A.R.S. tit. 18 | Title 18 — Information Technology

Chapter 1 Government Information Technology

Article 1 General Provisions

§ 18-101 Definitions

In this chapter, unless the context otherwise requires:

"Budget unit" means a department, commission, board, institution or other agency of the state receiving, expending or disbursing state funds or incurring obligations of the state including the Arizona board of regents but excluding the universities under the jurisdiction of the Arizona board of regents, the community college districts and the legislative or judicial branches.
"Committee" means the information technology authorization committee.
"Department" means the department of administration.
"Director" means the director of the department.
"Disaster recovery" means the measures required to mitigate the loss of information technology capability.
"Information technology" means all computerized and auxiliary automated information processing, telecommunications and related technology, including hardware, software, vendor support and related services, equipment and projects.

§ 18-102 Government information technology

The department is responsible for government information technology functions as prescribed in this chapter.

§ 18-103 Powers and duties of director

In regard to government information technology, the director shall:

Appoint a chief information officer for information technology.
Establish minimum qualifications for each position authorized for the department for government information technology. The qualifications shall be subject to the review of the information technology authorization committee.
Employ, determine the conditions of employment and prescribe the duties and powers of administrative, professional, technical, secretarial, clerical and other persons subject to title 41, chapter 4, article 4 as may be necessary in the performance of the department's duties and contract for the services of outside advisors, consultants and aides as may be reasonably necessary. Employees of the department shall meet the minimum qualifications established pursuant to this section.

§ 18-104 Powers and duties of the department; violation; classification

A. The department shall:

Develop, implement and maintain a coordinated statewide plan for information technology. This includes:

(a) Adopting statewide technical and coordination standards for information technology.

(b) Serving as statewide coordinator for information technology resources.

(c) Developing a statewide disaster recovery plan, identifying risks in each budget unit and directing agencies to adopt risk mitigation strategies, methods and procedures to minimize the risks.

(d) Developing a list of approved department projects by priority category.

(e) Developing a detailed list of information technology assets that are owned, leased or employed by this state.

(f) Evaluating and either approving or disapproving budget unit information technology plans. Budget units shall submit information technology plans that include quality assurance plans and disaster recovery plans to the department each year on or before May 15. The legislative and judicial departments of state government shall submit information technology plans on or before September 1 for information purposes.

(g) Evaluating specific information technology projects relating to the approved budget unit and statewide information technology plans in consultation with the statewide information security and privacy office in the Arizona department of homeland security. The department shall approve or reject projects with total costs of at least $25,000 but not more than $1,000,000 and may establish conditional approval criteria, including procurement purchase authority. If the total project costs exceed $1,000,000, the department shall evaluate the project and make recommendations to the information technology authorization committee. If the total project costs exceed $5,000,000, the department shall require the budget unit to contract with an independent third party to review and guide the technology approach, scope, estimated cost, timeline for completion and overall feasibility of the project before making recommendations to the information technology authorization committee. On or before the thirtieth day following the last day of each calendar quarter, the budget unit shall submit a report from the independent third party to the information technology authorization committee and the joint legislative budget committee regarding the progress of each ongoing project. As part of a budget request for an information technology project that has total costs of at least $25,000, a budget unit shall indicate the status of review by the department. Projects shall not be artificially divided to avoid review by the department.

Require that budget units incorporate a life-cycle analysis into the information technology planning, budgeting and procurement processes.
Require that budget units demonstrate expertise to carry out information technology plans, either by employing staff or contracting for outside services.
Monitor information technology projects that the department considers to be major or critical, including expenditure and activity reports and periodic review.
Temporarily suspend the expenditure of monies if the department determines that the information technology project is at risk of failing to achieve its intended results or does not comply with the requirements of this section.
Continuously study emergent technology and evaluate its impact on this state's system.
Advise each budget unit as necessary and report to the committee on an annual basis.
Provide to budget units information technology consulting services it deems necessary, either directly or by procuring outside consulting services.
Maintain all otherwise confidential information received from a budget unit pursuant to this section as confidential.
Provide staff support to the committee.
Subject to section 35-149, accept, spend and account for grants, monies and direct payments from public or private sources and other grants of monies or property to conduct programs that it deems consistent with the government information technology purposes and objectives of the department.
Adopt rules it deems necessary or desirable to further the government information technology objectives and programs of the department.
Formulate policies, plans and programs to effectuate the government information technology purposes of the department.
Advise and make recommendations to the governor and the legislature on all matters concerning its objectives.
Contract and enter into interagency and intergovernmental agreements pursuant to title 11, chapter 7, article 3 with any public or private party.
Have an official seal that shall be judicially noticed.
Establish an interactive online directory of codes, rules, ordinances, if available electronically, and statutes to assist individuals and businesses with regulatory requirements and obligations. As provided in this paragraph, counties, municipalities and budget units shall submit information in a manner and format prescribed by the agency.
Manage enterprise-level information technology infrastructure, except that the information security and privacy office in the Arizona department of homeland security shall manage the information security aspects of the infrastructure.
Develop strategies to protect the information technology infrastructure of this state and the data that is stored on or transmitted by the infrastructure.
Temporarily suspend access to information technology infrastructure when directed by the Arizona department of homeland security and consult with the Arizona department of homeland security regarding security policies, standards and procedures.

B. The department shall advise the judicial and legislative branches of state government concerning information technology.

C. The department may examine all books, papers, records and documents in the office of any budget unit and may require any state officer of the budget unit to furnish information or statements necessary to carry out this chapter.

D. The director, any member of the director's staff or any employee who knowingly divulges or makes known in any manner not permitted by law any particulars of any confidential record, document or information is guilty of a class 5 felony.

§ 18-106 Electronic and digital signatures; exemptions; definitions

A. The department, in consultation with the state treasurer, shall adopt policies or rules pursuant to title 41, chapter 6 establishing policies and procedures for the use of electronic and digital signatures by all state agencies, boards and commissions for documents filed with and by all state agencies, boards and commissions.

B. Unless otherwise provided by law, an electronic signature that complies with this section may be used to sign a writing on a document that is filed with or by a state agency, board or commission, and the electronic signature has the same force and effect as a written signature.

C. An electronic signature shall be unique to the person using it, shall be capable of reliable verification and shall be linked to a record in a manner so that if the record is changed the electronic signature is invalidated.

D. Except for returns, statements or other documents filed pursuant to titles 42 and 43, a document that contains an electronic signature that is a digital signature shall comply with the policies or rules adopted pursuant to subsection A of this section.

E. The following records are not public records and are exempt from public inspection and reproduction pursuant to title 39, chapter 1, article 2:

Records containing information that would disclose or may reasonably lead to the disclosure of any component in the process used to execute or adopt an electronic or digital signature if the disclosure would or may reasonably cause the loss of sole control over the electronic or digital signature from the person using it.
Records that if disclosed would jeopardize or may reasonably lead to jeopardizing the security of a certificate issued in conjunction with a digital signature.

F. For the purposes of this section:

"Certificate" means a computer-based record that is contained in a document with a digital signature and that identifies the subscriber, contains the subscriber's public key and is digitally signed by the entity issuing the certificate.
"Digital signature" means a type of electronic signature.
"Electronic signature" either:

(a) Means an electronic or digital method of identification that complies with the requirements of this section and that is executed or adopted by a person with the intent to be bound by or to authenticate a record.

(b) Includes a digital signature.

"Entity issuing the certificate" means a person that creates and issues a certificate and notifies the subscriber listed in the certificate of the contents of the certificate.
"Person" means a human being or an organization capable of signing a document, either legally or as a matter of fact.
"Private key" means the key of a key pair that is used to create a digital signature.
"Public key" means the key of a key pair that is used to verify a digital signature.
"Record" means information that is inscribed in a tangible medium or that is stored in an electronic or other medium and that is retrievable in a physically perceivable form. Record includes electronic records and printed, typewritten and tangible records.
"Subscriber" means a person that is the subject listed in a certificate, accepts that certificate and holds a private key that corresponds to a public key listed in that certificate.

Article 2 Information Technology Authorization Committee

§ 18-121 Information technology authorization committee; members; terms; duties; compensation; definition

A. The information technology authorization committee is established consisting of the following members:

One member of the house of representatives who is appointed by the speaker of the house of representatives and who shall serve as an advisory member.
One member of the senate who is appointed by the president of the senate and who shall serve as an advisory member.
Four members from private industry who are appointed by the governor pursuant to section 38-211, or their designees, and who are knowledgeable in information technology.
One local government member and one federal government member who are appointed by the governor and who shall serve as advisory members.
Two members who are directors of state agencies and who are appointed by the governor, or their designees.
The administrative director of the courts or the director's designee.
The director of the department of administration or the director's designee, who shall be the chairperson of the committee but for all other purposes shall serve as an advisory member.
Two members from either private industry or state government who are appointed by the governor, or their designees.
The staff director of the joint legislative budget committee, or the staff director's designee, who shall serve as an advisory member.
The statewide chief information security officer or the officer's designee.

