Text of DC B 260670 (2026)

Statement of Introduction DC Government Data Privacy and Protection Act of 2026 April 24, 2026 Today, along with Councilmembers Christina Henderson, Janeese Lewis George, and Zachary Parker, I am introducing the “District of Columbia Data Privacy and Protection Act of 2026”. This legislation establishes comprehensive privacy protections governing the collection, use, sale, and disclosure of individuals' personal data by District government agencies and third parties and provides individuals with rights over their personal data. The bill establishes a Chief Privacy Officer (CPO) within the Office of the Chief Technology Officer (OCTO) to oversee compliance and implementation across agencies. Data privacy laws for government are essential to safeguarding residents’ personal information and preventing misuse by unauthorized actors. Public-sector databases have increasingly become targets for cybercriminals, who seek to exploit sensitive information for financial gain, identity theft, or unauthorized access to government systems.1 For example, the 2023 breach of the District of Columbia Board of Elections exposed voter registration data after attackers gained access to internal systems.2 The Committee on Public Works & Operations learned through oversight of OCTO that the Department of Motor Vehicles had sold user data to LexisNexis.3 This sale occurred without clear, informed consent from residents, and without prior approval from OCTO about what information, if any, could be securely sold. Any sale of data should be transparent and performed with clear guidelines and limitations for both the agency and the third party. When handled responsibly and securely, data is a powerful tool for improving government services, serving as an aid to agencies in identifying disparities in service delivery, evaluating program effectiveness, and promoting community advocacy.4 This legislation establishes clear rules and rights to safeguard individuals’ data, promoting responsible data usage so that our government can continue to utilize data-informed service delivery for District residents and visitors. 1 Data Security Laws | State Government 2 Update: D.C. Elections Board Says Hack Impacted Less Than 4,000 Voters | DCist 3 Testimony of Shauna Dillavou, Brightlines, at the FY24 Performance Oversight Hearing for the Office of the Chief Technology Officer 4 Building Trust in Data Requires Building Trust with Communities | DQC 1 A BILL _________________________ IN THE COUNCIL OF THE DISTRICT OF COLUMBIA _________________________ To establish comprehensive privacy protections governing the collection, use, and disclosure of 1 covered individuals’ personal data by District government agencies, to establish 2 requirements for third party’s handling personal data of covered individuals, to provide 3 covered individuals with enforceable rights regarding their personal data, and to establish 4 a Chief Privacy Officer in the Office of the Chief Technology Officer. 5 BE IT ENACTED BY THE COUNCIL OF THE DISTRICT OF COLUMBIA, That this 6 act may be cited as the “District of Columbia Government Data Privacy and Protection Act of 7 2026”. 8 Sec 2. Definitions. 9 For the purposes of this act, the term: 10 (1) “Affirmative consent” means a clear affirmative act signifying a covered 11 individual’s freely given, specific, informed, and unambiguous agreement to the processing of 12 personal data for a purpose that is not required by law or necessary to provide a government 13 service requested by the individual. 14 _____________________________ Councilmember Christina Henderson _____________________________ Councilmember Brianne K. Nadeau _____________________________ Councilmember Zachary Parker _____________________________ Councilmember Janeese Lewis George 2 (2) “Agency” shall include agencies and independent agencies as defined in 15 section 1, paragraphs (1) and (13) of the District of Columbia Government Comprehensive Merit 16 Personnel Act of 1978, effective March 3, 1979 (D.C. Law 2-139, D.C. Official Code § 1– 17 603.01). 18 (3) “Authenticate” means to use reasonable means to determine that a request to 19 exercise any of the rights afforded under this act is being made by, or on behalf of, the covered 20 individual who is entitled to exercise such rights with respect to the personal data at issue. 21 (4) “Collect” and “collecting” mean gathering, obtaining, receiving, accessing, or 22 otherwise acquiring personal data of covered individuals by an agency. 23 (5) “Covered individual” means an individual or natural person who currently 24 resides in the District of Columbia, is currently employed in the District of Columbia, or who 25 accesses, uses, or otherwise interacts with District services, programs, systems, or benefits 26 provided by a District agency, regardless of the individual’s place of domicile or permanent 27 residence. 28 (6) “Personal data” means any information that is linked to an identified or 29 identifiable covered individual. “Personal data” does not include de-identified or aggregated 30 data, or publicly available information. 31 (7) “Process” or “processing” means any operation or set of operations performed, 32 whether by manual or automated means, on personal data or on sets of personal data, such as the 33 use, storage, disclosure, analysis, deletion or modification of personal data. 34 (8) “Sale of personal data” means the exchange of personal data for monetary or 35 other consideration by an agency to a third party. 