 Section: 480-3 Effective: 02/01/2012 Supersedes: 12/28/1978 Next Review Date: Issuance Date: 02/01/2012 Issuing Office: IPA Coordinator Responsibilities and Guidelines for Handling Records Containing Information About Individuals |
These guidelines should be interpreted to benefit the individual. Where discretion is allowed, the protection of privacy should override the option to disclose. These issues are often complex and frequently require legal interpretation by UC Counsel. To assist departments with record matters a Records Advisor has been appointed for each functional area on campus. See Supplement I for a listing of Records Advisors. These guidelines do not encompass student records as defined in the Family Education Rights and Privacy Act (FERPA). For information regarding access to student records, please refer to UC Policies and UCSD Campus Regulations Applying to Campus Activities, Organizations, and Students available in the Central University Library. The term ``individual'' means a natural person acting in the person's individual and private capacity as opposed to public employment or business proprietorship. The term ``person'' means any natural person, corporation, partnership firm, or association. The term data subject refers to an individual who is the subject of the record. The term ``third party'' means any individual or person other than the individual who is the subject of the record. The term ``record'' means any file or a grouping of information about an individual which is maintained by the University and that contains the individual's name or identifying number, symbol or other identifying particular. The term ``system of records'' means one or more records, which pertain to one or more individuals, which is maintained by the campus from which information is retrieved by the name of an individual or by some identifying number, symbol, or other identifying particular. The term ``disclosure'' means to release, transfer, disseminate, or otherwise communicate all or any part of a record orally, in writing, or by electronic or any other means to any person or entity. The term ``amend'' means to change the record in any way. The term ``confidential information'' means any record pertaining to: The enforcement of criminal laws as its principal function if the information is: compiled for the purpose of identifying individual criminal offenders and alleged offenders, compiled for the purpose of a criminal investigation of suspected criminal activities, and compiled at any stage of the process of enforcement of the criminal laws, from the arrest or indictment stage through release from supervision and including the process of extradition or the exercise of executive clemency. Information consisting solely of written testing or examination material, or scoring keys used solely to determine individual qualifications for appointment or promotion in public service, or used to administer a licensing examination, or academic examination, the disclosure of which would compromise the objectivity or fairness of the testing or examination process. Information containing medical, psychiatric, or psychological material if a professional determines that disclosure of the information would be medically or psychologically detrimental to the individual. Such information shall, upon written authorization, be disclosed to a physician, psychiatrist or other licensed medical or psychological personnel designated by the data subject. Information consisting solely of investigative materials maintained by an agency for the purpose of investigating a specific grievance, complaint, or violation of state law, but only so long as an investigation is in progress and such investigative information has not been maintained for a period longer than is necessary to complete a criminal, civil, or administrative prosecution or initiate other remedial action. The source or sources of information used for an investigation under this section may be kept confidential so long as the confidentiality is necessary to protect its law enforcement activities. Records consisting of information used solely for the purpose of verifying and paying government health care service claims made pursuant to the Welfare and Institutions Code. Any information which is required by statute to be withheld from the individual to whom it pertains. Academic Personnel Review files, including letters of recommendation, and ad hoc committee reports, pending result of litigation. The term ``nonpersonal information'' means: Information consisting only of names, campus addresses, campus telephone numbers, and other limited factual data which could not, in any reasonable way: reflect or convey anything detrimental, disparaging, or threatening to an individual's rights, benefits, privileges, or qualifications, and be used to make a determination that would affect an individual's rights, benefits, privileges, or qualifications. A campus telephone book or directory. A card catalog of any campus library, or the contents of any book listed within the card catalog. A mailing list consisting of campus addresses used exclusively to mail University or campus information. Records required by law to be maintained and used solely as a system of statistical records, as long as such records are not used in making any determination about an identifiable individual. Any information in any record about an individual that is maintained by the University and is not included in the definitions of non personal and confidential in the above paragraphs. Process all requests related to the personnel records of persons holding appointment in an academic title. Requests will be processed in accordance with PPM 230-11, ``Maintenance of, Access to, and Opportunity to Request Amendment of