B. Committee members who are from private industry serve two-year terms. The other members serve at the pleasure of their appointing officers.

C. For all budget units and the legislative and judicial branches of state government, the committee shall:

Review established statewide information technology standards and the statewide information technology plan.
Review the minimum qualifications established by the director for each position authorized for the department for information technology.
Approve or disapprove all proposed information technology projects, including project changes and contract amendments, that exceed a total cost of $1,000,000, excluding public monies from county, municipal and other political subdivision sources that are not deposited in a state fund. The committee shall also approve or disapprove any proposed information technology project involving more than one budget unit if the collective total development cost of the project is expected to be more than $1,000,000. As part of a budget request for an information technology project that has total costs of more than $1,000,000, a budget unit and the legislative and judicial branches of state government shall indicate the status of review by the committee. Projects shall not be artificially divided to avoid review by the committee.
Develop a report format that incorporates the life-cycle analysis for use in submitting project requests to the committee.
Require expenditure and activity reports from a budget unit or the legislative or judicial branch of state government on implementing information technology projects approved by the committee.
Conduct periodic reviews on the progress of implementing information technology projects approved by the committee.
Monitor information technology projects that the committee considers to be major or critical.
Temporarily suspend the expenditure of monies if the committee determines that the information technology project is at risk of failing to achieve its intended results or does not comply with the requirements of this chapter.
Hear and decide appeals made by budget units regarding the department's rejection of their proposed information technology plans or projects.
Report to the governor, the speaker of the house of representatives, the president of the senate and the secretary of state at least annually on all matters concerning its objectives. This includes:

(a) Its review of the statewide information technology plan developed by the department.

(b) The findings and conclusions of its periodic reviews.

Adopt rules it deems necessary or desirable to further the objectives and programs of the committee.

D. The committee shall meet at the call of the chairperson.

E. Members of the committee are not eligible to receive compensation but are eligible to receive reimbursement for expenses pursuant to title 38, chapter 4, article 2.

F. For the purposes of this section, "advisory member" means a member who gives advice to the other members of the committee at committee meetings but who is not eligible to vote and is not a member for purposes of determining whether a quorum is present.

Article 3 Alternative Access to Electronic or Information Technology

§ 18-131 Definitions

In this article, unless the context otherwise requires:

"Disability" means a physical or mental impairment that substantially limits one or more major life activities and includes having a record of or being regarded as having such an impairment.
"Electronic or information technology" means all electronic information processing hardware and software, including telecommunications and any electronic information equipment or interconnected system that is used in acquiring, storing, manipulating, managing, moving, controlling, displaying, switching, interchanging, transmitting and receiving data or information, including audio, graphics and text.

§ 18-132 Alternative methods of access to electronic or information technology; complaint procedure; rules

A. In order to improve accessibility of future electronic or information technology and increase the successful employment and access to government services for individuals with disabilities, particularly blind and visually impaired and deaf and hard-of-hearing persons, a budget unit, in developing, procuring, maintaining or using electronic or information technology through the use of state monies, shall ensure that the electronic or information technology provides comparable access to individuals with disabilities in accordance with the accessibility standards adopted under section 508 of the rehabilitation act of 1973 (29 United States Code section 794d) unless doing so would impose an undue burden on the budget unit.

B. The budget unit that contracts with a vendor that provides these products or services is subject to this article for the provision of electronic or information technology or for the provision of related services and shall agree to respond to and make a good faith effort to resolve any complaint regarding accessibility. The department of administration shall establish a complaint procedure for all budget units, except the supreme court shall establish a complaint procedure for the courts. The complaint procedures for the department of administration and the supreme court shall be consistent with section 508 of the rehabilitation act of 1973 to be used by an individual with a disability who alleges that a budget unit failed to comply with this article.

C. The department of administration shall adopt rules that are necessary to implement this article and revise those rules as necessary based on any amendments to section 508 of the rehabilitation act of 1973, including an undue burden process that is consistent with the section 508 federal acquisition regulation provisions. The department of administration shall begin the rule making process by October 1, 2004.

Chapter 2 Network Access

Article 1 Acceptable Use Policy

§ 18-201 Definitions

In this article, unless the context otherwise requires:

"Agency":

(a) Means any board, commission, department or other administrative unit of this state established by the Constitution of Arizona or by enactment of the legislature.

(b) Includes the legislature, the courts and the governor.

"Agency web site" means an agency owned, operated or funded web site connected to the internet and includes web sites accessed through the "Arizona@yourservice" portal.
"Privacy policy statement" means a description of an agency's information practices.

§ 18-202 Obligations of state agencies obtaining information on line

An agency web site provided by this state shall contain a privacy policy statement to disclose the information gathering and dissemination practices related to the internet. The privacy policy statement shall describe at a minimum the agency's information practices with regard to the following matters:

What services the site provides.
The information the agency obtains from individuals on line.
A person's option to choose to proceed with the transaction and any alternatives available.
How the agency uses the information.
Whether and under what circumstances the agency discloses the obtained information to other entities or persons.
Whether other entities or persons are collecting information through the agency web site.
A general description of the security measures in place to protect a person's information without compromising the integrity of the security measures.

§ 18-203 Agency reports; availability on line

A. An agency that maintains an agency web site shall post on the agency web site a copy of any annual report of activities that the agency:

Is required by law to make.
Elects to make.

B. An agency that posts a copy of an annual report pursuant to subsection A of this section shall not distribute printed copies of the report except:

To the governor, the president of the senate and the speaker of the house of representatives.
The agency shall distribute a sufficient number of printed copies of the annual report to the Arizona state library, archives and public records. The agency shall include a notice on the agency web site that a copy of the annual report is available for interlibrary loan from the Arizona state library, archives and public records.
Pursuant to a request made pursuant to title 39.

C. An agency that posts a copy of an annual report pursuant to subsection A of this section:

Shall send an electronic or printed notification to the governor, each member of the house of representatives and the senate and the director of the Arizona state library, archives and public records that the annual report has been posted on the agency web site.
May send an electronic or printed notification to any person not specified in paragraph 1 of this subsection that the annual report has been posted on the agency web site.

D. The printed copies of an annual report distributed pursuant to subsection B of this section shall comply with the requirements of section 39-102.

Chapter 3 Governmental Reporting of Information

Article 1 General Provisions

§ 18-301 Definitions

In this chapter, unless the context otherwise requires:

"Agency website" means a website that is connected to the internet and that is owned, operated or funded by a local government.
"Local government" means:

(a) A county, city or town with a population of more than twenty-five hundred persons.

(b) Any community college district and school district having a student count of more than six hundred pupils.

"State government" means any department, commission, board, institution or other agency of the state organization receiving, expending or disbursing state funds or incurring obligations against the state.

§ 18-302 Comprehensive internet web portal of local governments

The department of administration shall establish an internet web portal that provides a list of all local governments with jurisdiction over any address entered by a user. Each listing shall be linked to an agency website maintained by each local government that shall primarily contain the following information:

The name of the local government's governing board with official contact information for each board member, including a phone number for direct contact by constituents.
The name and contact information for the administrative head of the local government.
Information for how the governing board and administrative head of the local government are selected, including dates of the next election, if any, durations of terms and names and contact information of appointing authorities, as applicable.
Information on taxes or fees controlled by the local government, including the total taxes per capita of the local government for the population within its jurisdiction along with a statewide average of all similar local governments as calculated by the department, and proposed changes in the taxes or fees.
Information on special elections, which shall be posted at least ninety days in advance of the election date.
A link to the official internet website required by section 41-725.
The total value of all outstanding debt obligations, including the actuarial value of unfunded pension liabilities and the equivalent amount on a per capita basis for the population within the local government's jurisdiction.

§ 18-303 Reporting of public funding for public communications

A. Every local government shall report to the department of administration all expenditures for communications that promote an individual elected public official and that include the official's name or physical likeness. This subsection does not apply to communications that are required by statute, ordinance or rule and activities that are conducted in the normal course of the local government's operations, including routine communications such as regular agendas, notices, regular reports and minutes of meetings.

B. The department shall maintain a searchable database of these expenditures, including the type of medium and total expenditures.

§ 18-304 Debt reporting by state and local governments; database

A. State government and all local governments shall report to the department of administration all incurred debt, including the date of issue, purpose, original amount, current balance, interest paid to date and principal and interest paid in the latest full fiscal year according to a schedule determined by the department.

