4765-2-06 Personal information system.

(A) In accordance with section 1347.05 of the Revised Code, the division shall appoint a privacy officer who shall be directly responsible for the personal information system operated or maintained by the division. Responsibilities of the privacy officer or the privacy officer's designee include, but are not limited to, the following:

(1) Receive all correspondence or inquiries related to personal information or the system;

(2) Inform each division employee who has any responsibility for the operation or maintenance of the system, or for the use of personal information maintained in the system, of the applicable provisions of Chapter 1347. of the Revised Code, and any applicable rules adopted thereunder;

(3) Monitor the accuracy, relevance, timeliness, and completeness of the personal information in the system and, in accordance with procedures established by the division, maintain the personal information in the system with the accuracy, relevance, timeliness, and completeness that is necessary to assure fairness in any determination made with respect to a person on the basis of information contained within the system;

(4) Assure the collection, maintenance, and use of only personal information that is necessary and relevant to functions the board is required or authorized to perform by statute or rule, and the elimination of such information from the personal information system when it is no longer necessary or relevant to functions of the board;

(5) Assure that the division does not place personal information in an interconnected or combined system, or use personal information that is placed in an interconnected or combined system by another state or local agency or another organization, unless the interconnected or combined system will contribute to the efficiency of the involved agencies in implementing programs that are authorized by law;

(6) Assure that the division does not use personal information placed in an interconnected or combined system by another state or local agency or another organization unless the personal information is necessary and relevant to the performance of a lawful function of the board or division.

(7) Provide a person who is asked to supply personal information that will be placed in an interconnected or combined system, with information relevant to the system, including the identity of the other agencies or organizations that have access to the information in the system.

(B) The division shall inform a person who is asked to supply personal information for the system whether such person is legally required, or may refuse, to supply the information.

(C) The division shall allow a person who is the subject of any record in the personal information system to inspect the record and dispute any information contained therein, in accordance with section 1347.08 of the Revised Code. Upon the request of such person, the division shall:

(1) Inform the person of any personal information in the system of which the person is the subject;

(2) Except as provided in divisions (C) and (E)(2) of section 1347.08 of the Revised Code, permit the person, the person's legal guardian, or an attorney who presents a signed, written authorization made by the person, to inspect all personal information in the system of which such person is the subject;

(3) Inform the person about the types of uses made of the personal information, including the identity of any user typically granted access to the system;

(4) Allow a person who wishes to exercise a right provided by this chapter to be accompanied by another individual of such person's choice;

(D) The division shall investigate disputes as to the accuracy, relevance, timeliness, or completeness of personal information in accordance with section 1347.09 of the Revised Code.

(1) Any person who is the subject of personal information in a system who disputes the accuracy, relevance, timeliness, or completeness of the personal information may request that the division investigate the current status of the information.

(2) Within ninety days after receiving the request from the disputant, the division shall:

(a) Make a reasonable investigation to determine whether the disputed information is accurate, relevant, timely, and complete;

(b) Notify the disputant of the results of the investigation;

(c) Advise the disputant of any action the board plans to take with respect to the disputed information.

(3) The division shall delete any information that it cannot verify or that it finds to be inaccurate.

(4) If, after the division's determination in accordance with this rule, the disputant is not satisfied, the division shall do either of the following:

(a) Permit the disputant to include within the system, a brief statement of the disputant's position on the disputed information;

(b) Permit the disputant to include within the system, a notation that the disputant protests that the information is inaccurate, irrelevant, outdated, or incomplete.

(5) The division may limit the statement of a disputant to not more than one hundred words if it assists the disputant to write a clear summary of the dispute.

(6) The division shall retain a copy of the disputant's statement of dispute.

(E) The division shall include a statement or notation made by a disputant in accordance with paragraph (D)(4) of this rule in any subsequent transfer, report, or dissemination of the disputed information and may include with the disputant's statement or notation, a statement by the division that it has reasonable grounds to believe that the dispute is frivolous or irrelevant, and the reasons for that belief.

(F) For purposes of paragraph (E) of this rule, the presence of contradictory information in a disputant's file does not alone constitute reasonable grounds to believe that the dispute is frivolous or irrelevant.

(G) Following any deletion of information that is found to be inaccurate or the accuracy of which can no longer be verified, or if a statement of dispute was filed by a disputant in accordance with paragraph (D)(4) of this rule, the division shall, at the written request of the disputant, furnish notification that the information has been deleted, or furnish a copy of the disputant's statement of the dispute, to any person specifically designated by the disputant. The division shall inform a disputant that the disputant has the right to make such a request.

Effective: 02/01/2009
R.C. 119.032 review dates: 11/13/2008 and 01/22/2014
Promulgated Under: 119.03
Statutory Authority: 4765.11
Rule Amplifies: 1347.05
Prior Effective Dates: 10/1/95, 4/28/02