Bill Text: MI HB4540 | 2015-2016 | 98th Legislature | Engrossed

---

Bill Title: Civil rights; public records; public body records, documents, or information disclosable under freedom of information act; exempt critical energy infrastructure and cybersecurity-related information. Amends secs. 2 & 13 of 1976 PA 442 (MCL 15.232 & 15.243).

Spectrum: Partisan Bill (Republican 12-0)

Status: (Introduced - Dead) 2016-04-19 - Referred To Committee On Elections And Government Reform [HB4540 Detail]

Download: Michigan-2015-HB4540-Engrossed.html

---

HB-4540, As Passed House, March 23, 2016

 

 

 

 

 

 

 

 

 

 

 

SUBSTITUTE FOR

 

HOUSE BILL NO. 4540

 

 

 

 

 

 

 

 

 

 

 

     A bill to amend 1976 PA 442, entitled

 

"Freedom of information act,"

 

by amending sections 2 and 13 (MCL 15.232 and 15.243), section 2 as

 

amended by 1996 PA 553 and section 13 as amended by 2006 PA 482.

 

THE PEOPLE OF THE STATE OF MICHIGAN ENACT:

 

     Sec. 2. As used in this act:

 

     (a) "Cybersecurity assessment" means an investigation

 

undertaken by a person, governmental body, or other entity to

 

identify vulnerabilities in cybersecurity plans.

 

     (b) "Cybersecurity incident" includes, but is not limited to,

 

a computer network intrusion or attempted intrusion; a breach of

 

primary computer network controls; unauthorized access to programs,

 

data, or information contained in a computer system; or actions by

 

a third party that materially affect component performance or,

 

because of impact to component systems, prevent normal computer

 

system activities.

 

     (c) "Cybersecurity plan" includes, but is not limited to,

 

information about a person's information systems, network security,

 

encryption, network mapping, access control, passwords,

 

authentication practices, computer hardware or software, or

 

response to cybersecurity incidents.

 

     (d) "Cybersecurity vulnerability" means a deficiency within

 

computer hardware or software, or within a computer network or

 

information system, that could be exploited by unauthorized parties

 

for use against an individual computer user or a computer network

 

or information system.

 

     (e) (a) "Field name" means the label or identification of an

 

element of a computer data base database that contains a specific

 

item of information, and includes but is not limited to a subject

 

heading such as a column header, data dictionary, or record layout.

 

     (f) (b) "FOIA coordinator" means either of the following:

 

     (i) An individual who is a public body.

 

     (ii) An individual designated by a public body in accordance

 

with section 6 to accept and process requests for public records

 

under this act.

 

     (g) (c) "Person" means an individual, corporation, limited

 

liability company, partnership, firm, organization, association,

 

governmental entity, or other legal entity. Person does not include

 

an individual serving a sentence of imprisonment in a state or

 

county correctional facility in this state or any other state, or

 

in a federal correctional facility.

     (h) (d) "Public body" means any of the following:

 

     (i) A state officer, employee, agency, department, division,

 

bureau, board, commission, council, authority, or other body in the

 

executive branch of the state government, but does not include the

 

governor or lieutenant governor, the executive office of the

 

governor or lieutenant governor, or employees thereof.

 

     (ii) An agency, board, commission, or council in the

 

legislative branch of the state government.

 

     (iii) A county, city, township, village, intercounty,

 

intercity, or regional governing body, council, school district,

 

special district, or municipal corporation, or a board, department,

 

commission, council, or agency thereof.

 

     (iv) Any other body which that is created by state or local

 

authority or which is primarily funded by or through state or local

 

authority, .

 

     (v) The except that the judiciary, including the office of the

 

county clerk and its employees thereof when acting in the capacity

 

of clerk to the circuit court, is not included in the definition of

 

public body.

 

     (i) (e) "Public record" means a writing prepared, owned, used,

 

in the possession of, or retained by a public body in the

 

performance of an official function, from the time it is created.

 

Public record does not include computer software. This act

 

separates public records into the following 2 classes:

 

     (i) Those that are exempt from disclosure under section 13.

 

     (ii) All public records that are not exempt from disclosure

 

under section 13 and which that are subject to disclosure under

this act.