B. The department of administration shall maintain an online accessible and searchable database and, subject to approval by the joint legislative budget committee, may require additional information that is not listed in this section.

§ 18-305 Reports; electronic submission; exception; posting

A. Notwithstanding any other law, state agencies may submit all statutorily required reports and budget estimates electronically, except those required by section 35-113.

B. Each state agency shall post all statutorily required reports and budget estimates on the state agency's website.

C. Each state agency shall consult with the secretary of state to ensure that the Arizona state library, archives and public records receives an adequate number of copies of the statutorily required reports and budget estimates in a format that is agreed on for the purposes of the state archives pursuant to section 41-151.08.

D. Each state agency that maintains a generally accessible internet website, or for which a generally accessible website is maintained, shall include a link on that website to the website of the ombudsman-citizens aide and a statement that reads as follows: "The ombudsman-citizens aide helps citizens to resolve ongoing issues with state agencies."

Chapter 4 Network Services

Article 1 General Provisions

§ 18-401 Information technology fund

A. The information technology fund is established for use by the department and the committee. Monies in the fund are subject to legislative appropriation.

B. State agencies that are subject to section 41-750, all budget units and the legislative and judicial branches of state government shall contribute a pro rata share of the overall cost of information technology services provided by the department or committee. The pro rata share is payable by payroll fund source, and the resultant amount shall be deposited in the information technology fund. For all budget units and the legislative and judicial branches of state government, the pro rata share is 0.61 percent of the total payroll. Total payroll includes all fund sources, including the state general fund, federal monies, special revenue funds, intergovernmental revenue monies, trust funds and other payroll fund sources.

C. A claim for the pro rata share percentage payment shall be submitted according to the fund source, with the accompanying payroll, to the department of administration for deposit in the information technology fund.

D. Notwithstanding section 35-190, monies in the information technology fund do not revert to the state general fund at the end of each fiscal year.

§ 18-402 Statewide e-rate program fund

A. The statewide e-rate program fund is established. The department shall administer the fund. The statewide e-rate program fund shall consist of:

Monies received pursuant to the e-rate program under the telecommunications act of 1996 or other grants to assist this state in improving broadband internet and telecommunications access for public schools and libraries in this state.
Monies received as a result of an intergovernmental agreement between the department and other political subdivisions of this state.
Monies received from private grants or donations if designated for the fund by the grantor or donor.

B. Monies in the fund shall be used to assist public school districts, charter schools and libraries to submit applications for funding pursuant to subsection C and to fulfill the terms of an intergovernmental agreement or private contract pursuant to subsection D.

C. Subject to the conditions of subsection E and in cooperation with the Arizona state library, archives and public records, the department shall develop policies and procedures for the e-rate application for public school districts, charter schools and libraries in this state, including providing technical assistance.

D. The department may enter into contracts with private organizations and intergovernmental agreements with other state agencies and political subdivisions of this state to administer the statewide e-rate program.

E. Participation in the e-rate program by libraries is voluntary. The Arizona state library, archives and public records shall determine e-rate eligibility applications.

Article 2 Department of Administration

§ 18-421 State web portal fund; exemption

A. The state web portal fund is established and is subject to legislative appropriation. The department shall administer the fund. The state web portal fund shall consist of:

Monies appropriated to the fund by the legislature.
Any web portal usage fees collected by this state or under any agreement between this state and an independent contractor providing services for the common web portal minus the amount of fees collected pursuant to section 28-446 for deposit in the Arizona highway user revenue fund.
Monies received from private grants or donations if designated for the fund by the grantor or donor.
Monies received from the federal government by grant or otherwise to assist this state in providing any common web portal projects.

B. Monies in the state web portal fund may be used for:

Improving or expanding this state's information technology services and projects, including the common web portal.
Operating costs of the government transformation office.

C. If this state chooses to use an independent contractor to provide services for the state web portal, the selection of the independent contractor may be made using a competitive bid process.

D. Monies in the state web portal fund are exempt from the provisions of section 35-190 relating to lapsing of appropriations.

§ 18-422 State agencies; third-party electronic service provider authorization; definitions

A. Any state agency may authorize a person to be a third-party electronic service provider.

B. The written agreement between the state agency and the authorized third-party electronic service provider may be for a limited number of services and may limit the persons that may receive the services.

C. An authorized third-party electronic service provider must meet all of the requirements established by the state agency and must be selected through a competitive bid process.

D. An authorized third-party electronic service provider:

Shall submit to the state agency all statutorily prescribed fees and taxes it collects and deposit pursuant to sections 35-146 and 35-147 the fees and taxes with the state treasurer.
May collect and retain a reasonable and commensurate fee for its services.

E. For the purposes of this section:

"Authorized third-party electronic service provider" means an entity that has executed a written agreement with a state agency and that is authorized by the state agency to provide electronic transmission services between the state agency, private citizens, other government agencies and public and private entities in this state or in any other state, territory or country.
"Person" includes a corporation, company, partnership, firm, association or society.
"State agency" means any department, office, agency, commission, board or other instrumentality of this state that receives, spends or disburses state monies or incurs obligations against this state.

Article 3 Secretary of State

§ 18-441 Data processing acquisition fund

A. A data processing acquisition fund is established to improve data processing in the office of secretary of state consisting of the fees collected pursuant to subsection B of this section. The secretary of state shall administer the fund. Monies in the fund are continuously appropriated to the office of secretary of state.

B. The secretary of state may assess a special recording fee of no more than six dollars for each filing under section 41-126, subsection A, paragraph 6, subdivisions (a) through (d). These fees are in addition to the fees collected under section 41-126, subsection A, paragraphs 6 through 9. The secretary of state shall deposit, pursuant to sections 35-146 and 35-147, all monies collected under these provisions in the data processing acquisition fund.

C. Monies in the data processing acquisition fund are exempt from the provisions of section 35-190 relating to lapsing of appropriations.

§ 18-443 Electronic database system; procedures

A. Subject to legislative appropriation or transfer of monies, the secretary of state shall develop electronic database systems for financial disclosures required under title 38, chapter 3.1, article 1 and lobbyist reporting requirements under title 41, chapter 7, article 8.1.

B. The electronic database system shall allow a county, city or town to elect to use the secretary of state's system subject to:

Approval of the local governing body.
The local governing body conforming the local governing body's financial disclosure requirement and lobbying disclosure requirements with requirements of this state.

C. This section does not require the secretary of state to provide for a system that complies with filing requirements other than those required in sections 18-444 and 38-543 and title 41, chapter 7, article 8.1.

§ 18-444 Duty to file financial disclosure statement; contents; exceptions

A. In addition to other statements and reports required by law, every public officer, as a matter of public record, shall file with the secretary of state on a form prescribed by the secretary of state a verified financial disclosure statement covering the preceding calendar year. The statement shall disclose:

The name and home or work address of the public officer, whether the public officer's spouse is a member of the public officer's household, the number of minor children who are members of the public officer's household and all names and addresses under which each does business. If disclosure of the identity of the public officer's spouse or minor child would otherwise be required, a public officer may comply with the identification requirement by using the term "spouse" or "minor child", as applicable.
The name and address of each employer and of each other source of compensation other than gifts amounting to more than one thousand dollars received during the preceding calendar year by the public officer and members of his household in their own names, or by any other person for the use or benefit of the public officer or members of his household, a description of the services for which the compensation was received and the nature of the employer's business. This paragraph shall not be construed to require the disclosure of individual items of compensation that constituted a portion of the gross income of the business from which the public officer or members of his household derived compensation.
For a controlled business, a description of the goods or services provided by the business, and if any single source of compensation to the business during the preceding calendar year amounts to more than ten thousand dollars and is more than twenty-five percent of the gross income of the business, the disclosure shall also include a description of the goods or services provided to the source of compensation. For a dependent business the statement shall disclose a description of the goods or services provided by the business and a description of the goods or services provided to the source of compensation from which the dependent business derived the amount of gross income described in section 38-541, paragraph 4. If the source of compensation for a controlled or dependent business is a business, the statement shall disclose a description of the business activities engaged in by the source of compensation.
The names and addresses of all businesses and trusts in which the public officer or members of his household, or any other person for the use or benefit of the public officer or members of his household, had an ownership or beneficial interest of over one thousand dollars at any time during the preceding calendar year, and the names and addresses of all businesses and trusts in which the public officer or any member of his household held any office or had a fiduciary relationship at any time during the preceding calendar year, together with the amount or value of the interest and a description of the interest, office or relationship.
All Arizona real property interests and real property improvements, including specific location and approximate size, in which the public officer, any member of his household or a controlled or dependent business held legal title or a beneficial interest at any time during the preceding calendar year, and the value of any such interest, except that this paragraph does not apply to a real property interest and improvements thereon used as the primary personal residence or for the personal recreational use of the public officer. If a public officer, any member of his household or a controlled or dependent business acquired or divested any such interest during the preceding calendar year, he shall also disclose that the transaction was made and the date it occurred. If the controlled or dependent business is in the business of dealing in real property interests or improvements, disclosure need not include individual parcels or transactions as long as the aggregate value of all parcels of such property is reported.
The names and addresses of all creditors to whom the public officer or members of his household, in their own names or in the name of any other person, owed a debt of more than one thousand dollars or to whom a controlled business or a dependent business owed a debt of more than ten thousand dollars which was also more than thirty percent of the total business indebtedness at any time during the preceding calendar year, listing each such creditor. This paragraph shall not be construed to require the disclosure of debts owed by the public officer or any member of his household resulting from the ordinary conduct of a business other than a controlled or dependent business nor shall disclosure be required of credit card transactions, retail installment contracts, debts on residences or recreational property exempt from disclosure under paragraph 5 of this subsection, debts on motor vehicles not used for commercial purposes, debts secured by cash values on life insurance or debts owed to relatives. It is sufficient disclosure of a creditor if the name and address of a person to whom payments are made is disclosed. If the public officer, any member of his household or a controlled or dependent business incurred or discharged a debt which is reportable under this subsection during the preceding calendar year, the report shall disclose that the transaction was made and the date it occurred.
The identification and amount of each debt exceeding one thousand dollars owed at any time during the preceding calendar year to the public officer and members of his household in their own names, or to any other person for the use or benefit of the public officer or any member of his household. The disclosure shall include the identification and amount of each debt exceeding ten thousand dollars to a controlled business or dependent business which was also more than thirty percent of the total indebtedness to the business at any time during the preceding calendar year. This paragraph shall not be construed to require the disclosure of debts from the ordinary conduct of a business other than a controlled or dependent business. If the public officer, any member of his household or a controlled or dependent business incurred or discharged a debt which is reportable under this subsection during the preceding year, the report shall disclose that the transaction was made and the date it occurred.
The name of each source of any gift, or accumulated gifts from a single source, of more than five hundred dollars received by the public officer and members of his household in their own names during the preceding calendar year, or by any other person for the use or benefit of the public officer or any member of his household except gifts received by will or by virtue of intestate succession, or received by way of distribution from any inter vivos or testamentary trust established by a spouse or by an ancestor, or gifts received from any other member of the household or relatives to the second degree of consanguinity.
A list of all business licenses issued to, held by or in which the public officer or any member of his household had an interest at any time during the preceding calendar year, including the name in which the license was issued, the type of business and its location.
A list of all bonds, together with their value, issued by this state or any political subdivision of this state and held at any time during the preceding calendar year by the public officer or any member of his household, which bonds issued by a single entity had a value in excess of one thousand dollars. If the public officer or any member of his household acquired or divested any bonds during the preceding calendar year which are reportable under this paragraph, the fact that the transaction occurred and the date shall also be shown.
The name of each meeting, conference or other event where the public officer is participating in the public officer's official capacity if travel-related expenses of one thousand dollars or more were incurred on behalf of the public officer and the travel-related expenses are not paid by the public officer.

B. If an amount or value is required to be reported pursuant to this section, it is sufficient to report whether the amount or value of the equity interest falls within:

Category 1, one thousand dollars to twenty-five thousand dollars.
Category 2, more than twenty-five thousand dollars to one hundred thousand dollars.
Category 3, more than one hundred thousand dollars.

C. This section does not require the disclosure of any information that is privileged by law.

D. The statement required to be filed pursuant to subsection A shall be filed by all persons who qualified as public officers at any time during the preceding calendar year on or before January 31 of each year with the exceptions that a public officer appointed to fill a vacancy shall, within sixty days following his taking of such office, file a financial disclosure statement covering as his annual period the twelve month period ending with the last full month prior to the date of his taking office, and a public officer whose final term expires less than thirty-one days into the immediately following calendar year may file the public officer's final financial disclosure at the same time as the disclosure for the last immediately preceding year.

E. The secretary of state shall prepare written guidelines, forms and samples for completing the financial disclosure statement required by this section. A copy of the guidelines, forms and samples shall be distributed to each public officer and shall be made available to each candidate required to file a financial disclosure statement pursuant to section 38-543.

F. Beginning January 1, 2017, the statement required to be filed in subsection D of this section may be filed by the public officer in a form prescribed by the secretary of state that includes authorization for future filings to be submitted in an electronic format. Any subsequent filings required to be filed in subsection D of this section may be filed in an electronic format as prescribed by the secretary of state. Beginning January 1, 2017, any statements that are required to be filed by a local public officer pursuant to an ordinance, rule, resolution or regulation adopted pursuant to section 38-545 may be filed in an electronic format as prescribed by the secretary of state.

Chapter 5 Network Security

Article 1 Computer Spyware

§ 18-501 Definitions

In this article, unless the context otherwise requires:

"Advertisement" means a communication the primary purpose of which is the commercial promotion of a commercial product or service, including communication on an internet website that is operated for a commercial purpose.
"Computer software" means a sequence of instructions that is written in any programming language and that is executed on a computer and does not include a web page or data components of web pages that are not executable independently of the web page.
"Damage" means any significant impairment to the integrity or availability of data, computer software, a system or information.
"Execute" means the performance of the functions or the carrying out of the instructions of the computer software.
"Intentionally deceptive" means any of the following:

(a) By means of an intentionally and materially false or fraudulent statement.

(b) By means of a statement or description that intentionally omits or misrepresents material information in order to deceive an owner or operator of a computer.

(c) By means of an intentional and material failure to provide any notice to an owner or operator of a computer regarding the installation or execution of computer software in order to deceive the owner or operator.

"Internet" means the global information system that is logically linked together by a globally unique address space based on the internet protocol, or its subsequent extensions, and that is able to support communications using the transmission control protocol or internet protocol suite, or its subsequent extensions, or other internet protocol compatible protocols, and that provides, uses or makes accessible, either publicly or privately, high level services layered on the communications and related infrastructure described in this paragraph.
"Owner or operator" means the owner or lessee of a computer or someone using the computer with the owner's or lessee's authorization. Owner or operator does not include any person who owns a computer before the first retail sale of the computer.
"Person" means any individual, partnership, corporation, limited liability company or other organization or any combination of these entities.
"Personally identifiable information" means any of the following with respect to an individual who is an owner or operator of a computer:

(a) First name or first initial in combination with last name.

(b) A home or other physical address including street name.

(d) A credit or debit card number or bank account number or any password or access code associated with a credit or debit card or bank account.

(e) A social security number, tax identification number, driver license number, passport number or any other government issued identification number.

(f) Any of the following information in a form that personally identifies an owner or operator of a computer:

(i) Account balances.

(ii) Overdraft history.

(iii) Payment history.

"Transmit" means to transfer, send or make available computer software, or any component of computer software, via the internet or any other medium, including local area networks of computers, any other nonwire transmission and a disk or other data storage device. Transmit does not include any action by a person providing any of the following:

(a) The internet connection, telephone connection or other means of transmission capability such as a compact disk or digital video disk through which the software was made available.

(b) The storage or hosting of the software program or an internet web page through which the software was made available.

(c) An information location tool, such as a directory, index, reference, pointer or hypertext link, through which the user of the computer located the software, unless the person receives a direct economic benefit from the execution of the software on the computer.

§ 18-502 Prohibited activities; applicability

A. It is unlawful for any person who is not an owner or operator of a computer to transmit computer software to a computer, with actual knowledge or with conscious avoidance of actual knowledge, and to use the software to do any of the following:

Modify, through intentionally deceptive means, settings that control any of the following:

(a) The page that appears when an owner or operator of a computer launches an internet browser or similar computer software used to access and navigate the internet.

(b) The default provider or web proxy that an owner or operator of a computer uses to access or search the internet.

Collect, through intentionally deceptive means, personally identifiable information:

(a) Through the use of a keystroke logging function that records all keystrokes made by an authorized user who uses the computer and transfers that information from the computer to another person.

(b) In a manner that correlates the information with data respecting all or substantially all of the websites visited by an owner or operator of the computer, other than websites operated by the person collecting the information.

(c) With respect only to information described in section 18-501, paragraph 9, by extracting such information from the hard drive of an owner's or operator's computer.