Academic Personnel Records.'' Process requests for access to personnel files located in Staff Personnel Office. (See PPM 250-605.) Process requests from individuals to review refusals to amend staff personnel records. (See PPM 250-605.) Maintain accurate and up to date records. Serve as initial contact for individual seeking access or amendments to records. Contact Records Advisor when questions arise. Route requests for information from third parties to Records Advisor. Maintain a log of all third party disclosures. (See Exhibit D.) Upon receipt of a request to access records, ensure that all related records are identified and maintained for inspection. Destruction of records after receipt of a request is a violation of the Information Practices Act. Follow Code of Conduct in handling University Records containing information about individuals (See Supplement II). Conduct annual inventory of campus record keeping systems and report findings to Systemwide. Assist individuals in locating records containing personal information about themselves. Serve as consultant to Records Advisors and campus personnel regarding privacy laws as they relate to University records. Serve as Chair of Records Advisors Committee. Serve as the campus liaison with Systemwide offices including General Counsel. Upon request by an individual who is the subject of the record, assemble the Records Advisors Committee to review a refusal to amend records. (Personnel records and student records are excluded from this process.) Distribute information regarding privacy laws and policies throughout campus. Upon request from an individual who is the subject of the record, evaluate the confidential designation of information made by the Record Holder / department. Advise departmental personnel in matters relating to records particularly privacy of and access to information. Consult with campus IPA coordinator when questions or concerns arise. Serve on Records Advisors Committee. Ensure that information regarding privacy laws and policies / procedures are disseminated through area of responsibility and arrange for training of employees. Upon notification from IPA coordinator, review a refusal to amend records (personnel and student records are excluded). Review all requests for information from Third Parties. Appoint Records Advisor for area of responsibility. Maintain close communication with Records Advisor regarding matters involving privacy laws and policies. Vice Chancellor-Academic Affairs responds to requests from governmental agencies for access to academic personnel records. Vice Chancellor-Business & Finance responds to requests from governmental agencies for access to staff personnel records. The name of the campus department requesting the information. The title, campus address and telephone number of the person responsible for the record keeping system. The University policy or other legal authority which authorizes the maintenance of the information being collected on the form. Whether submission of the information on the form is mandatory or voluntary. The consequences, if any, of not providing all or any part of the requested information. Describe the principal purpose or purposes for which the information being collected is to be used. The right of the individual who is the subject of the record to review records containing personal information maintained on him or her by the University. A simple statement such as: ``You have the right to review the record as it pertains to yourself'' is sufficient. List any known or forseeable disclosures which may be made to a governmental agency of the information being collected (if there are none, leave this point off the statement). A notification statement guide which is to be used to meet these requirements is attached as Exhibit A. This format has been approved by the Systemwide IPA Coordinator and General Counsel. Notification statements that vary from this form must be approved by the campus IPA Coordinator. Upon request, an individual who is the subject of the record shall be notified as to whether the University maintains a record about himself/herself. If it is found that records are maintained about the individual, the campus shall so inform the subject individual, provide the title and business address of the official responsible for the record, and refer the subject individual to these guidelines for access and appeal procedures. The Request for Records Access form, Exhibit B, is to be used for this purpose. This section applies only to personal information and not confidential information. See Section III for definitions. Requests may be directed to the Record Holder or the IPA Coordinator if there is a question as to the location of the information. A driver's license with a photograph is sufficient in most cases when an individual appears in person. Personal information should not be given over the telephone unless there is adequate assurance of the identity of the caller. Record Holders must not allow themselves to be pressured into providing personal information over the telephone where the identity of the caller is uncertain. If information is requested by mail, signature verification might be enough assurance or Record Holders may ask the individual to sign and return a Request for Records Access, Exhibit B. a copy of the material with deletions made to protect the identity of the source of the information; or in the case of academic personnel records, a comprehensive summary of the information. (See 160-20C of the APM and PPM 230-11.) The individual directly affected by the confidential designation of the information may request a review of the designation. The Request for Records Access form is to be used for this purpose. The individual who is the subject of the record will