SECTIONS 1798.14-1798.23 - California Statutes

CIVIL CODE

SECTION 1798.14-1798.23

1798.14. Each agency shall maintain in its records only personal
information which is relevant and necessary to accomplish a purpose
of the agency required or authorized by the California Constitution
or statute or mandated by the federal government.

1798.15. Each agency shall collect personal information to the
greatest extent practicable directly from the individual who is the
subject of the information rather than from another source.

1798.16. (a) Whenever an agency collects personal information, the
agency shall maintain the source or sources of the information,
unless the source is the data subject or he or she has received a
copy of the source document, including, but not limited to, the name
of any source who is an individual acting in his or her own private
or individual capacity. If the source is an agency, governmental
entity or other organization, such as a corporation or association,
this requirement can be met by maintaining the name of the agency,
governmental entity, or organization, as long as the smallest
reasonably identifiable unit of that agency, governmental entity, or
organization is named.
(b) On or after July 1, 2001, unless otherwise authorized by the
Department of Information Technology pursuant to Executive Order
D-3-99, whenever an agency electronically collects personal
information, as defined by Section 11015.5 of the Government Code,
the agency shall retain the source or sources or any intermediate
form of the information, if either are created or possessed by the
agency, unless the source is the data subject that has requested that
the information be discarded or the data subject has received a copy
of the source document.
(c) The agency shall maintain the source or sources of the
information in a readily accessible form so as to be able to provide
it to the data subject when they inspect any record pursuant to
Section 1798.34. This section shall not apply if the source or
sources are exempt from disclosure under the provisions of this
chapter.

1798.17. Each agency shall provide on or with any form used to
collect personal information from individuals the notice specified in
this section. When contact with the individual is of a regularly
recurring nature, an initial notice followed by a periodic notice of
not more than one-year intervals shall satisfy this requirement. This
requirement is also satisfied by notification to individuals of the
availability of the notice in annual tax-related pamphlets or
booklets provided for them. The notice shall include all of the
following:
(a) The name of the agency and the division within the agency that
is requesting the information.
(b) The title, business address, and telephone number of the
agency official who is responsible for the system of records and who
shall, upon request, inform an individual regarding the location of
his or her records and the categories of any persons who use the
information in those records.
(c) The authority, whether granted by statute, regulation, or
executive order which authorizes the maintenance of the information.
(d) With respect to each item of information, whether submission
of such information is mandatory or voluntary.
(e) The consequences, if any, of not providing all or any part of
the requested information.
(f) The principal purpose or purposes within the agency for which
the information is to be used.
(g) Any known or foreseeable disclosures which may be made of the
information pursuant to subdivision (e) or (f) of Section 1798.24.
(h) The individual's right of access to records containing
personal information which are maintained by the agency.
This section does not apply to any enforcement document issued by
an employee of a law enforcement agency in the performance of his or
her duties wherein the violator is provided an exact copy of the
document, or to accident reports whereby the parties of interest may
obtain a copy of the report pursuant to Section 20012 of the Vehicle
Code.
The notice required by this section does not apply to agency
requirements for an individual to provide his or her name,
identifying number, photograph, address, or similar identifying
information, if this information is used only for the purpose of
identification and communication with the individual by the agency,
except that requirements for an individual's social security number
shall conform with the provisions of the Federal Privacy Act of 1974
(Public Law 93-579).

1798.18. Each agency shall maintain all records, to the maximum
extent possible, with accuracy, relevance, timeliness, and
completeness.
Such standard need not be met except when such records are used to
make any determination about the individual. When an agency
transfers a record outside of state government, it shall correct,
update, withhold, or delete any portion of the record that it knows
or has reason to believe is inaccurate or untimely.

1798.19. Each agency when it provides by contract for the operation
or maintenance of records containing personal information to
accomplish an agency function, shall cause, consistent with its
authority, the requirements of this chapter to be applied to those
records. For purposes of Article 10 (commencing with Section
1798.55), any contractor and any employee of the contractor, if the
contract is agreed to on or after July 1, 1978, shall be considered
to be an employee of an agency. Local government functions mandated
by the state are not deemed agency functions within the meaning of
this section.

1798.20. Each agency shall establish rules of conduct for persons
involved in the design, development, operation, disclosure, or
maintenance of records containing personal information and instruct
each such person with respect to such rules and the requirements of
this chapter, including any other rules and procedures adopted
pursuant to this chapter and the remedies and penalties for
noncompliance.

1798.21. Each agency shall establish appropriate and reasonable
administrative, technical, and physical safeguards to ensure
compliance with the provisions of this chapter, to ensure the
security and confidentiality of records, and to protect against
anticipated threats or hazards to their security or integrity which
could result in any injury.

1798.22. Each agency shall designate an agency employee to be
responsible for ensuring that the agency complies with all of the
provisions of this chapter.

1798.23. The Department of Justice shall review all personal
information in its possession every five years commencing July 1,
1978, to determine whether it should continue to be exempt from
access pursuant to Section 1798.40.