Section 10-183l-17 - Personal data(a)Definitions.(1) The following definitions shall apply to these regulations: (A) "Category of Personal Data" means the classifications of personal information set forth in the Personal Data Act, Conn. Gen. Stat. Sec. 4-190(9).(B) "Other Data" means any information which because of name, identifying number, mark or description can be readily associated with a particular person.(2) Terms defined in Conn. Gen. Stat. Sec. 4-190 shall apply to these regulations.(b)General Nature and Purpose of Personal Data Systems.(1) The Teachers' Retirement Board maintains the following personal data systems: (A) Personnel Records (i) All personnel records are maintained at the Teachers' Retirement Board, Room 208, State Office Building, Hartford, Connecticut.(ii) Personnel records are maintained in both automated and manual form.(iii) Personnel records are maintained for the purpose of providing a history of payroll, promotion, discipline and related personnel information concerning Teachers' Retirement Board employees.(iv) Personnel records are the responsibility of the Assistant Secretary of the Teachers' Retirement Board, whose business address is Teachers' Retirement Board, Room 202, State Office Building, Hartford, Connecticut. All requests for disclosure or amendment of these records should be directed to the Assistant Secretary.(v) Routine sources for information retained in personnel records are generally the employee, previous employers of the employee, references provided by applicants for employment, the employee's supervisor, the Comptroller's Office, Department of Administrative Services, Division of Personnel and Labor Relations, and State insurance carriers.(vi) Personal data in personnel records are collected, maintained and used under authority of the State Personnel Act, Conn. Gen. Stat. Sec. 5-193 et seq.(B) Retirement System Participant Records (i) Participant records are maintained with the Executive Secretary of the Teachers' Retirement Board, Room 200, State Office Building, Hartford, Connecticut.(ii) Participant records are maintained in both automated and manual form.(iii) Participant records are maintained for the purpose of determining the eligibility for and the amount of benefit payments to be made to participants and beneficiaries.(iv) Participant records are maintained with the Executive Secretary of the Teachers' Retirement Board, Room 200, State Office Building, Hartford, Connecticut. All requests for disclosure or amendment of these records should be directed to the Executive Secretary.(v) Routine sources of information retained in participant records are generally the participant, current and previous employers of the participant, and the State Department of Education.(vi) Personal data in Retirement System Participant Records are collected, maintained and used under authority of Conn. Gen. Stat. Sec. 10-183b through 10-183dd, inclusive.(c)Categories of Personal Data.(1) Personnel Records (A) The following categories of personal data are maintained in personnel records:(ii) Medical or emotional condition or history.(iii) Employment records.(B) The following categories of other data may be maintained in personnel records: (C) Personnel records are maintained on employees of the Teachers' Retirement Board and applicants for employment with the Teachers' Retirement Board.(2) Retirement System Participant Records (A) The following categories of personal data are maintained in retirement system participant records: (ii) Medical or emotional condition or history.(iii) Employment records.(v) Contributions records.(B) The following categories of other data may be maintained in retirement system participant records:(ii) Social security number.(iii) Retirement System membership number.(v) Bank account identification.(vi) Income tax withholding information.(C) Retirement System Participant Records are maintained on current and former Connecticut public school teachers.(d)Maintenance of Personal Data-General.(1) Personal data will not be maintained by the Teachers' Retirement Board unless relevant and necessary to accomplish the lawful purposes of the agency. Where the agency finds irrelevant or unnecessary public records in its possession, the agency shall dispose of the records in accordance with its records retention schedule, and with the approval of the Public Records Administrator pursuant to Conn. Gen. Stat. Sec. 11-8a, or, if the records are not disposable under the records retention schedule, request permission from the Public Records Administrator to dispose of the records under Conn. Gen. Stat. Sec. 11-8a.(2) The Teachers' Retirement Board will collect and maintain all records with accurateness and completeness.(3) Insofar as it is consistent with the needs and mission of the Teachers' Retirement Board, the Board, wherever practical, shall collect personal data directly from the persons to whom a record pertains.(4) Employees of the Teachers' Retirement Board involved in the operations of the agency's personal data systems will be informed of the provisions of the (i) Personal Data Act, (ii) the agency's regulations adopted pursuant to Sec. 4-196, (iii) the Freedom of Information Act and (iv) any other state or federal statute or regulations concerning maintenance or disclosure of personal data kept by the agency.(5) All employees of the Teachers' Retirement Board shall take reasonable precautions to protect personal data under their custody from the danger of fire, theft, flood, natural disaster and other physical threats.(6) The Teachers' Retirement Board shall incorporate by reference the provisions of the Personal Data Act and regulations promulgated thereunder in all contracts, agreements or licenses for the operation of a personal data system or for research, evaluation and reporting of personal data for the agency or on its behalf.(7) The Teachers' Retirement Board shall have an independent obligation to insure that personal data requested from any other state agency is properly maintained.(8) Only employees of the Teachers' Retirement Board who have a specific need to review personal data records for lawful purposes of the agency will be entitled to access to such records under the Personal Data Act.(9) The Teachers' Retirement Board will keep a written up-to-date list of individuals entitled to access to each of the agency's personal data systems.(10) The Teachers' Retirement Board will insure against unnecessary duplication of personal data records. In the event it is necessary to send personal data records through interdepartment mail, such records will be sent in envelopes or boxes sealed and marked "confidential."