1. (1) Except as specifically prohibited by state or federal laws, and in accordance with applicable state and federal privacy laws and policies, each state agency is authorized, in accordance with the provisions of the interdepartmental data protocol, to share data collected in the course of performing its powers and duties with the following entities:

   1. (a) Other state agencies;
   2. (b) The legislative and judicial departments;
   3. (c) Political subdivisions; and
   4. (d) Nongovernmental organizations and individuals.

2. (2) Except as specifically prohibited by state or federal law, the department of law, and in accordance with applicable state and federal privacy laws and policies, the department of state, and the department of the treasury are authorized, in accordance with either the provisions of their own data-sharing protocol or the interdepartmental data protocol, to share data collected in the course of performing the department's powers and duties with the following entities:

   1. (a) Other state agencies;
   2. (b) The legislative and judicial departments;
   3. (c) Political subdivisions; and
   4. (d) Nongovernmental organizations and individuals.

3. (3) In order to further the development and implementation of the interdepartmental data protocol, each state agency shall:

   1. (a) Provide input and coordinate with the office and the government data advisory board as necessary to support the development of the necessary data governance framework and protocol described in subsections (1) and (2) of this section;
   2. (b) Conduct an inventory of its own data assets, including sensitivity and classification, and provide the inventory to the office;
   3. (c) Develop a process for ongoing monitoring of new data acquired by the state agency and establish a data retention policy for all data; and
   4. (d) Create a plan and work to implement the interoperability data framework and protocol published by the office for the purpose of minimizing duplication of records, enhancing security, and increasing the state's capability to monitor and audit data-sharing transactions.

Source: L. 2021: Entire part R&RE, (HB 21-1236), ch. 211, p. 1113, § 13, effective September 7.