Ohio Administrative Code
Title 1301 - Department of Commerce - Administration and Director
Chapter 1301-1 - Notice of Rules
Section 1301-1-03 - Procedures for accessing confidential personal information
Universal Citation: OH Admin Code 1301-1-03
Current through all regulations passed and filed through September 16, 2024
(A) For the purposes of this rule promulgated in accordance with section 1347.15 of the Revised Code, the following definitions apply:
(1)
"Access" as a noun means an opportunity to copy, view,
or otherwise perceive whereas "access" as a verb means to copy, view, or
otherwise perceive.
(2)
"Acquisition of a new computer system" means the
purchase of a "computer system," as defined in this rule, that is not a
computer system currently in place nor one for which the acquisition process
has been initiated as of the effective date of the this rule.
(3)
"Agency" means
the department of commerce and includes the divisions thereof.
(4)
"Computer
system" means a "system," as defined by section
1347.01 of the Revised Code,
that stores, maintains, or retrieves personal information using electronic data
processing equipment.
(5)
"Confidential personal information" (CPI) has the
meaning as division (A)(1) of section
1347.15 of the Revised Code and
as identified by this rule promulgated in accordance with division (B)(3) of
section 1347.15 of the Revised Code,
which includes references to the federal or state statutes or administrative
rules that make personal information maintained by the agency
confidential.
(6)
"Employee of the state agency" means each employee of
the agency regardless of whether he/she holds an elected or appointed office or
position within the agency.
(7)
"Incidental
contact" means contact with the information that is secondary or tangential to
the primary purpose of the activity that resulted in the contact.
(8)
"Individual" means natural person or the natural person's authorized
representative, legal counsel, legal custodian, or legal guardian.
(9)
"Information owner" means the individual appointed in accordance with division
(A) of section 1347.05 of the Revised Code to
be directly responsible for a system.
(10)
"Person" means
natural person.
(11)
"Personal information" has the same meaning as defined
in division (E) of section
1347.01 of the Revised
Code.
(12)
"Personal information system" means a system that
maintains personal information as those terms are defined in section
1347.01 of the Revised Code.
"System" includes manual and computer systems.
(13)
"Research"
means a methodical investigation into a subject.
(14)
"Routine" means
common place, regular, habitual, or ordinary.
(15)
"Routine
information that is maintained for the purpose of internal office
administration, the use of which would not adversely affect a person" as that
phrase is used in division (F) of section
1347.01 of the Revised Code
means personal information relating to the agency's employees that is
maintained by the agency for administrative and human resource purposes.
(16)
"System" has the same meaning as defined by division (F) of section
1347.01 of the Revised
Code.
(17)
"Upgrade" means a substantial redesign of an existing
system for the purpose of providing a substantial amount of new application
functionality, or application modifications that would involve substantial
administrative or fiscal resources to implement, but would not include
maintenance, minor updates and patches, or modifications that entail a limited
addition of functionality due to changes in business or legal
requirements.
(B) For personal information systems, whether manual or computer systems, that contain confidential personal information, the agency shall do the following:
(1)
Criteria for accessing confidential personal
information. Personal information systems of the agency are managed on a
"need-to-know" basis whereby the information owner determines the level of
access required for an employee of the agency to fulfill his/her job duties.
The determination of access to confidential personal information shall be
approved by the employee's supervisor and the information owner prior to
providing the employee with access to confidential personal information within
a personal information system. The agency shall establish procedures for
determining a revision to an employee's access to confidential personal
information upon a change to that employee's job duties including, but not
limited to, transfer or termination. Whenever an employee's job duties no
longer require access to confidential personal information in a personal
information system, the employee's access to confidential personal information
shall be removed.