 

     (j) (f) "Software" means a set of statements or instructions

 

that when incorporated in a machine usable medium is capable of

 

causing a machine or device having information processing

 

capabilities to indicate, perform, or achieve a particular

 

function, task, or result. Software does not include computer-

 

stored information or data, or a field name if disclosure of that

 

field name does not violate a software license.

 

     (k) (g) "Unusual circumstances" means any 1 or a combination

 

of the following, but only to the extent necessary for the proper

 

processing of a request:

 

     (i) The need to search for, collect, or appropriately examine

 

or review a voluminous amount of separate and distinct public

 

records pursuant to a single request.

 

     (ii) The need to collect the requested public records from

 

numerous field offices, facilities, or other establishments which

 

are located apart from the particular office receiving or

 

processing the request.

 

     (l) (h) "Writing" means handwriting, typewriting, printing,

 

photostating, photographing, photocopying, and every other means of

 

recording, and includes letters, words, pictures, sounds, or

 

symbols, or combinations thereof, and papers, maps, magnetic or

 

paper tapes, photographic films or prints, microfilm, microfiche,

 

magnetic or punched cards, discs, drums, hard drives, solid state

 

storage components, or other means of recording or retaining

 

meaningful content.

 

     (m) (i) "Written request" means a writing that asks for

information, and includes a writing transmitted by facsimile,

 

electronic mail, or other electronic means.

 

     Sec. 13. (1) A public body may exempt from disclosure as a

 

public record under this act any of the following:

 

     (a) Information of a personal nature if public disclosure of

 

the information would constitute a clearly unwarranted invasion of

 

an individual's privacy.

 

     (b) Investigating records compiled for law enforcement

 

purposes, but only to the extent that disclosure as a public record

 

would do any of the following:

 

     (i) Interfere with law enforcement proceedings.

 

     (ii) Deprive a person of the right to a fair trial or

 

impartial administrative adjudication.

 

     (iii) Constitute an unwarranted invasion of personal privacy.

 

     (iv) Disclose the identity of a confidential source, or if the

 

record is compiled by a law enforcement agency in the course of a

 

criminal investigation, disclose confidential information furnished

 

only by a confidential source.

 

     (v) Disclose law enforcement investigative techniques or

 

procedures.

 

     (vi) Endanger the life or physical safety of law enforcement

 

personnel.

 

     (c) A public record that if disclosed would prejudice a public

 

body's ability to maintain the physical security of custodial or

 

penal institutions occupied by persons arrested or convicted of a

 

crime or admitted because of a mental disability, unless the public

 

interest in disclosure under this act outweighs the public interest

in nondisclosure.

 

     (d) Records or information specifically described and exempted

 

from disclosure by statute.

 

     (e) A public record or information described in this section

 

that is furnished by the public body originally compiling,

 

preparing, or receiving the record or information to a public

 

officer or public body in connection with the performance of the

 

duties of that public officer or public body, if the considerations

 

originally giving rise to the exempt nature of the public record

 

remain applicable.

 

     (f) Trade secrets or commercial or financial information

 

voluntarily provided to an agency for use in developing

 

governmental policy if:

 

     (i) The information is submitted upon a promise of

 

confidentiality by the public body.

 

     (ii) The promise of confidentiality is authorized by the chief

 

administrative officer of the public body or by an elected official

 

at the time the promise is made.

 

     (iii) A description of the information is recorded by the

 

public body within a reasonable time after it has been submitted,

 

maintained in a central place within the public body, and made

 

available to a person upon request. This subdivision does not apply

 

to information submitted as required by law or as a condition of

 

receiving a governmental contract, license, or other benefit.

 

     (g) Information or records subject to the attorney-client

 

privilege.

 

     (h) Information or records subject to the physician-patient

privilege, the psychologist-patient privilege, the minister,

 

priest, or Christian Science practitioner privilege, or other

 

privilege recognized by statute or court rule.

 

     (i) A bid or proposal by a person to enter into a contract or

 

agreement, until the time for the public opening of bids or

 

proposals, or if a public opening is not to be conducted, until the

 

deadline for submission of bids or proposals has expired.

 

     (j) Appraisals of real property to be acquired by the public

 

body until either of the following occurs:

 

     (i) An agreement is entered into.

 

     (ii) Three years have elapsed since the making of the

 

appraisal, unless litigation relative to the acquisition has not

 

yet terminated.

 

     (k) Test questions and answers, scoring keys, and other

 

examination instruments or data used to administer a license,

 

public employment, or academic examination, unless the public

 

interest in disclosure under this act outweighs the public interest

 

in nondisclosure.

 

     (l) Medical, counseling, or psychological facts or evaluations

 

concerning an individual if the individual's identity would be

 

revealed by a disclosure of those facts or evaluation, including

 

protected health information, as defined in 45 CFR 160.103.

 

     (m) Communications and notes within a public body or between

 

public bodies of an advisory nature to the extent that they cover

 

other than purely factual materials and are preliminary to a final

 

agency determination of policy or action. This exemption does not

 

apply unless the public body shows that in the particular instance

the public interest in encouraging frank communication between

 

officials and employees of public bodies clearly outweighs the

 

public interest in disclosure. This exemption does not constitute

 

an exemption under state law for purposes of section 8(h) of the

 

open meetings act, 1976 PA 267, MCL 15.268. As used in this

 

subdivision, "determination of policy or action" includes a

 

determination relating to collective bargaining, unless the public

 

record is otherwise required to be made available under 1947 PA

 

336, MCL 423.201 to 423.217.

 

     (n) Records of law enforcement communication codes, or plans

 

for deployment of law enforcement personnel, that if disclosed

 

would prejudice a public body's ability to protect the public

 

safety unless the public interest in disclosure under this act

 

outweighs the public interest in nondisclosure in the particular

 

instance.

 

     (o) Information that would reveal the exact location of

 

archaeological sites. The department of history, arts, and

 

libraries natural resources may promulgate rules in accordance with

 

the administrative procedures act of 1969, 1969 PA 306, MCL 24.201

 

to 24.328, to provide for the disclosure of the location of

 

archaeological sites for purposes relating to the preservation or

 

scientific examination of sites.

 

     (p) Testing data developed by a public body in determining

 

whether bidders' products meet the specifications for purchase of

 

those products by the public body, if disclosure of the data would

 

reveal that only 1 bidder has met the specifications. This

 

subdivision does not apply after 1 year has elapsed from the time

the public body completes the testing.

 

     (q) Academic transcripts of an institution of higher education

 

established under section 5, 6, or 7 of article VIII of the state

 

constitution of 1963, if the transcript pertains to a student who

 

is delinquent in the payment of financial obligations to the

 

institution.

 

     (r) Records of a campaign committee including a committee that

 

receives money from a state campaign fund.

 

     (s) Unless the public interest in disclosure outweighs the

 

public interest in nondisclosure in the particular instance, public

 

records of a law enforcement agency, the release of which would do

 

any of the following:

 

     (i) Identify or provide a means of identifying an informant.

 

     (ii) Identify or provide a means of identifying a law

 

enforcement undercover officer or agent or a plain clothes officer

 

as a law enforcement officer or agent.

 

     (iii) Disclose the personal address or telephone number of

 

active or retired law enforcement officers or agents or a special

 

skill that they may have.

 

     (iv) Disclose the name, address, or telephone numbers of

 

family members, relatives, children, or parents of active or

 

retired law enforcement officers or agents.

 

     (v) Disclose operational instructions for law enforcement

 

officers or agents.

 

     (vi) Reveal the contents of staff manuals provided for law

 

enforcement officers or agents.

 

     (vii) Endanger the life or safety of law enforcement officers

or agents or their families, relatives, children, parents, or those

 

who furnish information to law enforcement departments or agencies.

 

     (viii) Identify or provide a means of identifying a person as

 

a law enforcement officer, agent, or informant.

 

     (ix) Disclose personnel records of law enforcement agencies.

 

     (x) Identify or provide a means of identifying residences that

 

law enforcement agencies are requested to check in the absence of

 

their owners or tenants.

 

     (t) Except as otherwise provided in this subdivision, records

 

and information pertaining to an investigation or a compliance

 

conference conducted by the department under article 15 of the

 

public health code, 1978 PA 368, MCL 333.16101 to 333.18838, before

 

a complaint is issued. This subdivision does not apply to records

 

or information pertaining to 1 or more of the following:

 

     (i) The fact that an allegation has been received and an

 

investigation is being conducted, and the date the allegation was

 

received.