36 (9) “Sensitive data” means personal data that includes: 37 3 (A) Racial or ethnic origin, religious beliefs, mental or physical health 38 condition or diagnosis, status as pregnant, sex life, sexual orientation, gender identity, union 39 membership, income level or indebtedness, or citizenship or immigration status; 40 (B) Health data or medical information; 41 (C) Genetic or biometric data; 42 (D) Personal data of a covered individual that is under the age of 18; and, 43 (E) A government-issued identifier, including a Social Security number, 44 passport number or driver's license number, that is not required by law to be displayed in public. 45 (10) “Third party” means any non-governmental entity, external entity, or person 46 that receives, collects, stores, processes, accesses, or transfers personal data from, on behalf of, 47 or at the direction of a District government agency. 48 (11) “Transfer” means to disclose, release, disseminate, make available, license, 49 rent, or share personal data to a third party orally, in writing, electronically, or by any other 50 means. 51 Sec 3. Duties of agencies. 52 (a) An agency that processes personal data shall: 53 (1) Limit the collection, processing, and transfer of personal data to what is 54 reasonably necessary to provide or maintain: 55 (A) A specific product or service requested by the covered individual to 56 whom the data pertains including routine administrative, operational, or service-provision 57 activities necessary to deliver the government service requested by the covered individual; or 58 4 (B) A communication by the agency to the covered individual that is 59 reasonably anticipated within the context of the relationship between the agency and the covered 60 individual. 61 (2) Not collect, process, or transfer sensitive data concerning a covered individual 62 except when such collection, processing, or transfer is strictly necessary to provide or maintain a 63 specific product or service requested by the covered individual to whom the sensitive data 64 pertains. 65 (3) Not sell sensitive data of any covered individual. 66 (4) Not sell personal data of any covered individual without obtaining the covered 67 individual’s affirmative, informed consent. 68 (5) Not transfer personal data concerning a covered individual to a third party 69 without obtaining the covered individual’s affirmative consent. 70 (6) Establish, implement and maintain reasonable administrative, technical and 71 physical data security practices to protect the confidentiality, integrity and accessibility of 72 personal data. 73 (7) Provide a mechanism for a covered individual to revoke the covered 74 individual’s affirmative consent and cease to process the data as soon as practicable, but not later 75 than 45 days after the receipt of such request. 76 (8) Direct to a clear, accessible privacy notice, as established by the Chief Privacy 77 Officer (“CPO”), regarding data practices and rights of covered individuals that includes: 78 (A) How a covered individual may exercise their rights, including how a 79 covered individual may appeal an agency decision; 80 5 (B) The categories of personal data collected and processed by the agency, 81 including a separate list of categories of sensitive data collected and processed by the agency; 82 (C) The purpose for collecting and processing each category of personal 83 data; 84 (D) The categories of personal data that the government agency transfers 85 to third parties, if any, and the purposes for those transfers; 86 (E) The length of time the agency retains each category of personal data; 87 and, 88 (F) Information on how a covered individual may exercise the right to opt 89 out of such sales or processing. 90 (9) Not deny services or benefits to a covered individual for exercising rights 91 under this act. 92 (b) Agencies may only share personal data with third parties if: 93 (1) The sharing is necessary for a governmental purpose; 94 (2) The personal data does not include sensitive data, unless required by law; and, 95 (3) The third party agrees to comply with equivalent or greater privacy 96 protections, including: 97 (A) The ability of the agency to request that the third party delete or return 98 all personal data to the agency as requested, unless retention of the personal data is required by 99 law; 100 (B) Providing to the agency all information in its possession necessary to 101 demonstrate the third party’s compliance with the obligations of this section; 102 6 (C) Only processing and transferring the data it receives from the agency 103 to the extent necessary to provide a service requested by the agency; and 104 (D) Detailing the type of data subject to processing and the duration of the 105 processing and data retention. 106 (4) The sharing is documented and subject to audit. 107 (c) Nothing in this section shall be construed to restrict an agency’s ability to: 108 (1) Comply with District laws and regulations; 109 (2) Comply with a civil, criminal or regulatory inquiry, investigation, subpoena or 110 summons by federal or other governmental authorities, except as prohibited by District law; 111 (3) Provide a product or service specifically requested by the covered individual; 112 (4) Assist another agency with any of the obligations under this act; 113 (5) Collect or process personal data to accomplish the agencies’ mission and core 114 functions; and, 115 (6) Ensure the data security and integrity of personal data as required by this act, 116 protect against spam, or protect and maintain networks and systems, including through 117 diagnostics, debugging, and repairs. 118 Sec 4. Requirements of third parties. 