Prevent, through intentionally deceptive means, an owner's or operator's reasonable efforts to block the installation or execution of, or to disable, computer software by causing software that an owner or operator of the computer has properly removed or disabled automatically to reinstall or reactivate on the computer.
Intentionally misrepresent that computer software will be uninstalled or disabled by an owner's or operator's action.
Through intentionally deceptive means, remove, disable or render inoperative security, antispyware or antivirus computer software installed on the computer.
Take control of the computer by:

(a) Accessing or using the modem or internet service for the computer for the purpose of causing damage to the computer or causing an owner or operator to incur financial charges for a service that the owner or operator of the computer has not authorized.

(b) Opening multiple, sequential, stand-alone advertisements in an owner's or operator's internet browser without the authorization of the owner or operator that a reasonable computer user cannot close without turning off the computer or closing the internet browser.

Modify any of the following settings related to the computer's access to, or use of, the internet:

(a) Settings that protect information about an owner or operator of the computer for the purpose of stealing personally identifiable information of the owner or operator.

(b) Security settings for the purpose of causing damage to a computer.

Prevent an owner's or operator's reasonable efforts to block the installation of, or to disable, computer software, by doing either of the following:

(a) Presenting the owner or operator with an option to decline installation of computer software with knowledge that, if the option is selected, the installation nevertheless proceeds.

(b) Falsely representing that computer software has been disabled.

B. It is unlawful for any person who is not an owner or operator of a computer to do either of the following with regard to the computer:

Induce an owner or operator to install a computer software component on the computer by intentionally misrepresenting the extent to which installing the software is necessary for security or privacy reasons or in order to open, view or play a particular type of content.
Deceptively cause the execution on the computer of a computer software component with the intent of causing an owner or operator to use the component in a manner that violates any other provision of this section.

C. This section does not apply to any monitoring of, or interaction with, a subscriber's internet or other network connection or service, or a computer, by a telecommunications carrier, cable operator, video service provider, computer hardware or software provider or provider of information service or interactive computer service for network or computer security purposes, diagnostics, technical support, maintenance, repair, authorized updates of software or system firmware, authorized remote system management or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service or computer software, including scanning for and removing software prescribed under this article.

§ 18-503 Statewide concern; preemption

It is the intent of the legislature that this article is a matter of statewide concern. This article supersedes and preempts all rules, regulations, codes, ordinances and other laws adopted by a city, county, municipality or local agency regarding spyware and notices to consumers from computer software providers regarding information collection.

§ 18-504 Civil remedies; damages

A. In addition to any other remedies provided by law, the attorney general, or a computer software provider or a website or trademark owner who is adversely affected by a violation of this article, may bring an action against a person who violates this article to:

Enjoin further violations of this article.
Recover the greater of actual damages or one hundred thousand dollars for each separate violation of this article.

B. A single action or conduct that violates more than one paragraph of section 18-502, subsection A or B or at least one paragraph of section 18-502, subsection A and at least one paragraph of section 18-502, subsection B shall be considered multiple violations. The number of violations shall be based on the number of paragraphs violated.

C. In an action brought under this section, a court may:

Increase the damages up to three times the damages allowed by subsection A of this section if the defendant has engaged in a pattern and practice of violating this article.
Award costs and reasonable attorney fees to the prevailing party.

Article 2 Government Anti-Identification Procedures

§ 18-521 Definitions

In this article, unless the context otherwise requires:

"Entity identifying information" has the same meaning prescribed in section 13-2001.
"Governmental agency" means:

(a) Any board, commission, department or other administrative unit of this state established by the Constitution of Arizona or by enactment of the legislature and includes the legislature, the courts and the governor.

(b) Any county and any board, commission, department or other administrative unit of the county.

(d) Any other political subdivision of this state.

"Personal identifying information" has the same meaning prescribed in section 13-2001.

§ 18-522 Anti-identification procedures

A governmental agency shall develop and establish commercially reasonable procedures to ensure that entity identifying information or personal identifying information that is collected or obtained by the governmental agency is secure and cannot be accessed, viewed or acquired unless authorized by law. Nothing in this article shall be construed to restrict, diminish or otherwise affect the provisions of title 39.

Article 3 Internet Representations

§ 18-541 Definitions

In this article, unless the context otherwise requires:

"Electronic mail message" means a message sent to a unique destination that consists of a unique user name or mailbox and a reference to an internet domain, whether or not displayed, and to which an electronic mail message can be sent or delivered.
"Identifying information" means an individual's piece of information that can be used to access an individual's financial accounts or to obtain goods or services and that includes an individual's:

(a) Social security number.

(b) Driver license number.

(d) Credit or debit card number.

(e) Personal identification number.

(f) Automated or electronic signature.

(g) Unique biometric data.

(h) Account passwords.

"Internet" means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, that comprise the interconnected worldwide network of networks that employ the transmission control protocol or internet protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio.
"Web page" means a location with respect to the worldwide web that has a single uniform resource locator or other single location with respect to the internet.

§ 18-542 Prohibition

A person, with the intent to commit fraud or theft, shall not use a web page or electronic mail message or otherwise use the internet to solicit, request or take any action to induce another person to provide identifying information by representing that the person, either directly or by implication, is an online business without the authority or approval of the online business.

§ 18-543 Civil remedies; damages

A. A person who either is engaged in the business of providing internet access service to the public or owns a web page or trademark and who is adversely affected by reason of a violation of this article may bring an action against a person who violates this article to:

Enjoin further violations of this article.
Recover the greater of actual damages or two thousand five hundred dollars for each separate violation of this article.

B. A person, other than a person who is described in subsection A of this section, who is adversely affected by reason of a violation of this article may bring an action only against the person who violates this article to:

Enjoin further violations of this article.
Recover the greater of actual damages or five thousand dollars for each separate violation of this article.

C. The attorney general may bring an action against a person who violates this article to:

Enjoin further violations of this article.
Recover two thousand five hundred dollars per violation.

D. An action under this section must be brought within three years after the violation is discovered or by the exercise of reasonable diligence should have been discovered, whichever is earlier.

E. In an action under this section, the court may increase a damage award to an amount equal to not more than three times the amount otherwise available under this section if the court determines that the defendant has engaged in a pattern and practice of violating this article.

F. The attorney general may also recover reasonable attorney fees and costs.

G. For the purposes of this section, multiple violations of this article resulting from any single action or act shall constitute one violation.

§ 18-544 Violation; classification

A person who violates this article is guilty of a class 5 felony.

Article 4 Data Security Breaches

§ 18-551 Definitions

In this article, unless the context otherwise requires:

"Breach" or "security system breach":

(a) Means an unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information maintained as part of a database of personal information regarding multiple individuals.

(b) Does not include a good faith acquisition of personal information by a person's employee or agent for the purposes of the person if the personal information is not used for a purpose unrelated to the person and is not subject to further unauthorized disclosure.

"Court" means the supreme court, the court of appeals, the superior court, a court that is inferior to the superior court and a justice court.
"Encrypt" means to use a process to transform data into a form that renders the data unreadable or unusable without using a confidential process or key.
"Individual" means a resident of this state who has a principal mailing address in this state as reflected in the records of the person conducting business in this state at the time of the breach.
"Nationwide consumer reporting agency":

(a) Means a consumer reporting agency that compiles and maintains files on consumers on a nationwide basis as defined in 15 United States Code section 1681a(p).

(b) Does not include a nationwide specialty consumer reporting agency as defined in 15 United States Code section 1681a(x).

"Person":

(a) Means a natural person, corporation, business trust, estate, trust, partnership, association, joint venture, government or governmental subdivision or agency or any other legal or commercial entity.

(b) Does not include the department of public safety, a county sheriff's department, a municipal police department, a prosecution agency or a court.

"Personal information":

(a) Means any of the following:

(i) An individual's first name or first initial and last name in combination with one or more specified data elements.

(ii) An individual's user name or e-mail address, in combination with a password or security question and answer, that allows access to an online account.

(b) Does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.

"Prosecution agency" means the attorney general, a county attorney or a municipal prosecutor.
"Redact" means to alter or truncate a number so that not more than the last four digits are accessible and at least two digits have been removed.
"Security incident" means an event that creates reasonable suspicion that a person's information systems or computerized data may have been compromised or that measures put in place to protect the person's information systems or computerized data may have failed.
"Specified data element" means any of the following:

(a) An individual's social security number.

(b) The number on an individual's driver license issued pursuant to section 28-3166 or nonoperating identification license issued pursuant to section 28-3165.

(d) An individual's financial account number or credit or debit card number in combination with any required security code, access code or password that would allow access to the individual's financial account.

(e) An individual's health insurance identification number.

(f) Information about an individual's medical or mental health treatment or diagnosis by a health care professional.

(g) An individual's passport number.

(h) An individual's taxpayer identification number or an identity protection personal identification number issued by the United States internal revenue service.

