Rule 123-2-04 | Notice of personal information systems.
(A) Notices of personal information systems shall be filed with the Ohio privacy office prior to the first day of December of each year.
(B) If a new personal information system is established or an existing personal information system is enlarged, notice shall be filed with the Ohio privacy office within thirty days.
(1) Supplemental notice shall be filed when an existing, previously reported system is enlarged.
(2) Notice of a new system shall be filed when a new, previously unreported system is established.
(C) A supplemental or amended notice may be filed at any time after the original notice has been filed.
(D) All notices of personal information systems shall be submitted on form ADM-6109, except annual notice submitted pursuant to paragraph (A) of this rule may be validated by submitting form ADM-6110 if no change has occurred since the preceding filing period.
(E) Each notice of personal information system shall be prepared by the supervisor of the functional unit which maintains the record. In instances when duplicate records exist, the functional unit having primary responsibility shall complete the notice, including the identification of the location of duplicate records.
(F) The supervisor of the functional unit which maintains the system shall be designated the responsible individual as required by division (A) of section 1347.05 of the Revised Code.
(G) The responsible individual shall also prepare a listing of any users usually granted access to the system.
(H) The responsible individual shall retain a copy of the notice of personal information system and the listing of users and submit the originals and one copy of the notice to the privacy officer.
(I) The privacy officer shall review all notices for accuracy and determine if duplicate systems have been filed.
(J) The security-privacy coordinator shall retain copies of all notices and listings of users and file the original notices with the Ohio Privacy Office.
Five Year Review Date: