ARC 4710C

ARC 4710C

CHIEF INFORMATION OFFICER, OFFICE OF THE[129]

Notice of Intended Action

Proposing rule making related to waivers

and providing an opportunity for public comment

The Office of the Chief Information Officer hereby proposes to adopt new Chapter 7, "Waivers," Iowa Administrative Code.

Legal Authority for Rule Making

This rule making is proposed under the authority provided in Iowa Code sections 8B.4(5) and 17A.9A.

State or Federal Law Implemented

This rule making implements, in whole or in part, Iowa Code chapter 8B and section 17A.9A.

Purpose and Summary

Pursuant to Iowa Code section 17A.9A(1), "[a]ny person may petition an agency for a waiver or variance from the requirements of a rule, pursuant to the requirements of this section, if the agency has established by rule an application, evaluation, and issuance procedure permitting waivers and variances." This proposed rule making establishes such procedures by which persons may petition the Office for a waiver or variance, on a case-by-case basis, from administrative rules promulgated by the Office.

This proposed rule making does not apply to or permit requests for waivers or variances from participating agencies subject to information technology requirements set forth in Iowa Code chapter 8B or related rules, policies, standards, processes, or procedures promulgated, administered, and enforced by the Office. Pursuant to Iowa Code section 8B.21(5)"a," the Office is required to "adopt rules allowing for participating agencies to seek a temporary or permanent waiver from any of the requirements of [Iowa Code chapter 8B] concerning the acquisition, utilization, or provision of information technology." The Office has initiated simultaneously with this filing a separate Notice of Intended Action (ARC 4712C, IAB 10/23/19) which proposes that separate process. Further, this proposed rule making does not govern the waiver of the stated terms, conditions, or requirements in a procurement of information technology. The standards and processes for the granting of waivers from the stated terms, conditions, or requirements in a procurement of information technology shall be as stated in the competitive selection documents or other applicable solicitation documents initiating the procurement.

Fiscal Impact

This rule making has no fiscal impact to the State of Iowa.

Jobs Impact

After analysis and review of this rule making, no impact on jobs has been found.

Waivers

This chapter will establish an agencywide waiver provision.

Public Comment

Any interested person may submit written or oral comments concerning this proposed rule making. Written or oral comments in response to this rule making must be received by the Office no later than 4:30 p.m. on November 12, 2019. Comments should be directed to:

Public Hearing

A public hearing at which persons may present their views orally or in writing will be held as follows:

Persons who wish to make oral comments at the public hearing may be asked to state their names for the record and to confine their remarks to the subject of this proposed rule making.

Any persons who intend to attend the public hearing and have special requirements, such as those related to hearing or mobility impairments, should contact the Office and advise of specific needs by calling 515.281.5503.

Review by Administrative Rules Review Committee

The Administrative Rules Review Committee, a bipartisan legislative committee which oversees rule making by executive branch agencies, may, on its own motion or on written request by any individual or group, review this rule making at its regular monthly meeting or at a special meeting. The Committee's meetings are open to the public, and interested persons may be heard as provided in Iowa Code section 17A.8(6).

The following rule-making action is proposed:

Adopt the following new 129—Chapter 7:

CHAPTER 7

WAIVERS

129—7.1(8B,17A) Definitions. The definitions in Iowa Code section 8B.1 shall apply to this chapter. In addition, for purposes of this chapter, the following definitions shall also apply:

"Chief information officer" or "CIO" means the state chief information officer or the CIO's designee.

"Competitive selection documents" means the same as defined in rule 129—10.2(8B).

"Information technology waiver" means the same as defined in rule 129—8.1(8B).

"Office" or "OCIO" means the office of the chief information officer authorized by Iowa Code chapter 8B.

"Person" means an individual, corporation, limited liability company, government or governmental subdivision or agency, business trust, estate, trust, partnership or association, vendor, or any legal entity.

"Waiver or variance" means, as applied to an identified person on the basis of the particular circumstances of that person, any action by the office that suspends in whole or in part the requirements or provisions of a rule of the office. For simplicity, the term "waiver" shall include both a "waiver" and a "variance."

129—7.2(8B,17A) Scope of chapter and applicability. This chapter outlines generally applicable standards and a uniform process for the granting of individual waivers from rules adopted by the office in situations where no other more specifically applicable law provides for waivers. Generally, the office may grant a waiver from a rule only if the office has jurisdiction over the rule from which a waiver is requested or has final decision-making authority over a contested case in which a waiver is requested and the requested waiver is consistent with applicable statutes, constitutional provisions, or other provisions of law. Except to the extent authorized and not otherwise prohibited by applicable law, the office may not waive requirements created or duties imposed by statute. Any waiver must be consistent with statute.

Notwithstanding the foregoing, to the extent another more specific provision of law governs the issuance of a waiver from a particular rule, the more specific provision shall supersede this chapter with respect to any waiver from that rule. For example:

7.2(1) Iowa Code section 8B.21(5) and 129—Chapter 8 govern information technology waivers requested by a participating agency from the requirements of Iowa Code chapter 8B, rules adopted by the office, and information technology standards and policies prescribed by the office concerning the acquisition, utilization, or provision of information technology.

