Access to personal data

(a) Employees involved in the operation of the Commission's personal data systems or having access thereto shall be informed of the provisions of the personal data act, regulations promulgated under section 4-196 of the Connecticut General Statutes, the freedom of information act, the AIDS testing and medical information act, chapter 368x of the Connecticut General Statutes and any other state or federal statute or regulation concerning maintenance or disclosure of personal data maintained by the agency. (b) Only Commission employees who have a specific need to review personal data for lawful purposes of the agency shall have access to such records. The Commission shall keep a current written list of employees entitled to access to each of the agency's personal data systems. (c) The Commission shall incorporate the provisions of the personal data act and regulations promulgated thereunder by reference in all contracts, agreements or licenses for the operation of a personal data system or for research, evaluation and reporting of personal data for the Commission or on its behalf. (d) The Commission shall insure against unnecessary duplication of personal data. In the event that it is necessary to send personal data through interdepartmental mail, such records will be sent in envelopes or boxes sealed and marked "confidential." (e) The Commission shall insure that all records in manual personal data systems are kept under lock and key and, to the greatest extent practical, are kept in controlled access areas.