Maintenance of personal data

(a) The Commission shall strive to collect and maintain all personal data with accuracy and completeness. Any personal data not relevant and necessary to accomplish the lawful purpose of the Commission shall be disposed of in accordance with the Commission's record retention schedule, or upon permission from the public records administrator to dispose of said records under Section 11-8a of the General Statutes. (b) All employees who function as custodians for the Commission's personal data system, or are involved in its operation, shall be given a copy of the provisions of the Personal Data Act, these regulations, and a copy of the Freedom of Information Act. (c) All such Commission employees shall take reasonable precautions to protect personal data under their control or custody from the danger of fire, theft, flood, natural disaster and other physical threats. (d) The Commission shall incorporate by reference the provisions of the Personal Data Act and these regulations in all contracts, agreements or licenses for the operation of a personal data system or for research, evaluation and reporting of personal data for the Commission or on its behalf. (e) Access to the Commission's personal data system is available to Commission employees who require such information in the performance of their official and lawful duties and to such other persons who are entitled to access under law. The Commission shall keep an up-to-date roster of Commission employees entitled to access to the Commission's personal data system. (f) The Commission will ensure against unnecessary duplication of personal data records. In the event that it is necessary to send personal data records through interdepartmental mail, such records will be sent in envelopes or boxes sealed and marked "confidential," where such records are required by law to be kept confidential. (g) The Commission shall ensure that all records in its manual personal data system are kept under lock and key, and, to the greatest extent practical, are kept in controlled access areas. (h) The Commission shall, to the greatest extent practical, locate automated equipment and records in a limited access area. (i) Where required by law, to the greatest extent practical, the Commission shall require visitors to such area to sign a visitor's log and permit access to said area on a bona-fide need-to-enter basis only. (j) The Commission, to the greatest extent practical, will ensure that regular access to automated equipment is limited to operations personnel and other authorized persons. (k) The Commission shall use appropriate access control mechanisms to prevent disclosure to unauthorized individuals of personal data required to be kept confidential by law.