(i) Unique biometric data generated from a measurement or analysis of human body characteristics to authenticate an individual when the individual accesses an online account.

§ 18-552 Notification of security system breaches; requirements; enforcement; confidentiality; civil penalty; preemption; exceptions

A. If a person that conducts business in this state and that owns, maintains or licenses unencrypted and unredacted computerized personal information becomes aware of a security incident, the person shall conduct an investigation to promptly determine whether there has been a security system breach.

B. If the investigation results in a determination that there has been a security system breach, the person that owns or licenses the computerized data, within forty-five days after the determination, shall:

Notify the individuals affected pursuant to subsection E of this section and subject to the needs of law enforcement as provided in subsection D of this section.
If the breach requires notification of more than one thousand individuals, notify both:

(a) The three largest nationwide consumer reporting agencies.

(b) The attorney general and the director of the Arizona department of homeland security, in writing, in a form prescribed by rule or order of the attorney general or the director of the Arizona department of homeland security or by providing the attorney general or the director of the Arizona department of homeland security with a copy of the notification provided pursuant to paragraph 1 of this subsection. In the absence of a common form developed by the attorney general and the Arizona department of homeland security, nothing shall prohibit a person from submitting the same notification to the attorney general and the Arizona department of homeland security to meet the requirements of this subsection.

C. A person that maintains unencrypted and unredacted computerized personal information that the person does not own or license shall notify, as soon as practicable, the owner or licensee of the information on discovering any security system breach and cooperate with the owner or the licensee of the personal information, including sharing information relevant to the breach with the owner or licensee. The person that maintains the data under an agreement with the owner or licensee is not required to provide the notifications required by subsection B of this section unless the agreement stipulates otherwise.

D. The notifications required by subsection B of this section may be delayed if a law enforcement agency advises the person that the notifications will impede a criminal investigation. On being informed by the law enforcement agency that the notifications no longer compromise the investigation, the person shall make the required notifications, as applicable, within forty-five days.

E. The notification required by subsection B, paragraph 1 of this section shall include at least the following:

The approximate date of the breach.
A brief description of the personal information included in the breach.
The toll-free numbers and addresses for the three largest nationwide consumer reporting agencies.
The toll-free number, address and website address for the federal trade commission or any federal agency that assists consumers with identity theft matters.

F. The notification required by subsection B, paragraph 1 of this section shall be provided by one of the following methods:

Written notice.
An email notice if the person has email addresses for the individuals who are subject to the notice.
Telephonic notice, if telephonic contact is made directly with the affected individuals and is not through a prerecorded message.
Substitute notice if the person demonstrates that the cost of providing notice pursuant to paragraph 1, 2 or 3 of this subsection would exceed $50,000, that the affected class of subject individuals to be notified exceeds one hundred thousand individuals or that the person does not have sufficient contact information. Substitute notice consists of all of the following:

(a) A written letter to the attorney general that demonstrates the facts necessary for substitute notice.

(b) Conspicuous posting of the notice for at least forty-five days on the website of the person if the person maintains one.

G. If a breach involves personal information as prescribed in section 18-551, paragraph 7, subdivision (a), item (ii) for an online account and does not involve personal information as defined in section 18-551, paragraph 7, subdivision (a), item (i), the person may comply with this section by providing the notification in an electronic or other form that directs the individual whose personal information has been breached to promptly change the individual's password and security question or answer, as applicable, or to take other steps that are appropriate to protect the online account with the person and all other online accounts for which the individual whose personal information has been breached uses the same user name and email address and password or security question or answer. If the breach of personal information as prescribed in section 18-551, paragraph 7, subdivision (a), item (ii) is for login credentials of an email account furnished by the person, the person is not required to comply with this section by providing the notification to that email address, but may comply with this section by providing notification by another method described in this subsection or by providing clear and conspicuous notification delivered to the individual online when the individual is connected to the online account from an internet protocol address or online location from which the person knows the individual customarily accesses the account. The person satisfies the notification requirement with regard to the individual's account with the person by requiring the individual to reset the individual's password or security question and answer for that account, if the person also notifies the individual to change the same password or security question and answer for all other online accounts for which the individual uses the same user name or email address and password or security question or answer.

H. A person that maintains the person's own notification procedures as part of an information security policy for the treatment of personal information and that is otherwise consistent with the requirements of this article, including the forty-five-day notification period required by subsection B of this section, is deemed to be in compliance with the notification requirements of subsection B, paragraph 1 of this section if the person notifies subject individuals in accordance with the person's policies if a security system breach occurs.

I. A person that complies with the notification requirements or security system breach procedures pursuant to the rules, regulations, procedures, guidance or guidelines established by the person's primary or functional federal regulator is deemed to be in compliance with the requirements of subsection B, paragraph 1 of this section.

J. A person is not required to make the notification required by subsection B of this section if the person, an independent third-party forensic auditor or a law enforcement agency determines after a reasonable investigation that a security system breach has not resulted in or is not reasonably likely to result in substantial economic loss to affected individuals.

K. Except for notifications provided pursuant to subsection F of this section, notifications provided to the attorney general and the director of the Arizona department of homeland security pursuant to this section are confidential pursuant to section 44-1525 and are exempt from disclosure under title 39.

L. A knowing and wilful violation of this section is an unlawful practice pursuant to section 44-1522, and only the attorney general may enforce such a violation by investigating and taking appropriate action pursuant to title 44, chapter 10, article 7. The attorney general may impose a civil penalty for a violation of this article not to exceed the lesser of $10,000 per affected individual or the total amount of economic loss sustained by affected individuals, but the maximum civil penalty from a breach or series of related breaches may not exceed $500,000. This section does not prevent the attorney general from recovering restitution for affected individuals.

M. The state legislature determines that security system breach notification is a matter of statewide concern. The power to regulate security system breach notification is preempted by this state, and this article supersedes and preempts all municipal and county laws, charters, ordinances and rules relating to issues regulated by this article.

N. This article does not apply to either of the following:

A person that is subject to title V of the Gramm-Leach-Bliley act (P.L. 106-102; 113 Stat. 1338; 15 United States Code sections 6801 through 6809).
A covered entity or business associates as defined under regulations implementing the health insurance portability and accountability act of 1996, 45 Code of Federal Regulations section 160.103 (2013) or a charitable fundraising foundation or nonprofit corporation whose primary purpose is to support a specified covered entity, if the charitable fundraising foundation or nonprofit corporation complies with any applicable provision of the health insurance portability and accountability act of 1996 and its implementing regulations.

O. The department of public safety, a county sheriff's department, a municipal police department, a prosecution agency and a court shall create and maintain an information security policy that includes notification procedures for a security system breach of the department of public safety, the county sheriff's department, the municipal police department, the prosecuting agency or the court.

Chapter 6 Property Technology Sandbox

Article 1 General Provisions

§ 18-601 Definitions

In this chapter, unless the context otherwise requires:

"Applicable agency" means a department or agency of this state established by law to regulate certain types of business activity in this state and persons engaged in such business, including types of authorization, that the chief executive officer determines would regulate a sandbox participant.
"Chief executive officer" means the chief executive officer of the Arizona commerce authority.
"Consumer" means a person that purchases or otherwise enters into a transaction or agreement to receive an innovative property product or service that is being tested by a sandbox participant.
"Innovation" means, with respect to providing a property product or service or a substantial component of a property product or service, the use or incorporation of new or emerging technology or the reimagination of uses for existing technology to address a problem, provide a benefit or otherwise offer a product, service, business model or delivery mechanism that is not known by the chief executive officer to have a comparable widespread offering in this state.
"Innovative property product or service" means a property product or service that includes an innovation.
"Property product or service":

(a) Means a product or service that includes a business model, delivery mechanism or element that may otherwise require an authorization to act as a property institution or enterprise or other entity or an action not yet contemplated by statute.

(b) Does not include a product or service that is related to the physical new construction of improvements to real property.

"Property technology sandbox" means the program established by this chapter that allows a person to temporarily test innovative property products or services on a limited basis without otherwise being authorized to act under the laws of this state.
"Sandbox participant" means a person whose application to participate in the property technology sandbox is approved pursuant to this chapter.
"Test" means to provide products and services as allowed by this chapter.

§ 18-602 Program purpose

The chief executive officer shall establish a property technology sandbox program in direct consultation with the department of administration, the state real estate department and other applicable agencies of this state to enable a person to obtain limited access to the market in this state to test innovative property products or services without obtaining authorization that otherwise might be required.

§ 18-603 Application process and requirements; fee

A. Any person may apply to enter the property technology sandbox to test an innovation.

B. The chief executive officer must accept and review each application for entry into the property technology sandbox on a rolling basis.

