Personal data

(a) Definitions. The following definitions shall apply to this section of the Regulations of Connecticut State Agencies: (1) "Other Data" means any information, other than personal data, which because of name, identifying number, mark or description can be readily associated with a particular person. (2) Terms defined in section 4-190 of the Connecticut General Statutes shall apply. (b) General Nature and Purpose of Personal Data Systems. (1) The Office of Policy and Management maintains the following personal data systems: (A) Personnel Records. (i) All personnel records are maintained at the Office of Policy and Management, 450 Capitol Avenue, Hartford, Connecticut. (ii) Personnel records are maintained in both automated and manual form. (iii) Personnel records are maintained for the purposes of providing a history of payroll, promotion, discipline and related personnel information concerning Office of Policy and Management employees. (iv) Personnel records are the responsibility of the Principal Human Resources Specialist whose business address is the Office of Policy and Management, 450 Capitol Avenue, Hartford, Connecticut. All requests for disclosure or amendment of these records shall be directed to the Principal Human Resources Specialist. (v) Routine sources for information retained in personnel records are generally the employee, previous employers of the employee, references provided by applicants for employment, the employee's supervisor, the Comptroller's Office, Department of Administrative Services, Statewide Human Resources Management, Office of Policy and Management, Office of Labor Relations, and State insurance carriers. (vi) Personal data in personnel records are maintained under the authority of the State Personnel Act, sections 5-193 et seq. of the Connecticut General Statutes. (B) Examination and Certification Applications of Revaluation Company Employees. (i) Examination and certification applications of revaluation company employees are maintained with the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (ii) Examination and certification applications of revaluation company employees are maintained in manual form. (iii) Examination and certification applications of revaluation company employees are maintained for the purpose of determining the qualifications of applicants for certification to perform property valuations for a municipality for assessment purposes. (iv) Examination and certification applications of revaluation company employees are maintained with the Administrator of Data Collections, Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. All requests for disclosure or amendment of these records shall be directed to the Administrator. (v) Routine sources of information retained in examination and certification applications of revaluation company employees include applicants for certification and professional references provided by applicants. (vi) Personal data in examination and certification applications of revaluation company employees are maintained under the authority of sections 12-2b and 12-2c of the Connecticut General Statutes. (C) Applications for Additional Property Tax Exemption for Veterans. (i) Applications for additional property tax exemptions for veterans are maintained with the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (ii) Applications for additional property tax exemptions for veterans are maintained in both automated and manual forms. (iii) Applications for additional property tax exemptions for veterans are maintained for the purposes of reimbursing municipalities for the revenue loss represented by the additional property tax exemptions and auditing and making necessary adjustments to municipal claims for reimbursement. (iv) Applications for additional property tax exemptions for veterans are maintained with the Administrator of Data Collections, Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. All requests for disclosure or amendment of these records shall be directed to the Administrator. (v) Routine sources of information retained in applications for additional property tax exemptions for veterans include applicants for the exemption and municipal assessors. (vi) Personal data in applications for additional property tax exemptions for veterans are maintained under the authority of section 12-81g of the Connecticut General Statutes. (D) Applications for Tax Relief for Elderly Renters and Totally Disabled Renters. (i) Applications for tax relief for elderly renters and totally disabled renters are maintained with the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (ii) Applications for tax relief for elderly renters and totally disabled renters are maintained in automated form. (iii) Applications for tax relief for elderly renters and totally disabled renters are maintained for the purposes of providing a State grant in refund of utility and rent bills of income-eligible elderly renters and totally disabled renters. (iv) Applications for tax relief for elderly renters and totally disabled renters are maintained with the Administrator of Data Collections, Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. All requests for disclosure or amendment of these