be informed of the findings of such review within 30 calendar days from receipt of the request for review. If the individual, who is the subject of the record, is a University employee, the subject employee may schedule time off from work to review records containing personal information when the following criteria are met: Scheduled time off does not have a serious adverse effect on the employee's work unit. The supervisor has approved the time off. The use of overtime is avoided. Under no circumstances shall a supervisor willfully prevent an employee from scheduling an appointment to review records containing personal information within 30 days from receipt of request. Appointments for review of records containing personal information should be mutually acceptable to all involved. Disputes over scheduling appointments to review records should be referred to the campus IPA Coordinator for resolution. Records containing personal information may be disclosed to a third party with the prior written voluntary consent of the individual who is the subject of the record, but only if consent has been obtained not more than 30 days before disclosure, or time limits have been specified. There shall be no charge made for copies if the campus provides record copies in lieu of allowing access to actual records. In processing amendments to records containing personal information, keep in mind that requests pertaining to staff personnel records are governed by PPM/SPM 250-605 and requests pertaining to academic personnel records are governed by PPM 230-11. Requests pertaining to other records are governed by this policy (student records are excluded). The individual who is the subject of the record is entitled to request a review of the decision not to amend a record. See PPM/SPM 250-605 for staff personnel records and PPM 230-11 for academic personnel records. The following applies to requests for reviews pertaining to all other records (student records are excluded). The statement should be of reasonable length (usually not more than one or two pages). The statement should specify the corrections requested and reasons why each correction should be made. The statement will be filed with the record in dispute. A campus statement must be filed with the record in dispute as well. The Committee's notification to the subject individual may serve as the campus statement for the record. The two statements must be made available to persons or agencies to whom the disputed information was or is disclosed. Disclosure of personal information is only permitted under very specific conditions which are described in this section. Whenever personal information is disclosed, a Notice of Redisclosure, Exhibit E, should be given to the requesting individual, agency, institution, University department or other third party. Disclosure is permitted if the personal information disclosed is relevant and necessary in the ordinary course of their official duties and is related to the purpose for which the information was acquired. All requests from governmental agencies for access to personnel records must be referred to either the Vice Chancellor-%Academic Affairs or the Vice Chancellor-%Business & Finance. See PPM 480-5 for full details. Disclosures of personal information about an individual to any other person must be approved by the appropriate Records Advisor. If it is determined that personal information cannot be released, written notification shall be sent to the third party indicating the reason(s) for the refusal. Exhibit B may be used for this purpose. One of the following conditions must be satisfied before the disclosure will be made: The individual who is the subject of the record must have given prior written voluntary consent not more than 30 calendar days before the disclosure or within time limits specified by said individual in the written consent. The individual who is the subject of the record has a duly appointed guardian or conservator, or is represented by another person, and it can be proven with reasonable certainty that such person is the individual's authorized representative. The personal information is available in accordance with provisions of the California Public Records Act. This includes information which is part of an individual's employment contract with the University. The following information shall be released upon request: The employee's date of hire, current job title, current rate of pay, organizational unit assignment, and current job description. The Records Advisor has received advance, adequate, written assurance that the personal information will be used solely for statistical research or reporting purposes, and the information is in a form that will not identify an individual. Transfer of the personal information is necessary for the transferee agency to perform its constitutional or statutory duties, and such use is compatible with a purpose for which the information was collected. The record is requested under a State or Federal law and is released to a governmental entity. The Records Advisor determines that compelling circumstances exist which affect the health or safety of an individual. A notice that the personal information has been disclosed will be sent to the last known address of the individual who is the subject of the record. The disclosure is pursuant to a subpoena, court order, or other circumstances where the University is required by law to release the personal information. Prior to disclosure the Records Advisor must make a reasonable attempt to notify the individual who is the subject of the record. In the case of medical records, a subpoena duces tecum issued and served by a private party or an agency of the Federal government must include a certificate signed by the subpoenaing party