 Good afternoon, and welcome to House Judiciary Committee. We are continuing our discussion on the Bureau or Division of Racial Statistics. And we are joined by Kristen McClure. And welcome. Very glad to have you here. I think you play a very important role to this process and look forward to your testimony, really guiding us through this and helping us understand how everything connects and works together and to really, really be with us. And sorry, I need to step out to make a phone call, but I'll be back as soon as I can. Great. Well, thank you so much for having me today. For the record, Kristen McClure, Chief Data Officer with ADS. And for today, I'd like to hit on three key points. One, regarding some minor modifications or recommendations to the bill. The second, to talk about de-identified and identified data and how that relates to siege of data. And then the third, which will be a good segue, third to cover technology costs. Does that sound good to everyone? Excellent. Yeah, thank you. Thank you so much. OK, great. So for the minor adjustments, modifications, there are two of them. The first one we recommend is on page four, number six. This is under duties of the division, where it lists making technology recommendations. And we feel like it's more appropriate for this to be a duty of ADS versus the division as ADS is responsible for technology for the state. Could you point me to where that was again? I'm sorry. Yeah, it's page four, number six, starting with line item eight. And again, so your recommendation is? For that duty to be owned by ADS, where reference is making technology recommendations. This is by 46. Yeah, sorry. We're just a moment. OK, so right now the duty is within this new division. And then you're saying, pull that out. Correct. Pull that out, put that under ADS, or you could delete that correct, because that is an ADS responsibility. OK, great. The next one is on page five under data governance, number three. And this, my feedback is consistent with what you heard from the state archivist. The record retention is most appropriate or more appropriate to be of a SAR responsibility versus an ADS responsibility. And for the data collection and data governance, we would recognize this as a division responsibility versus an ADS. So we would, much like we interact with the other businesses, we consult on that item, but we recognize ownership that the business would have for data collection and data governance. The other items associated with that, which are security and storage and management, I believe is ADS, that's totally appropriate. Security, storage. This is on line 14 and 15, I believe. Can I ask just real quickly, is that on, I'm looking for data collection, digital services. Oh, I see, on the collection and retention. So collection is a division. Correct. Retention is an archivist. Data governance is presumably the division. And data security is also the division. Or did you say that's ADS? That would be ADS and storage would be ADS. And how about management? Yeah, I think that's appropriate to leave as ADS too. Thank you. So that covers the modification recommendations. We have on that. The next item I wanted to talk through is about de-identified and identified data. So as I read through the bill, it wasn't clear to me the intent of do we want the division to receive de-identified data or identified data. And identified data includes a person's first name, last name, and date of birth. De-identified data does not include any of those three items. And when I heard some of the other witnesses provide testimony, some had assumed it would be identified data from the sound of it. And some had assumed it would be identified data. So it would probably be good to clarify which data set, which type of data you want to receive, want the division to receive. So yeah, that's a question about that. So you're not necessarily taking a preference one way or another. It's just make it clear. Is that a factor of clarifying in the bill itself or just under, I mean, yeah, I could forget that question. Yeah, I can understand. Yeah. You know, I'll take over. I'll be right back, but I'm going to take over. I lost that. Tom, I think the difference, at least, hi, Kristen, how are you? Hi, Coach. Good, thank you. I think the difference is in the particular study that's being done. A lot of the data doesn't have to be, let's say, age-identified, name-identified. Whereas if we were talking about school settings, we would almost need to be able to identify age. So was it from pre-K to 12, for example? If we were looking at the effects of policing or police supports within a school setting, like the big discussion now is with SROs. So how would you disaggregate that data unless you had age-identifiable? I would recommend, including age. Anyway, in any data sets, the option the committee has is do you want to include specific data birth for a person? See, that, I don't think, is necessary. And I think one of the other things that I think Martin was alluding to is that the advisory panel that would be working with the division would be making recommendations. And presently, those recommendations are going to be rule set. So they'd go through the rule-making process. But I think in order for us to get started, a lot of the initial data, I would agree with you. Having age would cover 98% of the information that we need, if not more. You see me, Tom? I just want to raise my hand. I know it's hard for you to see from inside your square. You're one of those phone hands. I do have my participant list up. So anybody who is zooming, I guess, I would be able to see their hand. But anyway, go ahead, Martin. You know, I think I'm going to start doing is zooming in and just keeping everything muted and off so I can raise my hand. I think I've just decided that that's what we're going for. Anyway, I apologize. So this probably isn't, I'm going to try to work this out into a question for Kristen as opposed to a statement, but