records shall be directed to the Administrator. (v) Routine sources of information retained in applications for tax relief for elderly renters and totally disabled renters include applicants for the tax relief, municipal assessors and municipal agents for the elderly. (vi) Personal data in applications for tax relief for elderly renters and totally disabled renters are maintained under the authority of sections 12-170d to 12-170g, inclusive, of the Connecticut General Statutes. (E) Applications for Tax Credits for Elderly Homeowners and Totally Disabled Homeowners. (i) Applications for tax credits for elderly homeowners and totally disabled homeowners are maintained with the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (ii) Applications for tax credits for elderly homeowners and totally disabled homeowners are maintained in both automated and manual forms. (iii) Applications for tax credits for elderly homeowners and totally disabled homeowners are maintained for the purposes of reimbursing municipalities for the revenue loss represented by the tax credits provided to eligible elderly homeowners and totally disabled homeowners and auditing and making adjustments to municipal claims for reimbursement. (iv) Applications for tax credits for elderly homeowners and totally disabled homeowners are maintained with the Administrator of Data Collections, Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. All requests for disclosure or amendment of these records shall be directed to the Administrator. (v) Routine sources of information retained in applications for tax credits for elderly homeowners and totally disabled homeowners include the applicant for tax credits, municipal assessors and municipal agents for the elderly. (vi) Personal data in applications for tax credits for elderly homeowners and totally disabled homeowners are maintained under the authority of sections 12-129b to 12-129d, inclusive, and Secs. 12-170aa to 12-170cc, inclusive of the Connecticut General Statutes. (F) Real Property Sales Data. (i) Real property sales data are maintained with the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (ii) Real property sales data are maintained in automated form. (iii) Real property sales data are maintained for the purposes of determining the sales-assessment ratio for each town in order to calculate the equalized net grand list for each such town. (iv) Real property sales data are maintained with the Administrator of Data Collections, Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (v) Routine sources of information retained in real property sales data include town clerks, town assessors and Sales Ratio Assessment personnel in the Office of Policy and Management. (vi) Real property sales data are maintained under the authority of section 10-216b of the Connecticut General Statutes. (G) Connecticut Partnership for Long-Term Care Policyholder Data. (i) Connecticut Partnership for Long-Term Care policyholder data are maintained with the Policy Development and Planning Division, 450 Capitol Avenue, Hartford, Connecticut. (ii) Connecticut Partnership for Long-Term Care policyholder data are maintained in automated form. (iii) Connecticut Partnership for Long-Term Care policyholder data are maintained to manage and evaluate the Connecticut Partnership for Long-Term Care program, document the extent of Medicaid Asset Protection earned under the Connecticut Partnership for Long-Term Care program and assist Connecticut Partnership for Long-Term Care policyholders with questions regarding their policies. (iv) Connecticut Partnership for Long-Term Care policyholder data are maintained with the Director of the Connecticut Partnership for Long-Term Care, Policy Development and Planning Division, 450 Capitol Avenue, Hartford, Connecticut. (v) Routine sources of information retained in Connecticut Partnership for Long-Term Care policyholder data include insurance carriers and policyholders. (vi) Connecticut Partnership for Long-Term Care policyholder data are maintained under the authority of section 38a-475 of the Connecticut General Statutes. (c) Categories of Personal Data. (1) Personnel Records. (A) The following categories of personal data are maintained in personnel records: (i) Educational records. (ii) Medical or emotional condition or history. (iii) Employment records. (iv) Licenses and certificates of marriage. (v) Dependent birth certificates. (vi) Other reference records. (B) The following categories of other data may be maintained in personnel records: (i) Addresses. (ii) Telephone numbers. (C) Personnel records are maintained on employees of the Office of Policy and Management and applicants for employment with the Office of Policy and Management. (2) Records of Examination and Certification Applications of Revaluation Company Employees. (A) The following categories of personal data are maintained in the records of examination and certification applications of revaluation company employees: (i) Educational records. (ii) Employment records. (B) The following categories of other data may be maintained in the records of examination and certification applications of revaluation company employees: (i) Addresses. (ii) Telephone number. (C) Records