SB316: General Services, Department of; disposition of surplus materials.

SENATE BILL NO. 316

Offered January 10, 2018
Prefiled January 8, 2018
A BILL to amend and reenact §§ 2.2-1124 and 2.2-2009 of the Code of Virginia, relating to the Department of General Services; disposition of surplus materials.
Patron-- Ruff

Referred to Committee on General Laws and Technology

Be it enacted by the General Assembly of Virginia:

1. That §§ 2.2-1124 and 2.2-2009 of the Code of Virginia are amended and reenacted as follows:

§ 2.2-1124. Disposition of surplus materials.

A. "Surplus materials" means personal property including, but not limited to, materials, supplies, equipment, and recyclable items, but shall not include property as defined in § 2.2-1147 that is determined to be surplus. Surplus materials shall not include finished products that a state hospital or training center operated by the Department of Behavioral Health and Developmental Services sells for the benefit of individuals receiving services in the state hospital or training center, provided that (i) most of the supplies, equipment, or products have been donated to the state hospital or training center; (ii) the individuals in the state hospital or training center have substantially altered the supplies, equipment, or products in the course of occupational or other therapy; and (iii) the substantial alterations have resulted in a finished product.

B. The Department shall establish procedures for the disposition of surplus materials from departments, divisions, institutions, and agencies of the Commonwealth. Such procedures shall:

1. Permit surplus materials to be transferred between or sold to departments, divisions, institutions, or agencies of the Commonwealth;

2. Permit surplus materials to be sold to Virginia charitable corporations granted tax-exempt status under § 501(c)(3) of the Internal Revenue Code and operating as clinics for the indigent and uninsured that are organized for the delivery of primary health care services (i) as federally qualified health centers designated by the Health Care Financing Administration or (ii) at a reduced or sliding fee scale or without charge;

3. Permit public sales or auctions, including online public auctions;

4. Permit surplus motor vehicles to be sold prior to public sale or auction to local social service departments for the purpose of resale at cost to TANF recipients;

5. Permit surplus materials to be sold to Virginia charitable corporations granted tax-exempt status under § 501(c)(3) of the Internal Revenue Code and operating as children's homes;

6. Permit donations to political subdivisions of the Commonwealth under the circumstances specified in this section;

7. Permit other methods of disposal when (a) the cost of the sale will exceed the potential revenue to be derived therefrom or (b) the surplus material is not suitable for sale;

8. Permit any animal especially trained for police work to be sold at a price of $1 to the handler who last was in control of the animal. The agency or institution may allow the immediate survivor of any full-time sworn law-enforcement officer who (i) is killed in the line of duty or (ii) dies in service and has at least 10 years of service to purchase the service animal at a price of $1. Any such sale shall not be deemed a violation of the State and Local Government Conflict of Interests Act (§ 2.2-3100 et seq.);

9. Permit the transfer of surplus clothing to an appropriate department, division, institution, or agency of the Commonwealth for distribution to needy individuals by and through local social services boards;

10. Encourage the recycling of paper products, beverage containers, electronics, and used motor oil;

11. Require the proceeds from any sale or recycling of surplus materials be promptly deposited into the state treasury in accordance with § 2.2-1802 and report the deposit to the State Comptroller;

12. Permit donations of surplus computers and related equipment to public schools in the Commonwealth and Virginia charitable corporations granted tax-exempt status under § 501(c)(3) of the Internal Revenue Code and providing services to persons with disabilities, at-risk youths, or low-income families. For the purposes of this subdivision, "at-risk youths" means school-age children approved eligible to receive free or reduced price meals in the federally funded lunch program;

13. Permit surplus materials to be transferred or sold, prior to public sale or auction, to public television stations located in the state and other nonprofit organizations approved for the distribution of federal surplus materials;

14. Permit a public institution of higher education to dispose of its surplus materials at the location where the surplus materials are held and to retain any proceeds from such disposal, provided that the institution meets the conditions prescribed in subsection A of § 23.1-1002 and § 23.1-1019 (regardless of whether or not the institution has been granted any authority under Article 4 (§ 23.1-1004 et seq.) of Chapter 10 of Title 23.1);

15. Permit surplus materials from (i) the Department of Defense Excess Property Program or (ii) other surplus property programs administered by the Commonwealth to be transferred or sold to Virginia charitable corporations granted tax-exempt status under § 501(c)(3) of the Internal Revenue Code and operating as an educational institution devoted to emergency management training, preparedness, and response; and

16. Require, to the extent practicable, the recycling and disposal of computers and other information technology assets. Additionally, for computers or information technology assets that may contain confidential state data or personal identifying information of citizens of the Commonwealth, the Department shall ensure all policies for the transfer or other disposition of computers or information technology assets are consistent with data and information security policies developed by the Virginia Information Technologies Agency.

17. Permit any employee departing state employment to purchase at fair market value mobile technology devices provided to the employee during the course of employment. The Department shall ensure that all policies regarding the purchase of mobile technology devices are consistent with data and information security policies developed by the Virginia Information Technologies Agency.

C. The Department shall dispose of surplus materials pursuant to the procedures established in subsection B or permit any department, division, institution, or agency of the Commonwealth to dispose of its surplus materials consistent with the procedures so established. No surplus materials shall be disposed of without prior consent of the head of the department, division, institution, or agency of the Commonwealth in possession of such surplus materials or the Governor.