(2)
Individual's request for a list of confidential
personal information. Upon the signed written request of any individual for a
list of confidential personal information about the individual maintained by
the agency, the agency shall do all of the following:
(a)
Verify the
identity of the individual by a method that provides safeguards commensurate
with the risk associated with the confidential personal information;
(b)
Provide to the individual the list of confidential personal information that
does not relate to an investigation about the individual or is otherwise not
excluded from the scope of Chapter 1347. of the Revised Code; and
(c)
If
all information relates to an investigation about that individual, inform the
individual that the agency has no confidential personal information about the
individual that is responsive to the individual's request.
(3)
Notice of invalid access.
(a)
Upon discovery or notification that confidential
personal information of a person has been accessed by an employee for an
invalid reason, the agency shall notify the person whose information was
invalidly accessed as soon as practical and to the extent known at the time.
However, the agency shall delay notification for a period of time necessary to
ensure that the notification would not delay or impede an investigation or
jeopardize homeland or national security. Additionally, the agency may delay
the notification consistent with any measurers necessary to determine the scope
of the invalid access, including which individuals' confidential personal
information invalidly was accessed, and to restore the reasonable integrity of
the system. For purposes of this paragraph, "Investigation" means the
investigation of the circumstances and involvement of an employee surrounding
the invalid access of the confidential personal information. Once the agency
determines that notification would not delay or impede an investigation, the
agency shall disclose the access to confidential personal information made for
an invalid reason to the person.
(b)
Notification
provided by the agency shall inform the person of the type of confidential
personal information accessed and the date(s) of the invalid access.
(c)
Notification may be made by any method reasonably designed to accurately inform
the person of the invalid access, including written, electronic, or telephone
notice.
(4)
Appointment of a data privacy point of contact. The
director of the agency shall designate an employee of the agency to serve as
the data privacy point of contact. The data privacy point of contact shall work
with both the implementation of privacy protections for confidential personal
information that the agency maintains and compliance with section
1347.15 of the Revised Code and
this rule.
(5)
Completion of a privacy impact assessment. The data
privacy point of contact shall timely complete the privacy impact assessment
form developed by the office of information technology.
(C) Pursuant to the requirements of division (B)(2) of section 1347.15 of the Revised Code, this rule contains a list of valid reasons directly related to the agency's exercise of its powers or duties for which only employees of the agency may access confidential personal information (CPI) regardless of whether the personal information system is a manual system or a computer system:
(1)
Performing the
following functions constitute valid reasons for authorized employees of the
agency to access confidential personal information:
(a)
Responding to a
public records request;
(b)
Responding to a request from an individual for the
list of CPI the agency maintains on that individual;
(c)
Administering a
constitutional provision or duty;
(d)
Administering a
statutory provision or duty;
(e)
Complying with
any state or federal program requirements;
(f)
Processing or
payment of claims or otherwise administering a program with individual
participants or beneficiaries;
(g)
Auditing
purposes;
(h)
Licensure, registration, permitting, etc.,
processes;
(i)
Investigation or law enforcement purposes;
(j)
Administrative hearings;
(k)
Litigation, complying with an order of a court, or
subpoena;
(l)
Human resource matters (e.g., hiring, promotion,
demotion, discharge, salary/compensation issues, leave requests/issues,
training, time card approvals/issues);
(m)
Complying with
an executive order or policy;
(n)
Complying with
an agency policy or a state administrative policy issued by the department of
administrative services, the office of budget and management or other similar
state agency; or
(o)
Complying with a collective bargaining agreement
provision.
(2)
For employees of the division of liquor control, in
addition to the reasons specified in paragraph (C)(1) of this rule, the
following functions also constitute valid reasons for authorized employees of
the agency to access confidential personal information:
(a)
Carrying out
duties and responsibilities for the operation, management, and control of the
division of liquor control's spirituous liquor agency stores;
(b)
Carrying out
duties and responsibilities to maintain a state monopoly of the distribution of
spirituous liquor.