(11) The Teachers' Retirement Board will insure that all records in manual personal data systems are kept under lock and key and, to the greatest extent practical, are kept in controlled access areas.(e)Maintenance of Personal Data-Automated Systems.(1) To the greatest extent practical, automated equipment and records shall be located in a limited access area.(2) To the greatest extent practical, the Teachers' Retirement Board shall require visitors to such limited access area to sign a visitor's log and permit access to said area on a bona-fide need-to-enter basis only.(3) To the greatest extent practical, the Teachers' Retirement Board will insure that regular access to automated equipment is limited to operations personnel.(4) The Teachers' Retirement Board shall utilize appropriate access control mechanisms to prevent disclosure of personal data to unauthorized individuals.(f)Maintenance of Personal Data-Disclosure.(1) Within four business days of receipt of a written request therefor, the Teachers' Retirement Board shall mail or deliver to the requesting individual a written response in plain language, informing him/her as to whether or not the Board maintains personal data on that individual, the category and location of the personal data maintained on that individual and procedures available to review the records.(2) Except where nondisclosure is required or specifically permitted by law, the Teachers' Retirement Board shall disclose to any person upon written request all personal data concerning that individual which is maintained by the Board. The procedures for disclosure shall be in accordance with Conn. Gen. Stat. Sections 1-15 through 1-21k. If the personal data is maintained in coded form, the Board shall transcribe the data into a commonly understandable form before disclosure.(3) The Teachers' Retirement Board is responsible for verifying the identity of any person requesting access to his/her own personal data.(4) The Teachers' Retirement Board is responsible for ensuring that disclosure made pursuant to the Personal Data Act is conducted so as not to disclose any personal data concerning persons other than the person requesting the information.(5) The Teachers' Retirement Board may refuse to disclose to a person medical, psychiatric or psychological data on that person if the Board determines that such disclosure would be detrimental to that person.(6) In any case where the Board refuses disclosure to a person, it shall advise that person of his/her right to seek judicial relief pursuant to the Personal Data Act.(7) If the Teachers' Retirement Board refuses to disclose medical, psychiatric or psychological data to a person based on its determination that disclosure would be detrimental to that person and nondisclosure is not mandated by law, the Board shall, at the written request of such person, permit a qualified medical doctor to review the personal data contained in the person's record to determine if the personal data should be disclosed. If disclosure is recommended by the person's medical doctor, the Board shall disclose the personal data to such person; if nondisclosure is recommended by such person's medical doctor, the Board shall not disclose the personal data and shall inform such person of the judicial relief provided under the Personal Data Act.(8) The Teachers' Retirement Board shall maintain a complete log of each person, individual, agency or organization who has obtained access to, or to whom disclosure has been made of, personal data under the Personal Data Act, together with the reason for each such disclosure or access. This log shall be maintained for not less than five years from the date of such disclosure or access or for the life of the personal data record, whichever is longer.(g)Contesting the Content of Personal Data Records(1) Any person who believes that the Teachers' Retirement Board is maintaining inaccurate, incomplete or irrelevant personal data concerning him/her may file a written request with the Board for correction of said personal data.(2) Within 30 days of receipt of such request, the Teachers' Retirement Board shall give written notice to that person that it will make the requested correction, or if the correction is not to be made as submitted, the Board shall state the reason for its denial of such request and notify the person of his/her right to add his/her own statement to his/her personal data records.(3) Following such denial by the Teachers' Retirement Board, the person requesting such correction shall be permitted to add a statement to his or her personal data record setting forth what that person believes to be an accurate, complete and relevant version of the personal data in question. Such statements shall become a permanent part of the Board's personal data system and shall be disclosed to any individual, agency or organization to which the disputed personal data is disclosed.(h)Uses to be Made of the Personal Data.(1) Employees of the Teachers' Retirement Board who are assigned personnel and payroll responsibilities use the personal data contained in the Board's personnel records in processing promotions, reclassifications, transfers to another agency, retirement, and other personnel actions. Supervisors use that personal data when promotion, career counseling, or disciplinary action against such employee is contemplated, and for other employment-related purposes.(2) All employees of the Teachers' Retirement Board use retirement system participant records for the purpose of making an accurate determination of the retirement benefit to which such participants may be eligible, or the amount payable to such participant upon application for a refund of his/her retirement contributions.(3) The Teachers' Retirement Board retains personnel records according to schedules published by the Public Records Administrator, Connecticut State Library; it retains retirement system participant data permanently.(4) When an individual is asked to supply personal data to the Teachers' Retirement Board, the Board shall disclose to that individual, upon request, the name of the agency and the division within the agency which is requesting the data, the legal authority under which the agency is empowered to collect and maintain the personal data, the individual's rights pertaining to such records under the Personal Data Act and the agency's regulations, the known consequences arising from supplying or refusing to supply the requested personal data, and the proposed use to be made of the requested personal data.Conn. Agencies Regs. § 10-183l-17