of examination and certification applications are maintained on certified revaluation company employees and applicants for certification. (3) Records of Applications for Additional Property Tax Exemption for Veterans. (A) The following categories of personal data are maintained in the records of applications for additional property tax exemption for veterans: (i) Medical condition. (ii) Finances. (iii) Marital status. (B) The following categories of other data may be maintained in the records of applications for additional property tax exemption for veterans: (i) Addresses. (ii) Telephone numbers. (C) Records of applications for the additional property tax exemptions for veterans are maintained on applicants for such exemption. (4) Records of Applications for Tax Relief for Elderly Renters and Totally Disabled Renters. (A) The following categories of personal data are maintained in the records of applications for tax relief for elderly renters and totally disabled renters: (i) Medical condition. (ii) Finances. (iii) Marital status. (iv) Social Security numbers. (B) The following categories of other data are maintained in the records of applications for tax credits for elderly homeowners and totally disabled renters: (i) Addresses. (ii) Telephone numbers. (C) Records of applications for tax credits for elderly homeowners and totally disabled renters are maintained on applicants for such tax credits. (5) Real Property Sales Data Records. The following categories of other data may be maintained in the records of real property sales: Addresses. (6) Connecticut Partnership for Long-Term Care Policyholder Data Records. (A) The following categories of personal data are maintained in the records of Connecticut Partnership for Long-Term Care policyholders: (i) Names. (ii) Addresses. (iii) Telephone numbers. (iv) Gender. (v) Social Security numbers. (B) The following categories of other data may be maintained in the records of Connecticut Partnership for Long-Term Care policyholders: (i) Policy benefits. (ii) Claims data. (C) Records of Connecticut Partnership for Long-Term Care policyholder data are maintained on Connecticut Partnership for Long-Term Care policyholders. (d) Maintenance of Personal Data- General. (1) Personal data will not be maintained by the Office of Policy and Management unless relevant and necessary to accomplish the lawful purposes of the Office. Where the Office finds irrelevant or unnecessary public records in its possession, the Office shall dispose of the records in accordance with its records retention schedule and with the approval of the Public Records Administrator as per section 11-8a of the Connecticut General Statutes, or, if the records are not disposable under the records retention schedule, request permission from the Public Records Administrator to dispose of the records under section 11-8a of the Connecticut General Statutes. (2) The Office of Policy and Management shall collect and maintain all records with accurateness and completeness. (3) Insofar as it is consistent with the needs and mission of the Office of Policy and Management, the Office, wherever practical, shall collect personal data directly from the persons to whom a record pertains. (4) Employees of the Office of Policy and Management involved in the operations of the Office's personal data systems shall be informed of the provisions of the (A) Personal Data Act, (B) the Office's regulations adopted pursuant to section 4-196 of the Connecticut General Statutes, (C) the Connecticut Freedom of Information Act and (D) any other state or federal statute or regulations concerning maintenance or disclosure of personal data kept by the Office. (5) All employees of the Office of Policy and Management shall take reasonable precautions to protect personal data under their custody from the danger of fire, theft, flood, natural disaster and other physical threats. (6) The Office of Policy and Management shall incorporate by reference the provisions of the Personal Data Act and regulations promulgated thereunder in all contracts, agreements or licenses for the operation of a personal data system or for research, evaluation and reporting of personal data for the Office or on its behalf. (7) The Office of Policy and Management shall have an independent obligation to ensure that personal data requested from any other state agency is properly maintained. (8) Only employees of the Office of Policy and Management who have a specific need to review personal data records for lawful purposes of the Office shall be entitled to access to such records under the Personal Data Act. (9) The Office of Policy and Management shall keep a written up-to-date list of individuals entitled to access to each of the Office's personal data systems. (10) The Office of Policy and Management shall ensure against unnecessary duplication of personal data records. In the event it is necessary to send personal data records through interdepartmental mail, such records shall be sent in envelopes or boxes sealed and marked "confidential." (11) The Office of Policy and Management shall ensure that all records in manual personal data systems are kept under lock and key and, to the greatest extent practicable, are