C. An application must demonstrate that an applicant both:

Is an entity or individual who is subject to the jurisdiction of this state.
Has established a location, whether physical or virtual, that is adequately accessible to the chief executive officer, from which testing will be developed and performed and where all required records, documents and data will be maintained.

D. Persons that already possess an authorization under state laws that regulate a property product or service must file an application with the chief executive officer to test an innovation within the property technology sandbox for a property product or service outside the scope of the authorization.

E. Applications must contain sufficient information to demonstrate that an applicant has an adequate understanding of the innovation and a sufficient plan to test, monitor and assess the innovation while ensuring that consumers are protected from a testing failure.

F. Applications must contain the information required by a form that is developed and made publicly available by the chief executive officer. The information required by the form may include:

Relevant personal and contact information for the applicant, including full legal names, addresses, telephone numbers, e-mail addresses, website addresses and other information that the chief executive officer deems necessary.
Disclosure of any criminal convictions of the applicant or key personnel, if any.
A description of the innovation desired to be tested, including statements regarding all of the following:

(a) How an innovation is subject to regulation outside of the property technology sandbox.

(b) How the innovation would benefit consumers.

(d) Any risks to consumers.

(e) How entering the property technology sandbox would enable a successful test of the innovation.

(f) A description of the proposed testing plan, including estimated time periods for market entry, market exit and the pursuit of necessary licensure or authorization.

(g) How the applicant will wind down the test and protect consumers if the test fails.

(h) How the applicant will use cybersecurity measures to avoid breaches and protect consumer and transaction data.

G. The chief executive officer shall collect a nonrefundable processing fee from each applicant in an amount determined by the Arizona commerce authority. Monies collected pursuant to this subsection shall be deposited in the Arizona commerce authority fund established by section 41-1506.

H. A person shall file a separate application for each innovation sought to be tested.

I. After the applicant submits the information required by subsection F of this section, the chief executive officer may seek additional information that the chief executive officer deems necessary. Not later than ninety days after an application is initially submitted, the chief executive officer shall notify the applicant whether the application is approved for entry into the property technology sandbox. The chief executive officer and an applicant may mutually agree to extend the time period for the chief executive officer to determine whether an application is approved for entry into the property technology sandbox.

J. The chief executive officer may deny applications in the chief executive officer's discretion, and a denial is not an appealable agency action for the purposes of title 41, chapter 6, article 10.

§ 18-604 Consultation with applicable agencies; admission authority; state properties available for use

A. The chief executive officer must consult with an applicable agency before admitting an applicant into the property technology sandbox. This consultation may include seeking information about:

Whether the applicable agency previously has either:

(a) Issued a license or other authorization to the applicant.

(b) Investigated, sanctioned or pursued legal action against the applicant.

Whether the applicant could obtain authorization from an applicable agency after exiting the property technology sandbox.

B. Notwithstanding subsection A of this section, the chief executive officer has sole authority to make the final decision whether to admit an applicant into the property technology sandbox, except that the chief executive officer may not admit an applicant whose innovation should be regulated pursuant to title 41, chapter 55 or whose innovation involves physical construction that requires a contractor license pursuant to title 32, chapter 10.

C. The department of administration shall provide to the Arizona commerce authority a list of state-owned buildings and properties that are available for a sandbox participant to use.

§ 18-605 Scope

A. If the chief executive officer approves an application for entry into the property technology sandbox, the applicant is deemed a sandbox participant and both of the following apply:

The sandbox participant has twenty-four months after the date of approval to test the innovation described in the sandbox participant's application.
The chief executive officer must issue the sandbox participant a registration number.

B. This section does not restrict a sandbox participant that holds an authorization in another jurisdiction from acting pursuant to and in accordance with that authorization.

C. A sandbox participant is deemed to possess an appropriate authorization under the laws of this state for purposes of any provision of federal law requiring state authorization.

D. Except as otherwise provided in this chapter, a sandbox participant is not subject to state laws that establish requirements pursuant to an authorization issued by an applicable agency that otherwise would or may regulate a property product or service.

E. The chief executive officer may determine that certain state laws that regulate a property product or service apply to a sandbox participant. If the chief executive officer makes this determination and approves an application for entry into the property technology sandbox, the chief executive officer must notify the sandbox participant of the specific state property technology laws that apply to that sandbox participant.

F. A sandbox participant may obtain, record, provide or maintain in an electronic form, including as provided in section 44-7601, any information, writing, signature, record or disclosure that is required by this chapter or may substitute any substantially similar equivalent information, writing, signature, record or disclosure that is approved by the chief executive officer.

§ 18-606 Consumer protection

A. Before providing an innovative property product or service to consumers, a sandbox participant must disclose to consumers all of the following:

The name and contact information of the sandbox participant, including the registration number provided by the chief executive officer pursuant to section 18-605.
That the innovative property product or service is authorized pursuant to the property technology sandbox and, if applicable, that the sandbox participant does not have authorization to generally provide products or services under state laws that regulate a property product or service that is outside the property technology sandbox.
That this state does not endorse or recommend the innovation.
That the innovative property product or service is a temporary test that may be discontinued at the end of the testing period, including the expected end date of the testing period.
That complaints may be filed with the chief executive officer regarding the innovative property product or service being tested and the chief executive officer's telephone number and website address where complaints may be filed.

B. The disclosures prescribed by subsection A of this section must be provided to consumers in a clear and conspicuous form in both English and Spanish. For internet or application-based innovative property products or services, consumers must acknowledge receipt of these disclosures before completion of a transaction.

C. The chief executive officer may require that a sandbox participant make additional disclosures to consumers. If the chief executive officer approves an application for entry into the property technology sandbox, the chief executive officer shall notify the sandbox participant of the additional disclosures.

§ 18-607 Exit requirements

A. At least thirty days before the end of the twenty-four-month property technology sandbox testing period, a sandbox participant must notify the chief executive officer that the sandbox participant will exit the property technology sandbox, wind down its test and cease offering any innovative property products or services in the property technology sandbox within sixty days after the twenty-four-month testing period ends.

B. If the chief executive officer does not receive notification pursuant to subsection A of this section, the property technology testing period ends at the end of the twenty-four-month testing period and the sandbox participant must immediately cease offering innovative property products or services.

C. If a test includes offering products or services that require ongoing duties, the sandbox participant must continue to fulfill those duties or arrange for another person to fulfill those duties after the date the sandbox participant exits the property technology sandbox.

§ 18-608 Recordkeeping and reporting requirements

A. A sandbox participant must retain records, documents and data produced in the ordinary course of business regarding an innovation tested in the property technology sandbox.

B. If an innovation fails before the end of the testing period, the sandbox participant must notify the chief executive officer and report on actions taken to ensure consumers have not been harmed as a result of the innovation's failure.

C. A sandbox participant is subject to the requirements of section 18-552 and must notify the chief executive officer of any breach as defined in section 18-551.

§ 18-609 Records; disclosure; evidentiary effect

A. Records that are submitted to or obtained by the chief executive officer in administering this chapter are not public records or open for inspection by the public.

B. Records and information that are submitted or obtained pursuant to this chapter may be disclosed to any of the following:

State and federal agencies.
Representatives of foreign countries that have property technology or supervisory authority over the activities of the sandbox participant.
A federal, state or county grand jury in response to a lawful subpoena.
The auditor general for the purpose of conducting audits authorized by law.

C. The chief executive officer and any applicable agency consulted by the chief executive officer pursuant to section 18-604 are not liable for the disclosure of records, information or data received or obtained pursuant to this chapter.

D. The disclosure pursuant to subsection B of this section of a complaint or the results of an examination, inquiry or investigation of a sandbox participant does not make that information a public record, and the sandbox participant or the sandbox participant's holding company may not disclose that information to the general public unless the disclosure is required by law. A sandbox participant or the sandbox participant's holding company may not disclose, use or reference in any form comments, conclusions or results of an examination, inquiry or investigation in any type of communication to a customer or potential customer.

E. This section does not prevent the disclosure of information that is admissible in evidence in a civil or criminal proceeding brought by a state or federal law enforcement agency to enforce or prosecute civil or criminal violations of the law.

§ 18-610 Reporting requirements; monitoring; enforcement; agreements

A. The chief executive officer may establish periodic reporting requirements for sandbox participants.

B. The chief executive officer may request records, documents and data from sandbox participants. On the chief executive officer's request, sandbox participants must make such records, documents and data available for inspection by the chief executive officer.