we'll see how that goes. I think it's probably critical that it's actually identified data because the idea is we're getting data from multiple agencies that we in fact may want to be matching up a particular individual's journey through the criminal justice system. So that may in fact require having the birth date and all that additional information. We just, I agree we need to make that clear. And I agree when we talk to the archivist, we also need to make clear as far as how the public records act applies to that because it should apply. If some of that data comes through that is exempted from being released, that should continue to be the case. I guess I didn't have a question in there. I apologize, Kristen, but unless you wanted to comment on that thought. No, if the intent is to link across the data sets, like you mentioned, then you would want to receive identified data to enable that. Right. We'll need to make that clear. I appreciate that. Thank you. Oh, go on coach. No, no, I was saying thank you. I do want to mention there are some additional responsibilities that the employees will have if they receive identified data because it will mean that they're responsible for C Just data, which is now a specific compliance cat, a federal compliance category. What that is, I'm sorry. What kind of data C just data CJ is, it stands for criminal justice information. And there are a few key elements that's probably worth sharing here about see just data. So much like federal government also has a compliance category for FTI tax data and has certain regulations and security measures specified for that. They have the same procedures data. So there's certain security measures that would need to be put in place for the technology wherever the data touches. So how it's received, where it's stored, how it's used, that whole environment needs to be just compliant. And so additional security measures and a firewall and configuration, specific audit and logging, but ADS would take care of that and enable the environment to be so you just compliant. So I wanted to mention that because it'll be reflected in the technology cost too. Okay, thank you. Oh, there are three other items I think may be useful for the committee to know about COGIS data. And it's really on the division responsibility but probably good to be aware of. One is around access control and this is a shared responsibility that ADS and the division would have. Essentially who is granted access to the data. And COGIS says basically it's a need to know. Only people are granted access to the identified data that need to know to work on it. And it's called lease privilege. So people are assigned the very least privilege necessary to execute their job function. The other item that I think is probably worth mentioning is NCGIS references it as information exchange agreements. In the state, we have Bolton 3.5, which says we need data sharing agreements between any external entity in the government as well as across branches. So he just takes it one step further and says any entity sharing data needs to have a data sharing agreement in place. And then the last item is really for, yeah. I'll go ahead, Mark. In the bill itself, is there language we need to add or do you consider that to be part of ADS's purview that we're going to try to make clear with the security issues? Or is there something that we need to add in your view? I would defer to the attorneys on it, maybe a line item of need to abide by federal and state laws. Right. And it could be inclusive there. I think in order, Martin, if as we're talking to Ledge Council, we refer to sieges compliance because then people have to search for that and understand it. If we just say federal compliance, it's like, oh yeah, just another federal thing. No, but when you talk about sieges, sieges is pretty intentional. And so I think that would clarify for internal and external viewers or requesters of any way, if that makes sense. So I guess the question though for Mr. Clore is, is there, are we leaving something out if we just say sieges or is that really the main focus here? I know we have Public Records Act, we're going to be dealing with that separately, but is there anything- I don't think we're leaving anything out if we just call out the sieges requirements. Yeah. Okay, thank you. I think Coach is going to say something. Well, I was going into a strange place, Martin. That's a strange place. All right, I guess not. Anything else on that before we talk about the technology cost? I don't think so. I think that was helpful. Okay. So I'll focus on the identified data technology cost and then just kind of note the difference in it where it would be for de-identified data. So again, these are kind of rough assumptions with a lot of, I assumed information about the data and the size of the data, the number of different data sets that would be sent just so we could have a ballpark estimate to talk through. So the bottom line, ADS cost which includes both the technology cost and resource cost ranges from about 450, 450K to 550K. And the 450K is the de-identified ballpark cost. The 550K is the identified data ballpark cost. Do you want me to break it down by technology and resource and like the division of ADS kind of standard charges? Actually, I need something probably a higher level. Okay. Sure. Tom, I didn't know if you saw me again, Tom. Yeah, yeah, go ahead. Martin, just jump right in. Not a big deal. Okay. So when you're talking about identified and de-identified, is this cost specific? What's this cost, well, I guess I'm all of a sudden said specific when I said I wanted to hear general. I mean, is it for the various agencies within the administration and cost associated with the data coming from there? I assume it doesn't include the court or is this something different? Well, if you could describe that kind of a higher level and then into the specifics. Sure. There, these would be cost incurred to support the