(D) The following federal statutes or regulations or state statutes and administrative rules make personal information maintained by the agency confidential and identify the confidential personal information within the scope of the rules promulgated by this agency in accordance with section 1347.15 of the Revised Code:
(1)
5 U.S.C.
552a, for social security numbers unless the
individual was told that the number would be disclosed.
(2)
Divisions (A)
and (D) of section 109.57 and section
4776.04 of the Revised Code and
42 U.S.C.3789(g).
(3)
26
U.S.C. 6103
(4)
20
U.S.C. 1232(g)(b)(1).
(5)
Divisions (F)(3)(a), (F)(4) and (I) of section
169.03, sections
1121.11,
1121.18,
1121.25,
1155.091,
1155.16,
1163.20,
1163.121,
1315.03,
1315.122, division (A) of
section 1321.09, sections
1321.44,
1321.48,
1321.55, division (B) of section
1321.551321.76, divisions (A) and (B) of section 1322.061, division (Q) of
section 1707.03, division (W) of section
1707.03, sections
1733.32,
1733.327, 1765.21,
2710.03,
2710.07,
3319.321,
3737.16,
4727.18, division (D) of section
4735.05, division (D) of section
4763.03, and division (A)(1) of
section 4763.05 of the Revised
Code.
(6)
Rules 109:05-1-01 and
1301:9-3-09
and paragraphs (B)(1), (B)(2) and (H) of rule
1301:10-3-04
of the Administrative Code.
(E) For personal information systems that are computer systems and contain confidential personal information, the agency shall do the following:
(1)
Access
restrictions. Access to confidential personal information that is kept
electronically shall require a password or other authentication measure.
(2)
Acquisition of a new computer system. When the agency acquires a new computer
system that stores, manages, or contains confidential personal information, the
agency shall include a mechanism for recording specific access by employees of
the agency to confidential personal information in the system.
(3)
Upgrading
existing computer systems. When the agency modifies an existing computer system
that stores, manages, or contains confidential personal information, the agency
shall make a determination whether the modification constitutes an upgrade. Any
upgrades to a computer system shall include a mechanism for recording specific
access by employees of the agency to confidential personal information in the
system.
(4)
Logging requirements regarding confidential personal
information in existing computer systems.
(a)
The agency shall
require employees of the agency who access confidential personal information
within computer systems to maintain a log that records that access.
(b)
Access to confidential information is not required to be entered into the log
under the following circumstances:
(i)
The employee of the agency is accessing confidential
personal information for official agency purposes; including research, and the
access is not specifically directed toward a specifically named individual or a
group of specifically named individuals.
(ii)
The employee of
the agency comes into incidental contact with confidential personal information
and the access of the information is not specifically directed toward a
specifically named individual or a group of specifically named
individuals.
(iii)
The employee of the agency accesses confidential
personal information about an individual based upon a request made under either
of the following circumstances:
(a)The individual requests confidential personal information
about himself/herself.
(b)The individual
makes a request that the agency takes some action on that individual's behalf
and accessing the confidential personal information is required in order to
consider or process that request.
(c)
For purposes of
this paragraph, the agency may choose the form or forms of logging, whether in
electronic or paper formats.
(5)
Log management.
The agency shall issue a policy that specifies the following with regard to the
log that is required to be maintained pursuant to division (B) of section
1347.15 of the Revised Code and
paragraph (E)(4) of this rule:
(a)
Who shall maintain the log;
(b)
What information
shall be captured in the log;
(c)
How the log is
to be stored; and
(d)
How long information kept in the log is to be
retained.
(6)
Nothing in this rule limits the agency from requiring
logging in any circumstances that it deems necessary.
Five Year Review (FYR) Dates:
05/04/2017 and
05/04/2022
Promulgated
Under: 119.03
Statutory
Authority: 1347.15(B)
Rule Amplifies:
1347.15
Prior
Effective Dates: 11/22/2010
Disclaimer: These regulations may not be the most recent version. Ohio may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