C. If the chief executive officer has reasonable cause to believe that a sandbox participant was admitted into the property technology sandbox in violation of this chapter or has engaged in, is engaging in or is about to engage in any practice or transaction that violates this chapter, that constitutes an unlawful practice under section 44-1522 or that violates a state or federal criminal law, the chief executive officer may remove a sandbox participant from the property technology sandbox or order a sandbox participant to exit the property technology sandbox pursuant to section 18-607.

D. Removal from the property technology sandbox is not an appealable agency action for the purposes of title 41, chapter 6.

E. Sandbox participants are subject to the consumer fraud provisions under title 44, chapter 10, article 7.

F. The chief executive officer may enter into agreements with state, federal or foreign regulators that allow sandbox participants to operate in other jurisdictions and allow entities authorized to operate in other jurisdictions to be recognized as sandbox participants in this state.

§ 18-611 Applicability

This chapter does not apply to a profession that is regulated pursuant to title 32, chapter 20.

Chapter 7 Government Information Technology Use

Article 1 General Provisions

§ 18-701 Internet pornography; age verification; prohibited data retention or transmission; verification methods; applicability; civil liability; attorney fees and costs; definitions

A. A commercial entity that knowingly and intentionally publishes or distributes material on an internet website, including a social media platform, of which more than one-third is sexual material that is harmful to minors shall use reasonable age verification methods to verify that an individual who attempts to access the material is eighteen years of age or older.

B. A commercial entity that knowingly and intentionally publishes or distributes material on an internet website or a third-party entity that performs age verification pursuant to this section shall require an individual to do either of the following:

Provide a form of digital identification that does not cause or allow the individual's identifying information to be transmitted to any federal, state or local government entity.
Comply with a commercial age verification system that does not cause or allow the individual's identifying information to be transmitted to any federal, state or local government entity and verifies age using either of the following:

(a) Government-issued identification.

(b) A commercially reasonable method that relies on public or private transactional data to verify the age of an individual.

C. A commercial entity or a third-party entity that performs the age verification that is required by this section may not retain any identifying information of the individual and may not cause or allow any identifying information of the individual to be directly or indirectly transmitted to any federal, state or local government entity.

D. This section does not apply to a bona fide news or public interest broadcast, website video, report or event and may not be construed to affect the rights of a news-gathering organization.

E. An internet service provider, or its affiliates or subsidiaries, a search engine or a cloud service provider may not be held to have violated this section solely for providing access or connection to or from a website or other information or content on the internet or on a facility, system or network not under that internet service provider's control, including transmission, downloading, intermediate storage, access software or other services to the extent that the internet service provider or search engine is not responsible for the creation of the content that constitutes sexual material that is harmful to minors.

F. The parent or guardian of a minor who accesses material harmful to minors and a person whose identifying information was retained or transmitted because of an entity's violation of this section has a right of action against the offending entity. The court may award a successful plaintiff in an action brought pursuant to this section a penalty for a violation of this section:

In an amount equal to not more than the total, if applicable, of both of the following:

(a) $10,000 per day that the entity operates an internet website in violation of the age verification requirements of this section.

(b) $10,000 per instance when the entity retains or transmits identifying information in violation of subsection C of this section.

For an additional amount of not more than $250,000 if, because of the entity's violation of the age verification requirements of this section, one or more minors accesses sexual material that is harmful to minors.

G. The court shall determine the amount of a penalty that is imposed pursuant to this section based on all of the following factors:

The seriousness of the violation, including the nature, circumstances, extent and gravity of the violation.
The history of previous violations.
The amount necessary to deter a future violation.
The economic effect of a penalty on the entity on whom the penalty will be imposed.
The entity's knowledge that the act constituted a violation of this section.
Any other matter that justice may require.

H. A successful plaintiff may recover reasonable and necessary attorney fees and costs that are incurred in an action under this section.

I. In any action that is brought or maintained pursuant to this section, all personally identifiable information of users, including the user's name, shall be redacted before the information is produced.

J. For the purposes of this section:

"Commercial entity" includes a corporation, limited liability company, partnership, limited partnership, sole proprietorship or other legally recognized business entity.
"Digital identification" means information that is stored on a digital network that may be accessed by a commercial entity and that serves as proof of the identity of an individual.
"Distribute" means to issue, sell, give, provide, deliver, transfer, transmute, circulate or disseminate by any means.
"Minor" means an individual under eighteen years of age.
"News-gathering organization" includes the following:

(a) An employee of a newspaper, news publication or news source, printed or on an online or mobile platform, of current news and public interest, who is acting within the course and scope of that employment and can provide documentation of that employment with the newspaper, news publication or news source.

(b) An employee of a radio broadcast station, television broadcast station, cable television operator or wire service who is acting within the course and scope of that employment and can provide documentation of that employment.

"Publish" means to communicate or make information available to another person or entity on a publicly available internet website.
"Sexual material that is harmful to minors" includes any material that:

(a) The average person applying contemporary community standards would find, taking the material as a whole and with respect to minors, is designed to appeal to or pander to the prurient interest;

(b) In a manner patently offensive with respect to minors, exploits, is devoted to, or principally consists of descriptions of actual, simulated or animated displays or depictions of any of the following:

(i) A person's pubic hair, anus or genitals or the nipple of the female breast;

(ii) Touching, caressing or fondling of nipples, breasts, buttocks, anuses or genitals;

(iii) Sexual intercourse, masturbation, sodomy, bestiality, oral copulation, flagellation, excretory functions, exhibitions or any other sexual act and

"Transactional data":

(a) Means a sequence of information that documents an exchange, agreement, or transfer between an individual, commercial entity or third-party entity that is used to satisfy a request or event.

(b) Includes records from mortgage, education and employment entities.

Title 18 — Information Technology

Chapter 1 Government Information Technology

Article 1 General Provisions

§ 18-101 Definitions

§ 18-102 Government information technology

§ 18-103 Powers and duties of director

§ 18-104 Powers and duties of the department; violation; classification

§ 18-106 Electronic and digital signatures; exemptions; definitions

Article 2 Information Technology Authorization Committee

§ 18-121 Information technology authorization committee; members; terms; duties; compensation; definition

Article 3 Alternative Access to Electronic or Information Technology

§ 18-131 Definitions

§ 18-132 Alternative methods of access to electronic or information technology; complaint procedure; rules

Chapter 2 Network Access

Article 1 Acceptable Use Policy

§ 18-201 Definitions

§ 18-202 Obligations of state agencies obtaining information on line

§ 18-203 Agency reports; availability on line

Chapter 3 Governmental Reporting of Information

Article 1 General Provisions

§ 18-301 Definitions

§ 18-302 Comprehensive internet web portal of local governments

§ 18-303 Reporting of public funding for public communications

§ 18-304 Debt reporting by state and local governments; database

§ 18-305 Reports; electronic submission; exception; posting

Chapter 4 Network Services

Article 1 General Provisions

§ 18-401 Information technology fund

§ 18-402 Statewide e-rate program fund

Article 2 Department of Administration

§ 18-421 State web portal fund; exemption

§ 18-422 State agencies; third-party electronic service provider authorization; definitions

Article 3 Secretary of State

§ 18-441 Data processing acquisition fund

§ 18-443 Electronic database system; procedures

§ 18-444 Duty to file financial disclosure statement; contents; exceptions

Chapter 5 Network Security

Article 1 Computer Spyware

§ 18-501 Definitions

§ 18-502 Prohibited activities; applicability

§ 18-503 Statewide concern; preemption

§ 18-504 Civil remedies; damages

Article 2 Government Anti-Identification Procedures

§ 18-521 Definitions

§ 18-522 Anti-identification procedures

Article 3 Internet Representations

§ 18-541 Definitions

§ 18-542 Prohibition

§ 18-543 Civil remedies; damages

§ 18-544 Violation; classification

Article 4 Data Security Breaches

§ 18-551 Definitions

§ 18-552 Notification of security system breaches; requirements; enforcement; confidentiality; civil penalty; preemption; exceptions

Chapter 6 Property Technology Sandbox

Article 1 General Provisions

§ 18-601 Definitions

§ 18-602 Program purpose

§ 18-603 Application process and requirements; fee

§ 18-604 Consultation with applicable agencies; admission authority; state properties available for use

§ 18-605 Scope

§ 18-606 Consumer protection

§ 18-607 Exit requirements

§ 18-608 Recordkeeping and reporting requirements

§ 18-609 Records; disclosure; evidentiary effect

§ 18-610 Reporting requirements; monitoring; enforcement; agreements

§ 18-611 Applicability

Chapter 7 Government Information Technology Use

Article 1 General Provisions

§ 18-701 Internet pornography; age verification; prohibited data retention or transmission; verification methods; applicability; civil liability; attorney fees and costs; definitions

Setzen Sie Ihre Recherche in ChatGPT oder Claude fort