions from the scope, expanding the application of consumer protection statutes to licenses for computer information and the right to engage in lawful public comment from mass-market licenses to all licenses for computer information in its final form that is made generally available. Finally, open-source software is expressly not covered by the Act if only copyright permission is given and is not part of a contract; if there is a contract, there are no implied warranties if there is no commercial gain from the transaction.

To address a significant and costly but simple solution to one factor of identity theft – credit card fraud - the Committee voted to speed up compliance with the restrictions on printing payment device numbers and expiration dates on electronic receipts and expanding the restriction to include printed receipts. However, to address an issue created when Congress subsequently enacted a similar restriction for electronic credit card and debit card receipts, the recommendation was amended to cover payment devices in general. This way, a change in the federal law will not require amending state law again to address this issue. While the Committee did not adopt any other recommendations on this issue at this time, it did recommend that the Commission continue studying privacy issues.

Additional Commission Legislation on Privacy

Building on its work over the last couple of years, the Commission voted on two additional legislative proposals designed to limit the flow of confidential information. The first proposal would amend the Government Data Collection and Dissemination Practices Act by limiting the appearance of unique identifying numbers on public records. The legislation would prohibit filing or creating public records that contain more than the last four digits of any unique identifying number, unless the use is required by law or the record is exempt from disclosure. A unique identifying number is as any alphabetic or numeric sequence, or combination thereof, that is unique and assigned to a specific natural person at that person's request and includes, but is not limited to, social security number, bank account number, credit card number, military service number and driver's license number. The legislation excludes from this definition unique identifying numbers that are assigned to a natural person for purposes of identification, in lieu of social security numbers, and used for a single, specific government purpose. Preparers and filers would have the responsibility of certifying compliance.

The second proposal would amend the Personal Information Privacy Act by restricting the use of social security numbers in both the public and private sectors. Among other things, the proposal would prohibit making the social security number available to the general public, requiring consumers to provide the number to access goods or services unless required by law, and printing the number on an identification card. In addition, the proposal would require that insurance plans for state employees assign an identification number that is not a covered employee's social security number. Finally, the proposal would amend the Virginia Consumer Protection Act to prohibit a supplier from using a consumer's social security number when the consumer requests that his driver's license number be used. While current law requires that a supplier only provide an alternate number if the consumer so requests in writing, this proposal would provide consumers with another option other than providing their social security numbers and writing to the supplier for a new number.

Public comment on both proposals was mixed ranging from a request that the proposals further restrict confidential information to concerns that the proposals are too restrictive. The purpose of the proposals is to limit the general availability of key pieces of information used in identity theft while allowing their legitimate uses. The Commission unanimously voted to adopt these measures.

Advisory Committee on Integrated Government

The Advisory Committee on Integrated Government was charged with exploring the issues raised by the transformation of government in the digital age. The Committee continued focusing on the state of information technology (IT) procurement in the Commonwealth, including the newly created Virginia Information Technologies Agency (VITA) and Information Technology Investment Board (ITIB).

The Committee received briefings on the implementation of VITA, including updates from the Secretary of Technology, VITA staff, Joint Legislative Audit and Review Commission staff, and JCOTS staff. The Committee also received briefings on the state of IT procurement in the Commonwealth, including updates on VITA's procurement reform efforts, and on Virginia's spend analysis consulting services contract. VITA's new procurement manual incorporated several recommendations made by last year's Advisory Committee on Integrated Government.

Finally, the Committee discussed JCOTS' efforts to establish two regularly scheduled two-hour meeting times every month during the interim to make videoconference facilities available to public bodies in the legislative branch. These efforts arise in response to the Commission's decision in December 2002 to establish such meeting times as part of the Pilot Project, an exemption to the Virginia Freedom of Information Act that applies to meetings held via videoconference. The Pilot Project is due to sunset on July 1, 2005. The Committee made no recommendations at this time, though the Commission will continue to monitor these efforts.

Advisory Committee on the Hard Sciences

The Advisory Committee on the Hard Sciences was charged with evaluating the economic environment and capabilities of the Commonwealth to contribute to and benefit from the growth of new technologies and industries. The Committee focused on the infrastructure and resources necessary for high technology research projects and commercialization of those efforts and specifically focused on Internet2 as directed by HJR 653 (2003), distance learning and the Virginia Biotechnology Initiative.

The Committee learned that Internet2 is being replaced by the National LambdaRail (NLR), a system that will exclusively controlled by the research universities and private sector technology companies that are part of the NLR initiative. To join this effort, Virginia Tech, the University of Virginia, Old Dominion University, Virginia Commonwealth University, George Mason University, the College of William and Mary, and associate member Oak Ridge Associated Universities formed the Mid-Atlantic Terascale Partnership (MATP). On behalf of MATP, the Virginia Tech Foundation is underwriting a five-year, $5 million commitment to ensure the location of an NLR node in Washington, D.C. The briefings from the Virginia Biotechnology Initiative (VBI) and Virginia Educational Ventures (VEV; the group that addressed distance-learning initiatives) included a number of recommendations. VBI’s goal is to form an integrated long-term strategy, designed to place Virginia among the top 10 states in Biotechnology by 2010. To accomplish this objective, VBI proposed creating and funding an organization to bridge the gap between academia and business. Such an organization would help researchers and businesses commercialize intellectual property developed at the research institutions while allowing each to advance its different goals. VEV recommended creating and funding an authority to encourage, through coordination and financial support, new educational initiatives that address educationally underserved constituencies in technologically innovative and cost efficient ways.

Because of the extensive collaboration of the research institutions on NLR, the Committee took no action other than to support their efforts. In addition, the Committee endorsed the recommendations of VBI and VEV, while taking no position on its budget requests.