Pennsylvania Act 2006-156 — PUBLIC UTILITY CONFIDENTIAL SECURITY INFORMATION DISCLOSURE PROTECTION ACT

Act text

AN ACT

Relating to confidential security information of public utilities; and imposing penalties.

The General Assembly of the Commonwealth of Pennsylvania hereby enacts as follows:

Section 1. Short title.

This act shall be known and may be cited as the Public Utility Confidential Security Information Disclosure Protection Act.

Section 2. Definitions.

The following words and phrases when used in this act shall have the meanings given to them in this section unless the context clearly indicates otherwise:

"Agency." Any office, department, board or commission of the executive departments of the Commonwealth, any political subdivision of the Commonwealth, the Pennsylvania Turnpike Commission, the State System of Higher Education or any State or municipal authority or similar organization created by or pursuant to a statute which declares in substance that such organization performs or has for its purpose the performance of an essential governmental function.

"Confidential security information." Information contained within a record maintained by an agency in any form, the disclosure of which would compromise security against sabotage or criminal or terrorist acts and the nondisclosure of which is necessary for the protection of life, safety, public property or public utility facilities, including, but not limited to, all of the following:

(1) A vulnerability assessment which is submitted to the Environmental Protection Agency or any other Federal, State or local agency.

(2) Portions of emergency response plans that are submitted to the Department of Environmental Protection, the Pennsylvania Public Utility Commission or any other Federal, State or local agency dealing with response procedures or plans prepared to prevent or respond to emergency situations, except those portions intended for public disclosure, the disclosure of which would reveal vulnerability assessments, specific tactics, specific emergency procedures or specific security procedures. Nothing in this term shall be construed to relieve a public utility from its public notification obligations under other applicable Federal and State laws.

(3) A plan, map or other drawing or data which shows the location or reveals location data on community drinking water wells and surface water intakes.

(4) A security plan, security procedure or risk assessment prepared specifically for the purpose of preventing or for protection against sabotage or criminal or terrorist acts.

(5) (i) Specific information, including portions of financial statements, about security devices or personnel, designed to protect against sabotage or criminal or terrorist acts.

(ii) Nothing in this definition shall be construed to prevent the disclosure of monetary amounts.

"Dangerous to human life or property." A violent act or an act which is intended to or likely to cause death, serious bodily injury or mass destruction.

"Facilities." All the plant and equipment of a public utility, including all tangible and intangible real and personal property without limitation, and any and all means and instrumentalities in any manner owned, operated, leased, licensed, used, controlled, furnished or supplied for, by or in connection with the business of any public utility. For the purposes of this act, the term shall also include electric power generation.

"Mass destruction." An act which is intended to or likely to destroy or cause serious damage to facilities, public or private buildings, places of public accommodation or public works under circumstances evincing depraved indifference to human life or property.

"Public utility." Any person, corporation, municipality or municipal authority or corporation now or hereafter owning or operating in this Commonwealth equipment or facilities for:

(1) Producing, generating, transmitting, distributing or furnishing natural or artificial gas, electricity or steam for the production of light, heat or power to the public for compensation. For the purposes of this act, the term shall also include electric power generation.

(2) Diverting, developing, pumping, impounding, distributing or furnishing water to or for the public for compensation.

(3) Using a canal, turnpike, tunnel, bridge, wharf and the like for the public for compensation.

(4) Transporting or conveying natural or artificial gas, crude oil, gasoline or petroleum products, materials for refrigeration or oxygen or nitrogen or other fluid substance, by pipeline or conduit, for the public for compensation.

(5) Conveying or transmitting messages or communications by telephone or telegraph or domestic public land mobile radio service, including, but not limited to, point-to-point microwave radio service, for the public for compensation.

(6) Collecting, treating or disposing sewage for the public for compensation.

(7) Transporting passengers or property as a common carrier.

"Terrorist act." Any act or acts constituting a violent offense intended to:

(1) intimidate or coerce a civilian population;

(2) influence the policy of a government by intimidation or coercion; or

(3) affect the conduct of a government.

"Violent offense." An offense under 18 Pa.C.S. Pt. II (relating to definition of specific offenses), including an attempt, conspiracy or solicitation to commit any such offense, which is punishable by imprisonment of more than one year and involves an act dangerous to human life or property.

Section 3. Procedures for submitting, challenging and protecting confidential security information.

(a) General rule.--The public utility is responsible for determining whether a record or portion thereof contains confidential security information. When a public utility identifies a record as containing confidential security information, it must clearly state in its transmittal letter, upon submission to an agency, that the record contains confidential security information and explain why the information should be treated as such.

(b) Submission of confidential security information.--An agency shall develop filing protocols and procedures for public utilities to follow when submitting records, including protocols and procedures for submitting records containing confidential security information. Such protocols and procedures shall instruct public utilities who submit records to an agency to separate their information into at least two categories:

(1) Public.--Records or portions thereof subject to the provisions of the act of June 21, 1957 (P.L.390, No.212), referred to as the Right-to-Know Law.