or his/her attorney saying that they have notified the individual to whom the subpoenaed records pertain that his/her records are being sought. the records pertain must accompany the subpoena duces tecum prior to disclosure. The disclosure is pursuant to a search warrant. The disclosure is to a law enforcement agency engaged in the investigation of unlawful activity, unless such disclosure is otherwise prohibited by law. The disclosure is to a department of the University or a non-profit educational institution conducting scientific research, provided the request for information has been approved by the appropriate Human Subjects Committee and includes assurances that personal or confidential information is needed; procedures are established to protect the confidentiality of the information; and the personal identity of the subject shall not be disclosed further. The disclosure is to a committee of the State Legislature or to a member of the State Legislature when they have the permission of the individual to whom the information pertains. If a department head wishes to provide an oral evaluation of an individual in response to specific job related questions from a perspective non-University employer, refer to Staff Personnel Policy 250-605.25. The disclosure is to another government agency responsible for enforcing a specific state law, and it is necessary to investigate a case. The disclosure is to the Office of Information Practices when it is investigating a complaint regarding an alleged violation of the IPA or performing its mediation functions, and it has received the written voluntary consent for such a transfer from the individual who is the subject of the record. All disclosures of personal information to third parties are to be approved by the appropriate Records Advisor and recorded. Exhibit D, Disclosure Log, may be used for this purpose. The log forms may be kept with the individual record disclosed or may be kept as a separate record of disclosures made by the department. In either case, the Disclosure Log shall be made available for inspection by the individual who is the subject of the record. If the record of disclosures is kept as a separate file, one individual must not be given the record of disclosures made about other individuals. The Logs shall be retained for at least three (3) years after the disclosure was made. The IPA provides specific civil remedies and penalties for violations of the law. The complete text of the IPA is available from reference section of the Central Library. University employees acting in good faith, without fraudulent or malicious intent, are not individually liable for acts or omissions within the scope of their employment. The following will provide an overview of the types of penalties associated with improper handling of %University records. Any person who intentionally discloses information not otherwise public which he or she knows or reasonably should know was obtained from personal or confidential information maintained by the University shall be subject to a civil action for invasion of privacy by the individual to whom the information pertains. In any successful action, the plaintiff may be awarded damages, a minimum of $2500 in exemplary damages, as well as attorney's fees and other costs of litigation. Any person who willfully requests or obtains any record containing personal or confidential information from the University or campus under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000 or imprisoned not more than one year or both. An officer or employee of the University who intentionally violates any provision of the IPA, or any rules or regulations adopted thereunder, shall be disciplined. Discipline will be commensurate with the severity of the consequences of the violation and the degree of intent or negligence of the employee. Discipline may include termination of employment. EXHIBIT A This guide is to be used to develop an appropriate notification statement when collecting personal information. It has been approved by general counsel and may not be changed without prior approval from the campus IPA Coordinator. The State of California Information Practices Act of 1977, effective July 1, 1978, requires the University to provide the following information to individuals who are asked to supply information about themselves. The principal purpose for requesting the information on this form is to (be specific) Maintenance of this information is authorized by (state policy or list laws). Furnishing information requested on this form is mandatory, failure to provide such information Information furnished on this form may be used by various University departments for(list other uses)and will be transmitted to the State and Federal governments if required by law. Individuals have the right of access to this record as it pertains to themselves. The official(s) responsible for maintaining the information contained on this form is (are): Name and campus address, or title and campus address, of responsible officer. EXHIBIT B The Above Form is in PDF Format EXHIBIT C The Above Form is in PDF Format EXHIBIT D To be used to record disclosures of personal information made to all third parties. The Form is available in PDF format. EXHIBIT E PERSONAL INFORMATION This is a sample statement that should be used to warn persons and agencies receiving personal information from University records. This information has been disclosed to you from the files of The intentional redisclosure of this information may subject you to a civil action under Section 1798.53 of the Civil Code for invasion of privacy by the individual to whom the information pertains. You are advised to be certain of your authority to further disclose any of this information before doing so.
|