data that the division would be receiving and the analytics that the division would need. The difference in the cost for the de-identified and identified data. One is around that C just compliant environment for the technology. And that's about 40,000. That's a one-time setup cost. So you would incur that really in the first year to set up your compliant environment. And then going forward, you wouldn't have that $40,000 cost. The other component is around resources. And with identified data, as you mentioned before, it has that matching component. So that drives additional workload on the DBA resource. So we're estimating about three quarters of the DBA resource for identified data to do that matching. The difference that DBA cost, it would drop to about a half a resource, a half FTE for the de-identified data. So is that DBA? DBA, I'm sorry. Oh, sorry, database administrator. Oh, okay. And they would be receiving the data that the different entities send the division. They would get that data, load it into a database, and then perform that matching for the division. So if I could ask, this is a higher level question. And this is great that you're getting into this. This is exactly, I'm delighted that we are getting into these details. So the way that, I mean, this document does not spell out nicely the staffing. But I will tell you what it was based on, just so you know, and it was just really as a placeholder. And that was, we calculated, this was based on a bill last year, H317, which is kind of the precursor to this bill. And it was based on having a deputy director, two IT analysts, essentially, and one administrator for this division. And I guess what I'm wondering is whether that's appropriate, or whether it's not as many people in the division because we're relying on a lot of work on ADS. If that's the vision, and I'm happy to work with however the administration wants to work on this, and I'm just trying to understand that for our ask. So if I'm falling correctly, forehead count for the division? Right, right. Yes. I have no idea if that's the right number. I mean, I just want to, we put that in there as a placeholder because we're not the experts on this. Yeah, she's got it. But she was just getting ready to tell us. How that equated. Yeah, reading through the bill that seems like that was my gut feel. I estimated in this about five headcount for the division. This would be additional headcount from ADS to support that, to support the data the division receives. Okay, great. Thank you very much. So as I mentioned, we have that database administrator resource. We also in this estimate included a project manager because we assumed this is, well, this isn't a very tech heavy item. It is a very resource intensive on the division and the business area is sending the data. So we assumed one project manager for at least a year, potentially two may be needed as part of this cost estimate. So I guess Martin, in order to help not only our committee, but other of our colleagues who might not see the back end of ADS, this has offered a lot of clarity, actually. You know, and I think that it could be because we wanna ensure that everybody understands what this is all about. We might need to go into a little more detail in our noting information in our bill. You know, I'd rather have a little more volume, especially if people are gonna understand that ADS's supports are this, in the background over and above what the division is actually doing with their manpower or people power, so to speak. Does that make sense? Yeah, I think that what we can ponder this a little more, what I envisioned and was gonna ask Mr. McClure if we can get this information in writing as well, just so, because I'm trying to keep it up and to understand what is a one-time cost versus what the estimate might be for down the road. Maybe that's hard to do, but I mean, the estimate for down the road is not obviously as critical because we're not gonna ask the appropriations for that. But I would think that would go all into a joint fiscal office report and that's as much for appropriations to parse through as us. So I don't know if I wanna be overly prescriptive in the bill as opposed to here's the bottom line number and the backup support is the JFO report. Isn't that how that would run? We could do it either way. I think that it would be if Kristen felt being that you've been doing this for us across other agencies. If there's a standard protocol for dissemination of the information so that the folks on the policy side can implement, however you feel is best, I think Martin's point is well taken that because they just did a fiscal note on the per diem bill actually and we just got that back today and it was very informative. So I think when JFO does their piece, that analysis is critical for a lot of our members in the body. So, Mr. Claw, did you have more as far as, I think I may have jumped in there before you had finished and I apologize. That covered the cost discussion. Okay, all right, thank you. And I can send you that in a document as well. Great, great. That would be very helpful. I wonder if I could ask kind of your opinion from that when you saw this, you estimated five FTEs necessary. Can you just explain that a little bit more? Because again, that four, it wasn't made up, it was based on some other things, but I would certainly like to understand where you came up with the five, that's very helpful. Yeah, I was estimating like you were a lead for the division and two data stewards. Again, the majority of the work and it is a substantial piece of work will be on the division and potentially the area sending the data. So it's gonna be intensive from a process perspective for the division. So I was ballparking two data stewards and two data analysts to do the analysis work. So did you have a chance to read the RDAF report on this from November? I'm just curious if you- Not the one from November from the previous year. Because it was