1Amend Bill, page 2, by inserting between lines 20 and 21

2(a.3) Storage policy.--

3(1) The Office of Administration shall develop a policy
4to govern the proper storage by State agencies of data which
5includes personally identifiable information. The policy
6shall address identifying, collecting, maintaining,
7displaying and transferring personally identifiable
8information, using personally identifiable information in
9test environments, remediating personally identifiable
10information stored on legacy systems and other relevant
11issues. A goal of the policy shall be to reduce the risk of
12future breaches of security of the system.

13(2) In developing the policy under paragraph (1), the
14Office of Administration shall consider similar existing
15policies in other states, best practices identified by other
16states and relevant studies and other sources as appropriate.
17The policy shall be reviewed at least annually and updated as
18necessary.