kept in controlled access areas. (e) Maintenance of Personal Data- Automated Systems. (1) To the greatest extent practicable, automated equipment and records shall be located in a limited access area. (2) To the greatest extent practicable, the Office of Policy and Management shall require visitors to such limited access area to sign a visitor's log and permit access to said area on a bona-fide need-to-enter basis only. (3) To the greatest extent practicable, the Office of Policy and Management shall ensure that regular access to automated equipment is limited to operations personnel. (4) The Office of Policy and Management shall utilize appropriate access control mechanisms to prevent disclosure of personal data to unauthorized individuals. (f) Maintenance of Personal Data- Disclosure. (1) Not later than four (4) business days after it receives a written request for personal data, the Office of Policy and Management shall mail or deliver to the requesting individual a written response in plain language, informing him/her as to whether or not the Office maintains personal data on that individual, the category and location of the personal data maintained on that individual and procedures available to review the records. (2) Except where nondisclosure is required or permitted by law, the Office of Policy and Management shall disclose to any person upon written request all personal data concerning that individual which is maintained by the Office. The procedures for disclosure shall be in accordance with the Connecticut Freedom of Information Act. If the personal data is maintained in coded form, the Office shall transcribe the data into a commonly understandable form before disclosure. (3) The Office of Policy and Management is responsible for verifying the identity of any person requesting access to his/her own personal data. (4) The Office of Policy and Management is responsible for ensuring that disclosure made pursuant to the Personal Data Act is conducted so as not to disclose any personal data concerning persons other than the person requesting the information. (5) The Office of Policy and Management may refuse to disclose to a person medical, psychiatric or psychological data on that person if the Office determines that such disclosure would be detrimental to that person. The Office may also refuse to disclose to a person personal data pertaining to that person if such nondisclosure is otherwise permitted or required by law. In either case, the Office shall advise that person of his/her right to seek judicial relief pursuant to the Personal Data Act. (6) If the Office of Policy and Management refuses to disclose medical, psychiatric or psychological data to a person based on its determination that disclosure would be detrimental to that person and nondisclosure is not mandated by law, the Office shall, at the written request of such person, permit a qualified medical doctor to review the personal data contained in the person's records to determine if the personal data should be disclosed. If disclosure is recommended by the medical doctor, the Office shall disclose the personal data to such person; if nondisclosure is recommended by such medical doctor, the Office shall not disclose the personal data and shall inform such person of the judicial relief provided under the Personal Data Act. (7) The Office of Policy and Management shall maintain a complete log of each person, individual, agency or organization who has obtained access to, or to whom disclosure has been made of, personal data under the Personal Data Act, together with the reason for each such disclosure or access. This log shall be maintained by Human Resources and Payroll staff for not less than five (5) years from the date of such disclosure or access or for the life of the personal data record, whichever is longer. (g) Contesting the Content of Personal Data Records. (1) Any person who believes that the Office of Policy and Management is maintaining inaccurate, incomplete or irrelevant personal data concerning him/her may file a written request with the Office for correction of said personal data. (2) Not later than thirty (30) days after it receives such request, the Office of Policy and Management shall give written notice to that person that it will make the requested correction, or if the correction is not to be made as submitted, the Office shall state the reason for its denial of such request and notify the person of his/her right to add his/her own statement to his/her personal data records. (3) Following such denial by the Office of Policy and Management, the person requesting such correction shall be permitted to add a statement to his or her personal data record setting forth what that person believes to be an accurate, complete and relevant version of the personal data in question. Such statements shall become a permanent part of the Office's personal data system and shall be disclosed to any individual, agency or organization to which the disputed personal data is disclosed. (h) Uses To Be Made of the Personal Data. (1) Personnel Records. (A) Employees of the Office of Policy and Management who are assigned personnel and payroll responsibilities may use that personal data