119 (a) A contract between an agency and a third party shall govern the third party’s data 120 processing procedures with respect to processing performed on behalf of the agency. The 121 contract shall be binding and clearly set forth instructions for processing data, the nature and 122 purpose of processing, the type of data subject to processing, the duration of processing and the 123 rights and obligations of both parties. The third party shall adhere to the instructions of the 124 agency and only process and transfer the data it receives from the agency to the extent necessary 125 7 to provide a service requested by the agency, as set out in the contract. The contract shall also 126 require that the third party: 127 (1) Ensure that each person processing personal data is subject to a duty of 128 confidentiality with respect to the data; 129 (2) At the agency’s direction, delete or return all personal data to the agency as 130 requested at the end of the provision of services, unless retention of the personal data is required 131 by law; 132 (3) Upon the reasonable request of the agency, make available to the agency all 133 information in its possession necessary to demonstrate the third parties compliance with the 134 obligations under this act; 135 (4) After providing the agency an opportunity to object, engage any 136 subcontractor pursuant to a written contract that requires the subcontractor to meet the 137 obligations of the third party with respect to the personal data; and, 138 (5) Be prohibited from combining personal data that the third party receives from 139 or on behalf of an agency with personal data that the third party receives from or on behalf of 140 another person or collects from the interaction of the third party with an individual. 141 (b) A third party shall establish, implement and maintain reasonable administrative, 142 technical and physical data security practices to protect the confidentiality, integrity and 143 accessibility of personal data appropriate to the volume and nature of the personal data at issue. 144 (c) Any third party that receives personal data from an agency shall, upon receiving a 145 request for such data from any federal, state, or local government entity: 146 8 (1) Review the legal validity of the request, including whether it is lawfully 147 issued, within the authority of the requesting entity, and narrowly tailored to the data sought; 148 and, 149 (2) Challenge the request in a court of competent jurisdiction where the third 150 party has a reasonable basis to believe that the request is overbroad, not supported by sufficient 151 legal process, or inconsistent with applicable law or contractual obligations. 152 (d)(1) A third party shall not disclose personal data in response to a government request 153 unless the request is accompanied by a warrant, subpoena, court order, or another form of legally 154 binding process recognized under applicable law. 155 (2) The third party shall promptly notify the originating agency of any 156 government request for data, unless legally prohibited. Where not prohibited by law, the third 157 party shall make reasonable efforts to notify affected individuals prior to disclosure. 158 (3) If disclosure is required, the third party shall disclose only the minimum 159 amount of data necessary to comply with the request, take reasonable steps to narrow or modify 160 the request, and seek protective orders or confidentiality agreements where appropriate. 161 (e) A third party may not voluntarily provide personal data to any government entity 162 absent a legally binding request or express authorization from the originating agency and 163 consistency with District law. 164 (f) Third parties shall maintain records of all government requests received and provide 165 periodic reports to the agency, including the number of requests, the type of legal process used, 166 and whether requests were challenged. 167 (g) All agency contracts involving the transfer of personal data shall require compliance 168 with this section as a material term of the agreement. 169 9 (h) Failure to comply with this section shall constitute a material breach of contract and 170 may result in termination, damages, and debarment from future District contracts. 171 Sec 5. Rights of covered individuals 172 (a) Covered individuals shall have the right to: 173 (1) Confirm whether or not an agency is collecting or processing the covered 174 individual’s personal data and obtain: 175 (A) Categories of data collected; 176 (B) Purpose of processing; and, 177 (C) Categories of recipients; 178 (2) Obtain a copy of the personal data collected or processed; 179 (3) Correct inaccuracies in the covered individual's personal data; 180 (4) Delete personal data provided by, or obtained about, the covered individual, 181 unless the data is required by law to be retained; and, 182 (5) Obtain from an agency a list of specific third parties, other than natural 183 persons, to which the agency has transferred or sold: 184 (A) The covered individual’s personal data; or, 185 (B) Any personal data. 186 (6) Opt-out of the transfer or sale of personal data for purposes not required by 187 law or necessary to provide a government service. 188 (b) (1) Agencies shall respond to verified requests within sixty days after receipt of the 189 request. 190 10 (2) The agency shall inform the covered individual within forty-five days after 191 receipt of the request of any justification for declining to provide the requested information and 192 provide instructions for how to appeal the decision. 193 (c) A covered individual may exercise rights under this section by a secure and reliable 194 means established by CPO and described to the covered individual in the agency’s privacy 195 notice. 196 (d) Information provided in response to a covered individuals’ request shall be provided 197 by an agency once per covered individual during any four-month period. 