D. Departments, divisions, institutions, or agencies of the Commonwealth or the Governor may donate surplus materials only under the following circumstances:

1. Emergencies declared in accordance with § 44-146.18:2 or 44-146.28;

2. As set forth in the budget bill as defined by § 2.2-1509, provided that (a) the budget bill contains a description of the surplus materials, the method by which the surplus materials shall be distributed, and the anticipated recipients, and (b) such information shall be provided by the Department to the Department of Planning and Budget in sufficient time for inclusion in the budget bill;

3. When the market value of the surplus materials, which shall be donated for a public purpose, is less than $500; however, the total market value of all surplus materials so donated by any department, division, institution, or agency shall not exceed 25 percent of the revenue generated by such department's, division's, institution's, or agency's sale of surplus materials in the fiscal year, except these limits shall not apply in the case of surplus computer equipment and related items donated to Virginia public schools; or

4. During a local emergency, upon written request of the head of a local government or a political subdivision in the Commonwealth to the head of a department, division, institution, or agency.

E. On or before October 1 of each year, the Department shall prepare, and file with the Secretary of the Commonwealth, a plan that describes the expected disposition of surplus materials in the upcoming fiscal year pursuant to subdivision B 6.

F. The Department may make available to any local public body of the Commonwealth the services or facilities authorized by this section; however, the furnishing of any such services shall not limit or impair any services normally rendered any department, division, institution or agency of the Commonwealth. All public bodies shall be authorized to use the services of the Department's Surplus Property Program under the guidelines established pursuant to this section and the surplus property policies and procedures of the Department. Proceeds from the sale of the surplus property shall be returned to the local body minus a service fee. The service fee charged by the Department shall be consistent with the fee charged by the Department to state public bodies.

§ 2.2-2009. Additional duties of the CIO relating to security of government information.

A. To provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth's executive, legislative, and judicial branches and independent agencies. The CIO shall work with representatives of the Chief Justice of the Supreme Court and Joint Rules Committee of the General Assembly to identify their needs. Such policies, standards, and guidelines shall, at a minimum:

1. Address the scope and frequency of security audits. In developing and updating such policies, standards, and guidelines, the CIO shall designate a government entity to oversee, plan, and coordinate the conduct of periodic security audits of all executive branch agencies and independent agencies. The CIO shall coordinate these audits with the Auditor of Public Accounts and the Joint Legislative Audit and Review Commission. The Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly shall determine the most appropriate methods to review the protection of electronic information within their branches;

2. Control unauthorized uses, intrusions, or other security threats;

3. Provide for the protection of confidential data maintained by state agencies against unauthorized access and use in order to ensure the security and privacy of citizens of the Commonwealth in their interaction with state government. Such policies, standards, and guidelines shall include requirements that (i) any state employee or other authorized user of a state technology asset provide passwords or other means of authentication to use a technology asset and access a state-owned or state-operated computer network or database and (ii) a digital rights management system or other means of authenticating and controlling an individual's ability to access electronic records be utilized to limit access to and use of electronic records that contain confidential information to authorized individuals;

4. Address the creation and operation of a risk management program designed to identify information technology security gaps and develop plans to mitigate the gaps. All agencies in the Commonwealth shall cooperate with the CIO, including (i) providing the CIO with information required to create and implement a Commonwealth risk management program, (ii) creating an agency risk management program, and (iii) complying with all other risk management activities; and

5. Require that any contract for information technology entered into by the Commonwealth's executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws and regulations pertaining to information security and privacy.

B. 1. The CIO shall annually report to the Governor, the Secretary, and General Assembly on the results of security audits, the extent to which security policy, standards, and guidelines have been adopted by executive branch and independent agencies, and a list of those executive branch agencies and independent agencies that have not implemented acceptable security and risk management regulations, policies, standards, and guidelines to control unauthorized uses, intrusions, or other security threats. For any executive branch agency or independent agency whose security audit results and plans for corrective action are unacceptable, the CIO shall report such results to (i) the Secretary, (ii) any other affected cabinet secretary, (iii) the Governor, and (iv) the Auditor of Public Accounts. Upon review of the security audit results in question, the CIO may take action to suspend the executive branch agency's or independent agency's information technology projects pursuant to subsection B of § 2.2-2016.1, limit additional information technology investments pending acceptable corrective actions, and recommend to the Governor and Secretary any other appropriate actions.

2. Executive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated costs. Public bodies that are not required to but elect to use the entity designated to perform such audits shall also bear any associated costs.

C. The provisions of this section shall not infringe upon responsibilities assigned to the Comptroller, the Auditor of Public Accounts, or the Joint Legislative Audit and Review Commission by other provisions of the Code of Virginia.

D. The CIO shall promptly receive reports from directors of departments in the executive branch of state government made in accordance with § 2.2-603 and shall take such actions as are necessary, convenient or desirable to ensure the security of the Commonwealth's electronic information and confidential data.

E. The CIO shall provide technical guidance to the Department of General Services in the development of policies, standards, and guidelines for the recycling and disposal of computers and other technology assets. Such policies, standards, and guidelines shall include the expunging, in a manner as determined by the CIO, of all confidential data and personal identifying information of citizens of the Commonwealth prior to such sale, disposal, or other transfer of computers or other technology assets.

F. The CIO shall provide technical guidance to the Department of General Services in the development of policies, standards, and guidelines for the sale of mobile technology devices to employees departing state employment. Such policies, standards, and guidelines shall include (i) the expungement, in a manner as determined by the CIO, of all confidential data prior to the sale of the mobile technology devices and (ii) the preservation of personal information belonging to the departing employee.

G. The CIO shall provide all directors of agencies and departments with all such information, guidance, and assistance required to ensure that agencies and departments understand and adhere to the policies, standards, and guidelines developed pursuant to this section.