contained in the Office's personnel records in processing promotions, reclassifications, transfers to another agency, retirement and other personnel actions. Managers and supervisors may use the personal data when promotion, career counseling, or disciplinary action against such employee is contemplated, and for other employment-related purposes. (B) Personnel records are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Division of Administration, Office of Policy and Management, 450 Capitol Avenue, Hartford, Connecticut. (2) Records of Examination and Certification Applications of Revaluation Company Employees. (A) Records of examination and certification applications of revaluation company employees are used for the purposes of determining the qualifications of applicants for certification to perform property valuations for a municipality for assessment purposes. Users include employees of the Intergovernmental Policy Division and others where permitted or required by law. (B) Records of examination and certification applications of revaluation company employees are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Intergovernmental Policy Division, Office of Policy and Management, 450 Capitol Avenue, Hartford, Connecticut. (3) Records of Applications for Additional Property Tax Exemption for Veterans. (A) Records of applications for additional property tax exemption for veterans are maintained for the purposes of reimbursing municipalities for the revenue loss represented by the additional property tax exemptions and for auditing and making necessary adjustments to municipal claims for such reimbursement. Users include employees of the Intergovernmental Policy Division and others where permitted or required by law. (B) Records of applications for additional property tax exemption for veterans are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (4) Records of Applications for Tax Relief for Elderly Renters and Totally Disabled Renters. (A) Records of applications for tax relief for elderly renters and totally disabled renters are maintained for the purpose of providing a State grant in refund of utility and rent bills of income-eligible elderly renters and totally disabled renters. Users include employees of the Intergovernmental Policy Division and others where permitted or required by law. (B) Records of applications for tax relief for elderly renters and totally disabled renters are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (5) Records of Applications for Tax Credits for Elderly Homeowners and Totally Disabled Homeowners. (A) Records of applications for tax credits for elderly homeowners and totally disabled homeowners are maintained for the purposes of reimbursing municipalities for the revenue loss represented by the tax credits provided to eligible elderly homeowners and totally disabled homeowners and for auditing and making necessary adjustments to municipal claims for such reimbursement. Users include employees of the Intergovernmental Policy Division and others where permitted or required by law. (B) Records of applications for tax credits for elderly homeowners and totally disabled homeowners are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (6) Real Property Sales Data. (A) Records of real property sales data are maintained for the purposes of determining the sales-assessment ratio for each town in order to calculate the equalized net grand list for each such town. Users include employees of the Intergovernmental Policy Division and others where permitted or required by law. (B) Records of real property sales data are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Intergovernmental Policy Division, 450 Capitol Avenue, Hartford, Connecticut. (7) Connecticut Partnership for Long-Term Care Policyholder Data. (A) Connecticut Partnership for Long-Term Care policyholder data are maintained for the purposes of managing and evaluating the Connecticut Partnership for Long-Term Care program, documenting the extent of Medicaid Asset Protection earned under the Connecticut Partnership for Long-Term Care program and assisting Connecticut Partnership for Long-Term Care policyholders with questions regarding their policies. Users include employees of the Policy Development and Planning Division and others where permitted or required by law. (B) Records of Connecticut Partnership for Long-Term Care Policyholder data are retained in accordance with a records retention schedule adopted pursuant to section 11-8a of the Connecticut General Statutes, a copy of which is available from the Policy Development and Planning Division, 450 Capitol Avenue, Hartford, Connecticut. (8) When an individual is asked to supply personal data to the Office of Policy and Management, the Office shall disclose to that individual, upon request, the name of the agency which is requesting the data, the legal authority under which the agency is empowered to collect and maintain the personal data, the individual's rights pertaining to such records under the Personal Data Act and the agency's regulations, the known consequences arising from supplying or refusing to supply the requested personal data, and the proposed use to be made of the requested personal data.