(2) Confidential.--Records or portions thereof requested to be treated as containing confidential security information and not subject to the Right-to-Know Law.

(c) Challenges to designation of confidential security information.--Challenges to a public utility's designation or request to examine records containing confidential security information by a member of the public shall be made in writing to the agency in which the record or portions thereof were originally submitted. The agency shall develop protocols and procedures to address challenges to the designations or requests to examine records containing confidential security information. Such protocols and procedures shall include:

(1) Written notification to the public utility by the agency of the request to examine records containing confidential security information or challenge of its designation.

(2) An opportunity for agency review of the public utility's designation.

(3) During the review or any appeal of the agency's decision, the agency shall continue to honor the confidential security information designation by the public utility.

(4) Agency review of the public utility's designation or request to examine records containing confidential security information shall be based on consistency with the definition of confidential security information contained in this act or when there are reasonable grounds to believe disclosure may result in a safety risk, including the risk of harm to any person, or mass destruction.

(5) Written notification of the agency's decision on confidentiality to the public utility and member of the public that requested to examine the records containing confidential security information or challenged the designation made by the public utility shall occur within 60 days. In the same writing, the agency shall affirmatively state whether the disclosure would compromise the public utility's security against sabotage or criminal or terrorist acts.

(6) Following written notification by the agency of its decision on confidentiality, the public utility and member of the public shall be given 30 days to file an appeal in Commonwealth Court where the court may review the records containing confidential security information in camera to determine if they are protected from disclosure under this act. During pendency of the in camera review, the records subject to the in camera review shall not be made part of the public court filing.

(d) Protecting confidential security information.--An agency shall develop such protocols as may be necessary to protect public utility records or portions thereof that contain confidential security information from prohibited disclosure under section 5. Such protocols shall ensure that:

(1) Each copy of a record or portion thereof containing confidential security information is clearly marked as confidential and not subject to the provisions of the Right-to-Know Law.

(2) Each copy of a record or portion thereof containing confidential security information is kept on site in a secure location, separate from the general records relating to the public utility, where it is available for inspection by authorized individuals.

(3) Only authorized individuals, as designated by the agency, may have access to records or copies thereof containing confidential security information.

(4) Authorized individuals, as designated by the agency, shall undergo training and sign an access agreement which summarizes responsibilities and personal liabilities if confidential security information is knowingly or recklessly released, published or otherwise disclosed.

(5) A document tracking system is established to allow for records or copies thereof containing confidential security information to be traceable at all times to a single person.

(e) Redaction of confidential security information.--If an agency determines that a record or portions thereof contain confidential security information and information that is public, the agency shall redact the portions of the record containing confidential security information before disclosure.

Compiler's Note: The act of June 21, 1957 (P.L.390, No.212), referred to as the Right-to-Know Law, referred to in subsec. (b), was repealed by the act of Feb. 14, 2008 (P.L.6, No.3), known as the Right-to-Know Law.

Section 4. Applicability to other law.

Public utility records or portions thereof which contain confidential security information, in accordance with the provisions of this act, shall not be subject to the provisions of the act of June 21, 1957 (P.L.390, No.212), referred to as the Right-to-Know Law.

Compiler's Note: The June 21, 1957 (P.L.390, No.212), referred to as the Right-to-Know Law, referred to in this section, was repealed by the act of Feb. 14, 2008 (P.L.6, No.3), known as the Right-to-Know Law.

Section 5. Prohibition.

(a) General rule.--An agency shall not release, publish or otherwise disclose a public utility record or portion thereof which contains confidential security information, in accordance with the provisions of this act.

(b) Exception.--Notwithstanding subsection (a), an agency may, after notification and consultation with the public utility, disclose a public utility record or portion thereof which contains confidential security information, in accordance with the provisions of this act, that is necessary for construction, renovation or remodeling work on any public building or project. Release or disclosure of such records or portions thereof for these purposes does not constitute prohibited disclosure under subsection (a) and does not result in such records or portions thereof becoming public records subject to the provisions of the act of June 21, 1957 (P.L.390, No.212), referred to as the Right-to-Know Law.

Compiler's Note: The act of June 21, 1957 (P.L.390, No.212), referred to as the Right-to-Know Law, referred to in subsec. (b), was repealed by the act of Feb. 14, 2008 (P.L.6, No.3), known as the Right-to-Know Law.

Section 6. Penalties.

A public official or public employee who acquires a public utility record or portions thereof which contain confidential security information or any reproduction of a public utility record or portion thereof which contains confidential security information and who knowingly or recklessly releases, publishes or otherwise discloses a public utility record or portion thereof which contains confidential security information or any reproduction of a public utility record or portion thereof which contains confidential security information commits a misdemeanor of the second degree subject to prosecution by the Attorney General and shall, upon conviction, be sentenced to pay a fine of not more than $5,000 plus costs of prosecution or to a term of imprisonment not to exceed one year, or both, and shall be removed from office or agency employment.

Section 7. Effective date.

This act shall take effect in 180 days.