198 (e) Nothing in this section shall be construed to provide a basis for a private right of 199 action or any other remedy, claim, or cause of action for any violation of this act. The CPO and 200 the Office of the Attorney General for the District of Columbia (“OAG”) shall have authority to 201 investigate and enforce this act. 202 Sec 6. Chief Privacy Officer. 203 (a) There is established within the Office of the Chief Technology Officer (“OCTO”) a 204 Chief Privacy Officer (“CPO”) that shall be appointed by the Chief Technology Officer 205 (“CTO”). The CPO shall be a member in good standing with the DC Bar. 206 (b) The CPO shall: 207 (1) Be directly responsible for coordinating the related responsibilities of 208 cybersecurity, data governance, and privacy. 209 (2) Develop and implement written policies and procedures to ensure the privacy 210 and security of covered individuals’ personal data; 211 (3) Ensure compliance with applicable federal and state laws and regulations 212 relating to data privacy; 213 11 (4) Issue written findings, recommendations, or directives to an agency to ensure 214 compliance with this act, including requiring the agency to modify its practices, implement 215 safeguards, or cease unlawful data processing activities, and may coordinate with OAG to ensure 216 compliance; 217 (5) Conduct or require privacy impact assessments for applicable information 218 technology systems or programs; 219 (6) Establish government-wide standards for the collection, use, retention, and 220 disclosure of covered individuals’ personal data and sensitive data; 221 (7) Coordinate with the Chief Data Officer, Chief Information Officer, or 222 equivalent positions, regarding the investigation and notification of breaches of personal data; 223 (8) Provide training and guidance to agencies regarding data privacy requirements 224 and best practices; 225 (9) Conduct periodic reviews of agency practices relating to the handling of 226 personal data; 227 (10) Receive and resolve complaints; 228 (11) Receive and resolve disputes among agencies related to data privacy in 229 writing; 230 (12) Participate in audits related to data privacy conducted by the District of 231 Columbia Auditor and the Office of the Inspector General; 232 (13) Provide an annual report to the CTO to publish in August of every year 233 beginning after the effective date of this act, and 234 (14) Advise the CTO on matters relating to privacy and data protection. 235 (d) The CPO shall, in partnership with agencies: 236 12 (1) Develop a process by which covered individuals may appeal data request 237 decisions made by agencies; and, 238 (2) Develop a data privacy bill of rights, accessible to covered individuals on the 239 CPO’s webpage, and directly linked on webpages of agencies that collect or process personal 240 data of covered individuals. 241 Sec 7. Enforcement 242 (a) The OAG may issue written findings, recommendations, or directives to an agency to 243 ensure compliance with this act, including requiring the agency to modify its practices, 244 implement safeguards, or cease unlawful data processing activities. 245 (b) The OAG may require an agency to enter into a compliance agreement that includes 246 specific corrective actions, timelines for implementation, and ongoing monitoring or reporting 247 obligations. 248 (c) An agency found to be in violation of this act may be subject to appropriate 249 administrative remedies under District law, including required remediation, changes to data 250 practices, training requirements, or other corrective measures designed to ensure future 251 compliance. 252 (d) The OAG may require periodic reporting from agencies regarding their data practices, 253 risk assessments, data sharing activities, and compliance with this act. 254 (e) In determining the appropriate remedy or corrective action, the OAG may consider 255 the nature and seriousness of the violation, the number of individuals affected, the sensitivity of 256 the data, the risk of harm, whether the violation was part of a pattern or practice, and whether the 257 violation resulted from human or technical error. 258 13 (f) Nothing in this section shall be construed to limit any authority of the OAG under 259 District law or to impair the application of any other law governing the conduct of District 260 agencies. 261 Sec 8. Applicability 262 (a) This act shall apply upon the date of inclusion of its fiscal effect in an approved 263 budget and financial plan. 264 (b) The Chief Financial Officer shall certify the date of the inclusion of the fiscal effect in 265 an approved budget and financial plan, and provide notice to the Budget Director of the Council 266 of the certification. 267 (c)(1) The Budget Director shall cause the notice of the certification to be published in 268 the District of Columbia Register. 269 (2) The date of publication of the notice of the certification shall not affect the 270 applicability of this act. 271 Sec. 9. Fiscal impact statement. 272 The Council adopts the fiscal impact statement in the committee report as the fiscal 273 impact statement required by section 4a of the General Legislative Procedures Act of 1975, 274 approved October 16, 2006 (120 Stat. 2038; D.C. Official Code § 1-301.47a). 275 Sec. 10. Effective date. 276 This act shall take effect following approval by the Mayor (or in the event of veto by the 277 Mayor, action by the Council to override the veto) and a 30-day period of congressional review 278 as provided in section 602(c)(1) of the District of Columbia Home Rule Act, approved December 279 24, 1973 (87 Stat. 813; D.C. Official Code § 1-206.02(c)(1)). 280