 

     (ii) The fact that an allegation was received by the

 

department; the fact that the department did not issue a complaint

 

for the allegation; and the fact that the allegation was dismissed.

 

     (u) Records of a public body's security measures, including

 

security plans, security codes and combinations, passwords, passes,

 

keys, and security procedures, to the extent that the records

 

relate to the ongoing security of the public body.

 

     (v) Records or information relating to a civil action in which

 

the requesting party and the public body are parties.

 

     (w) Information or records that would disclose the social

security number of an individual.

 

     (x) Except as otherwise provided in this subdivision, an

 

application for the position of president of an institution of

 

higher education established under section 4, 5, or 6 of article

 

VIII of the state constitution of 1963, materials submitted with

 

such an application, letters of recommendation or references

 

concerning an applicant, and records or information relating to the

 

process of searching for and selecting an individual for a position

 

described in this subdivision, if the records or information could

 

be used to identify a candidate for the position. However, after 1

 

or more individuals have been identified as finalists for a

 

position described in this subdivision, this subdivision does not

 

apply to a public record described in this subdivision, except a

 

letter of recommendation or reference, to the extent that the

 

public record relates to an individual identified as a finalist for

 

the position.

 

     (y) Records or information of measures designed to protect the

 

security or safety of persons or property, or the confidentiality,

 

integrity, or availability of information systems, whether public

 

or private, including, but not limited to, building, public works,

 

and public water supply designs to the extent that those designs

 

relate to the ongoing security measures of a public body,

 

capabilities and plans for responding to a violation of the

 

Michigan anti-terrorism act, chapter LXXXIII-A of the Michigan

 

penal code, 1931 PA 328, MCL 750.543a to 750.543z, emergency

 

response plans; , risk planning documents; , threat assessments; ,

 

and domestic preparedness strategies; , and cybersecurity plans,

assessments, or vulnerabilities, unless disclosure would not impair

 

a public body's ability to protect the security or safety of

 

persons or property or unless the public interest in disclosure

 

outweighs the public interest in nondisclosure in the particular

 

instance.

 

     (z) Information that would identify or provide a means of

 

identifying a person that may, as a result of disclosure of the

 

information, become a victim of a cybersecurity incident or that

 

would disclose a person's cybersecurity plans or cybersecurity-

 

related practices, procedures, methods, results, organizational

 

information system infrastructure, hardware, or software.

 

     (2) A public body shall exempt from disclosure information

 

that, if released, would prevent the public body from complying

 

with 20 USC 1232g, commonly referred to as the family educational

 

rights and privacy act of 1974. A public body that is a local or

 

intermediate school district or a public school academy shall

 

exempt from disclosure directory information, as defined by 20 USC

 

1232g, commonly referred to as the family educational rights and

 

privacy act of 1974, requested for the purpose of surveys,

 

marketing, or solicitation, unless that public body determines that

 

the use is consistent with the educational mission of the public

 

body and beneficial to the affected students. A public body that is

 

a local or intermediate school district or a public school academy

 

may take steps to ensure that directory information disclosed under

 

this subsection shall not be used, rented, or sold for the purpose

 

of surveys, marketing, or solicitation. Before disclosing the

 

directory information, a public body that is a local or

intermediate school district or a public school academy may require

 

the requester to execute an affidavit stating that directory

 

information provided under this subsection shall not be used,

 

rented, or sold for the purpose of surveys, marketing, or

 

solicitation.

 

     (3) This act does not authorize the withholding of information

 

otherwise required by law to be made available to the public or to

 

a party in a contested case under the administrative procedures act

 

of 1969, 1969 PA 306, MCL 24.201 to 24.328.

 

     (4) Except as otherwise exempt under subsection (1), this act

 

does not authorize the withholding of a public record in the

 

possession of the executive office of the governor or lieutenant

 

governor, or an employee of either executive office, if the public

 

record is transferred to the executive office of the governor or

 

lieutenant governor, or an employee of either executive office,

 

after a request for the public record has been received by a state

 

officer, employee, agency, department, division, bureau, board,

 

commission, council, authority, or other body in the executive

 

branch of government that is subject to this act.

 

     Enacting section 1. This amendatory act takes effect 90 days

 

after the date it is enacted into law.