Each agency shall maintain in its records only personal information which is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government.
Information Practices Act ofAgency Requirements
Section § 1798.14
This law states that agencies in California are allowed to keep only the personal information they actually need to fulfill their official duties or comply with legal requirements.
personal information agency records relevant and necessary
Section § 1798.15
This law says that whenever possible, agencies should get personal information directly from the person it relates to, instead of from other sources.
Each agency shall collect personal information to the greatest extent practicable directly from the individual who is the subject of the information rather than from another source.
personal information agencies direct collection
Section § 1798.16
This law says that when a government agency in California collects personal information about you, it must keep a record of where the information came from. If the information came from another person or organization, they have to note the name of that person or organization. If they collect your info electronically, they have to keep a copy of the source unless you ask for it to be thrown away. The agency has to store this information in a way that makes it easy for you to ask and see where your information came from, unless the source is confidential.
(a)CA Civil Law Code § 1798.16(a) Whenever an agency collects personal information, the agency shall maintain the source or sources of the information, unless the source is the data subject or he or she has received a copy of the source document, including, but not limited to, the name of any source who is an individual acting in his or her own private or individual capacity. If the source is an agency, governmental entity or other organization, such as a corporation or association, this requirement can be met by maintaining the name of the agency, governmental
entity, or organization, as long as the smallest reasonably identifiable unit of that agency, governmental entity, or organization is named.
(b)CA Civil Law Code § 1798.16(b) On or after July 1, 2001, unless otherwise authorized by the Department of Information Technology pursuant to Executive Order D-3-99, whenever an agency electronically collects personal information, as defined by Section 11015.5 of the Government Code, the agency shall retain the source or sources or any intermediate form of the information, if either are created or possessed by the agency, unless the source is the data subject that has requested that the information be discarded or the data subject has received a copy of the source document.
(c)CA Civil Law Code § 1798.16(c) The agency shall maintain the source or sources of the information in a readily accessible form so as to be able to provide it to the data subject when they inspect any record pursuant to Section
1798.34. This section shall not apply if the source or sources are exempt from disclosure under the provisions of this chapter.
personal information collection data source retention government agency
Section § 1798.17
This law requires agencies to inform individuals when they're collecting personal information. The notice must include details such as the name of the agency, contact information of the official responsible, legal authority for data collection, whether providing the data is mandatory or optional, and any possible consequences of not providing it. It also needs to state the main purpose of using the information and any potential disclosures. The notice doesn't apply to certain law enforcement documents or basic identification data used for communication, except social security numbers, which must adhere to federal privacy rules.
Each agency shall provide on or with any form used to collect personal information from individuals the notice specified in this section. When contact with the individual is of a regularly recurring nature, an initial notice followed by a periodic notice of not more than one-year intervals shall satisfy this requirement. This requirement is also satisfied by notification to individuals of the availability of the notice in annual tax-related pamphlets or booklets provided for them. The notice shall include all of the following:
(a)CA Civil Law Code § 1798.17(a) The name of the agency and the division within the
agency that is requesting the information.
(b)CA Civil Law Code § 1798.17(b) The title, business address, and telephone number of the agency official who is responsible for the system of records and who shall, upon request, inform an individual regarding the location of his or her records and the categories of any persons who use the information in those records.
(c)CA Civil Law Code § 1798.17(c) The authority, whether granted by statute, regulation, or executive order which authorizes the maintenance of the information.
(d)CA Civil Law Code § 1798.17(d) With respect to each item of information, whether submission of such information is mandatory or voluntary.
(e)CA Civil Law Code § 1798.17(e) The consequences, if any, of not providing all or any part of the requested information.
(f)CA Civil Law Code § 1798.17(f) The principal purpose
or purposes within the agency for which the information is to be used.
(g)CA Civil Law Code § 1798.17(g) Any known or foreseeable disclosures which may be made of the information pursuant to subdivision (e) or (f) of Section 1798.24.
(h)CA Civil Law Code § 1798.17(h) The individual’s right of access to records containing personal information which are maintained by the agency.
This section does not apply to any enforcement document issued by an employee of a law enforcement agency in the performance of his or her duties wherein the violator is provided an exact copy of the document, or to accident reports whereby the parties of interest may obtain a copy of the report pursuant to Section 20012 of the Vehicle Code.
The notice required by this section does not apply to agency requirements for an individual to provide his or her name, identifying number,
photograph, address, or similar identifying information, if this information is used only for the purpose of identification and communication with the individual by the agency, except that requirements for an individual’s social security number shall conform with the provisions of the Federal Privacy Act of 1974 (Public Law 93-579).
personal information notice agency data collection regular notice
Section § 1798.18
This law says that government agencies should keep their records as accurate, relevant, timely, and complete as possible. This is especially important if the records are used to make decisions about people. If an agency sends a record to a group outside the state government, they must fix, update, or remove any part of it that might be wrong or out of date.
Each agency shall maintain all records, to the maximum extent possible, with accuracy, relevance, timeliness, and completeness.
Such standard need not be met except when such records are used to make any determination about the individual. When an agency transfers a record outside of state government, it shall correct, update, withhold, or delete any portion of the record that it knows or has reason to believe is inaccurate or untimely.
agency records accuracy relevance
Section § 1798.19
When a government agency in California hires a contractor to manage or run records containing personal information, they must make sure the contractor follows the same privacy rules that the agency does. This applies to contracts made on or after July 1, 1978. Contractors and their workers are treated as agency employees to ensure accountability. However, local government duties required by the state aren't considered agency functions in this context.
Each agency when it provides by contract for the operation or maintenance of records containing personal information to accomplish an agency function, shall cause, consistent with its authority, the requirements of this chapter to be applied to those records. For purposes of Article 10 (commencing with Section 1798.55), any contractor and any employee of the contractor, if the contract is agreed to on or after July 1, 1978, shall be considered to be an employee of an agency. Local government functions mandated by the state are not deemed agency functions within the meaning of this section.
personal information contractor obligations agency functions
Section § 1798.20
Agencies must create and enforce rules for anyone who handles records with personal information. They need to teach these individuals about these rules, how to follow them, and what could happen if they don’t comply.
Each agency shall establish rules of conduct for persons involved in the design, development, operation, disclosure, or maintenance of records containing personal information and instruct each such person with respect to such rules and the requirements of this chapter, including any other rules and procedures adopted pursuant to this chapter and the remedies and penalties for noncompliance.
personal information records management rules of conduct
Section § 1798.21
This section requires each agency to set up protective measures to keep records safe and private. They need to have rules and technologies in place to protect against risks that could harm the records' security or integrity and prevent injuries.
Each agency shall establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with the provisions of this chapter, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to their security or integrity which could result in any injury.
agency safeguards record security confidentiality
Section § 1798.22
Every agency must appoint an employee to make sure the agency follows all the rules in this chapter.
Each agency shall designate an agency employee to be responsible for ensuring that the agency complies with all of the provisions of this chapter.
agency compliance designate employee compliance responsibility
Section § 1798.23
This law requires the Department of Justice to review all personal information they hold every five years, starting from July 1, 1978, to decide if it should remain inaccessible to the public as outlined in a different rule (Section 1798.40).
The Department of Justice shall review all personal information in its possession every five years commencing July 1, 1978, to determine whether it should continue to be exempt from access pursuant to Section 1798.40.
Department of Justice personal information review process