7.2(2) Additionally, this chapter does not govern the waiver of the stated terms, conditions, or requirements in a procurement of information technology. The standards and processes for the granting of waivers from the stated terms, conditions, or requirements in a procurement of information technology shall be as stated in the competitive selection documents or other applicable solicitation documents initiating the procurement.

129—7.3(8B,17A) Granting a waiver. In response to a petition completed pursuant to rule 129—7.5(8B,17A), the CIO may, in the CIO's sole discretion, issue an order waiving, in whole or in part, the requirements of a rule pursuant to subrule 7.3(1).

7.3(1) Criteria for waiver.

a. The CIO may grant a waiver if the CIO finds, based on clear and convincing evidence, each of the following:

(1)The application of the rule would pose an undue hardship on the person for whom the waiver is requested.

(2)The waiver from the requirements of the rule in the specific case would not prejudice the substantial legal rights of any person.

(3)The provisions of the rule subject to the petition for a waiver are not specifically mandated by statute or another provision of law.

(4)Equal protection of public health, safety, and welfare and information security will be substantially afforded by a means other than that prescribed in the particular rule for which the waiver is requested.

b. In determining whether a waiver should be granted, the CIO shall consider the public interest, policies, and legislative intent of the statute on which the rule is based. When the rule from which a waiver is sought establishes administrative deadlines, the CIO shall balance the special individual circumstances of the petitioner with the overall goal of uniform treatment of all affected persons.

7.3(2) Special waivers not precluded. These rules shall not preclude the CIO from granting waivers in other contexts or on the basis of other statutes, rules, standards, policies, or procedures if:

a. The CIO deems it appropriate to do so; and

b. The CIO is not prohibited by state or federal statute, federal regulations, this rule, or any other rule adopted under Iowa Code chapter 17A from issuing such waivers.

129—7.4(8B,17A) Filing of petition. Any person may file with the office a petition requesting a waiver, in whole or in part, of a rule of the office on the ground that the application of the rule to the particular circumstances of that person would qualify for a waiver.

7.4(1) General. A petition for a waiver must be submitted in writing to the office of the chief information officer at the office's primary headquarters at the address identified in rule 129—1.2(8B,17A). Requests for waiver may be delivered, mailed, or sent by electronic means reasonably calculated to reach the intended recipient.

7.4(2) Special requirement for contested cases or appeals. If the petition relates to a pending appeal or contested case, the petition shall use the caption of the appeal or contested case, and in addition to being submitted to the office as required by subrule 7.4(1), a copy shall also be filed in the appeal or contested case proceeding.

129—7.5(8B,17A) Content of petition. A petition for waiver shall include the following information where applicable and known to the requester:

1.The name, address, and telephone number of the person for whom a waiver is requested and the case number of any related pending appeal or contested case.

2.A description of and citation to the specific rule from which a waiver is requested.

3.The specific waiver requested, including the precise scope and duration, and any alternative means or other condition or modification proposed to achieve the purposes of the applicable rule.

4.The relevant facts the petitioner believes would justify a waiver under each of the four criteria described in subrule 7.3(1). This statement shall include a signed statement from the petitioner attesting to the accuracy of the facts provided in the petition and a statement of reasons that the petitioner believes the relevant facts will justify a waiver.

5.A history of any prior contacts between the office and the petitioner relating to the activity that is the subject of the requested waiver, including but not limited to a list or description of prior notices, investigative reports, advice, negotiations, consultations or conferences, a description of contested case hearings relating to the activity within the past five years, and penalties relating to the proposed waiver.

6.Any information known to the requester regarding the office's treatment of similar cases.

7.The name, address, and telephone number of any public agency or political subdivision which also regulates the activity in question or which might be affected by the granting of a waiver.

8.The name, address, and telephone number of any person or entity that would be adversely affected by the granting of a petition.

9.The name, address, and telephone number of any person with knowledge of the relevant facts relating to the proposed waiver.

10.Signed releases authorizing persons with knowledge regarding the request to furnish the office with information relevant to the waiver.

129—7.6(8B,17A) Additional information. Prior to issuing an order granting or denying a waiver, the office may request additional information from the petitioner relative to the petition and surrounding circumstances. If the petition was not filed in conjunction with a pending contested case or appeal, the office may, on its own motion or at the petitioner's request, schedule a meeting between the petitioner and the CIO, which may be conducted either in person or by telephonic or other similar electronic means.

129—7.7(8B,17A) Notice. The office shall acknowledge the receipt of a petition by means reasonably calculated to reach the petitioner or designee. The office shall ensure that, within 30 days of the receipt of the petition, notice of the pendency of the petition and a concise summary of its contents have been provided to all persons to whom notice is required by any provision of law. In addition, the office may give notice to other persons. To accomplish this notice provision, the office may require the petitioner to serve the notice on all persons to whom notice is required by any provision of law and provide a written statement to the office attesting that notice has been provided. Notice may be provided by email or similar electronic means.

129—7.8(8B,17A) Hearing procedures. The provisions of Iowa Code sections 17A.10 to 17A.18A regarding contested case hearings and the office's corresponding implementing rules at 129—Chapter 6 shall apply to any petition for a waiver filed within a contested case and shall otherwise apply to office proceedings for a waiver only when the office so provides by rule or order or is required to do so by statute.

129—7.9(8B,17A) Ruling. An order granting or denying a waiver shall be in writing and shall contain a reference to the particular person and rule or portion thereof to which the order pertains, a statement of the relevant facts and reasons upon which the action is based, and, if a waiver is issued, a description of the precise scope of the waiver including its duration and any conditions associated therewith.

7.9(1) CIO discretion. The final decision on whether the circumstances justify the granting of a waiver shall be made at the sole discretion of the CIO, upon consideration of all relevant factors. Each petition for a waiver shall be evaluated by the CIO based on the unique, individual circumstances set out in the petition.

7.9(2) Burden of proof and persuasion. The burden of proof and persuasion rests with the petitioner to demonstrate by clear and convincing evidence that the CIO should exercise discretion to grant a waiver.

7.9(3) Narrowly tailored. A waiver, if granted, shall provide the narrowest exception possible to the provisions of a rule.

7.9(4) Administrative deadlines. When the rule from which a waiver is sought establishes administrative deadlines, the office shall balance the special individual circumstances of the petitioner with the overall goal of uniform treatment of all similarly situated persons.

7.9(5) Conditions. The CIO may place any condition on a waiver that the CIO finds desirable to protect the public health, safety, and welfare and information security.

7.9(6) Time period of waiver. A waiver shall not be permanent unless the petitioner can show that a temporary waiver would be impracticable. If a temporary waiver is granted, there is no automatic right to renewal. At the sole discretion of the CIO, a waiver may be renewed if the CIO finds that grounds for a waiver continue to exist.

7.9(7) Time for ruling. The CIO shall grant or deny a petition for a waiver as soon as practicable but, in any event, shall do so within 120 days of its receipt unless the petitioner agrees to a later date or the department, specifying good cause, extends this time period with respect to a particular petition for an additional 30 days. However, if a petition is filed in a contested case, the CIO shall grant or deny the petition no later than the time at which the final decision in that contested case is issued.

7.9(8) When deemed denied. Failure of the CIO to grant or deny a petition within the required time period shall be deemed a denial of that petition by the CIO.

7.9(9) Service of order. Within seven days of its issuance, any order issued under this chapter shall be transmitted to the petitioner or the person to whom the order pertains and to any other person entitled to such notice by any provision of law. Such service may be effectuated by email or similar electronic means.

129—7.10(8B,17A,22) Public availability. All orders granting or denying a waiver petition shall be indexed, filed, and available for public inspection as provided in Iowa Code section 17A.3. Petitions for a waiver and orders granting or denying a waiver petition are public records under Iowa Code chapter 22. Some petitions or orders may contain information the office is authorized or required to keep confidential. The office may accordingly redact confidential information from petitions or orders prior to public inspection.

129—7.11(8B,17A) Summary reports. Semiannually, the office shall prepare a summary report identifying the rules for which a waiver has been granted or denied, the number of times a waiver was granted or denied for each rule, a citation to the statutory provisions implemented by such rules, and a general summary of the reasons justifying the office's actions on waiver requests under this chapter. If practicable, the report shall detail the extent to which the granting of a waiver under this chapter has affected the general applicability of the rule itself. Copies of this report shall be available for public inspection and shall be provided semiannually to the administrative rules coordinator and the administrative rules review committee.

129—7.12(8B,17A) Cancellation of a waiver. A waiver issued by the CIO pursuant to this chapter may be withdrawn, canceled, or modified if, after appropriate notice and hearing, the CIO issues an order finding any of the following:

1.The petitioner or the person who was the subject of the waiver order withheld or misrepresented material facts relevant to the propriety or desirability of the waiver; or

2.The alternative means for ensuring that the public health, safety, and welfare and information security will be adequately protected after issuance of the waiver order have been demonstrated to be insufficient; or

3.The subject of the waiver order has failed to comply with all conditions contained in the order.

129—7.13(8B,17A) Violations. Violation of a condition in a waiver order shall be treated as a violation of the particular rule for which the waiver was granted. As a result, the recipient of a waiver under this chapter who violates a condition of the waiver may be subject to the same remedies or penalties as a person who violates the rule at issue.

129—7.14(8B,17A) Defense. After the CIO issues an order granting a waiver, the order is a defense within its terms and the specific facts indicated therein for the person to whom the order pertains in any proceeding in which the rule in question is sought to be invoked.

129—7.15(8B,17A) Judicial review. Judicial review of an office decision granting or denying a waiver petition may be taken in accordance with Iowa Code chapter 17A.

These rules are intended to implement Iowa Code sections 8B.4(5) and 17A.9A.