just, they didn't really specify the number of people but they specified in their recommendations, they came up, look, here's what FTEs should cover. Here's kind of like the responsibilities they set out. I guess if I could ask you, if you would have a chance to perhaps review that and get back to us if anything jumps out at you because you probably will be having you back in again, almost certainly not here. It's gonna travel for the government operations committee and then to appropriations and almost certainly we'd be reaching out to you among a number of other witnesses. And kind of having had a chance to look at what they suggested may be helpful. Sure, I'll share. Yeah, and it might be just in terms of having done a little bit of this before. I think that sometimes it'll be a question of terminology where we might say, we might say Dana analyst and someone else will say, data steward, you know. And so... Exactly, right. Yeah. So once we get clear on our language, that'll hopefully help people as well. So just a point. And as a question. So good afternoon. So just to be clear, we're talking about four additional people to handle this now. Not from the ADS perspective. How many are we talking from ADS? For the identified data, one PM we would recommend and three quarters of an FDE for a database administrator. Okay. And what about, is there enough? I don't have the proper word. I wanna say computers, equipment, stuff like that is ADS equipped to handle this extra load. Yeah, I think you're asking the load of the work of the data coming in and the hosting of it. Right. And in that case, that's where we factor in the one or the three quarters of a DBI and the hosting costs are also factored into this. The PM that we have factored into this that I mentioned, we have it factored in at a rate for a contractor because to your point, can ADS handle this load? We have a number of projects that are ongoing this year into next year and we're hitting the limit of the number of PMs we have at the state level. So it factors in the contract rate for the PM. And that was my next question of clarification is you're already understaffed over there already, correct? So you're having a difficult time with workforce just like everybody else. I assume that's a fair statement. Thank you. Bob. Just for clarification, I'm hosting financial culture for Martin or Kristen. So two questions, exactly how many employees are we discussing here with ADS, without ADS? And is this proposal to bring on more state employees or these all-contracted positions? Well, I can start answering. The division would certainly be state contractors and presumably the three-quarter FTE, I would assume, and Mr. Cork can answer that part of it. But I did have another question actually related to this when you addressed this. Well, actually go ahead and I'll ask the question afterwards. I was basically, I just want to total to the specific. Yeah, well, here's the question related to a division and what ADS is going to be doing. Yeah, yeah. And that's part of what it was great testimony that to help us clarify who does what. The question, I guess, if Mr. Cork could answer this, is the estimated five FTEs that we have for the division, this kind of project, would you understand that that's not for the life of the project? It's a lot, I would assume there's a lot of upfront work to get these systems talking to each other. So this may be a two or three year, or what would be your estimate before we can lower the number of people that we have in that division? That's exactly right. It would be a bubble of upfront work, realistically probably for two years for the division. Again, it's a pretty work-intensive project for them. So I would see a bubble of upfront work, which is where, again, I was ballparking five headcount. And I would see that kind of trail off when it reaches steady state to maybe two or three. And if I may, Bob, to Bob's question, when we do our JFO analysis, they will disaggregate the behind the scenes piece from ADS and the front-end piece of the Bureau. So we will be able to see clearly what Ms. McClure has shared with us from ADS as far as their labor need and the recommended need for the new division. So we will have a very clear appraisal of that at that point in time. So will the committee see that or just guess? Oh, yeah, yeah. No, that's the whole idea behind the fiscal note. When somebody makes that request, the whole idea is so that it's visible, so that we can all make good decisions. I testified in government operations yesterday about per diems and one of our colleagues asked for if we had a fiscal note. Well, they had a fiscal note this afternoon. So it's something that we all need in order to make qualitative decisions. Thank you. Just to be clear here, this starting point with this money and stuff like this, I don't think anybody should be under an illusion that the price is gonna drop down as this gets easier because it's not. I mean, the cost of doing business is salaries and all this other stuff is gonna go up every year. So just to add on to what Bob was, I think, looking for, I don't want to speak for Bob. Well, those are costs of living, you know? We had a 3.6% increase in our 438 employees in another organization I'm working with, so I fully understand what you're referring to. So there isn't any drop-off, even though the efficiency and effectiveness changes as we go. So it isn't what it is. Yeah? Not the first rodeo, so to speak. I realize I stepped out of the room, but it sounds like this is a very helpful test of money. And thank you. I'm not seeing any other hands right now, right? So you have Michelle who's available for to make up what we can do this morning. So anything else before we? No, I think we're fine. And I appreciate whatever you can send me so I can get that joint fiscal office starting to work on that list before. I really appreciate your testimony. Thank you. Thank you. Thanks, everyone. Thank you. Thanks.