Section 4747-1-21 - Rules governing personal information systems(A) The board shall appoint one employee to be directly responsible for the custody and security of each personal information system maintained by the board. Said employee shall: (1) Inform all employees who have any responsibility for the operation or maintenance of said system or the use of personal information maintained in the system, of the applicable provisions of Chapter 1347. of the Revised Code and rules adopted thereunder; and, (2) Inform all persons requested to supply personal information for a system whether or not they are legally required to provide such information; and, (3) Restrict the collection, maintenance and use of personal information to only that which is necessary and relevant to functions of the board as required or authorized by statute, ordinance, code or rule; and, (4) Provide all persons, asked to supply personal information that will be placed in an interconnected or combined system, with information relevant to the system, including the identity of all other agencies or organizations that have access to the information in the system; and, (5) Allow a person who is the subject of a record in a personal information system to inspect the record pursuant to section 1347.08 of the Revised Code. Upon the request and verification that the person requesting access to the record is the subject of information contained in the system, the employee shall: (a) Inform the person of any personal information in the system of which the person is the subject; (b) Permit the person, or the person's legal guardian, or an attorney who presents a signed authorization made by the person, to inspect all personal information in the system of which the person is the subject, except where prohibited by law; (c) Inform the person of the uses made of the personal information and identify other users who have access to the system; (d) Allow a person who wishes to exercise the person's rights as provided by this rule to be accompanied by one individual of his choice; (e) Provide, for a reasonable charge, copies of any personal information the person is authorized to inspect. (6) Investigate disputes concerning the accuracy, relevance, timeliness or completeness of personal information pursuant to section 1347.09 of the Revised Code and paragraph (D) of this rule. (B) The board shall reprimand in writing any employee who initiates or otherwise contributes to any disciplinary or other punitive action taken against another individual who brings to the attention of appropriate authorities, the press, or a member of the public, any evidence of unauthorized use of any material contained in the personal information system. A copy of the reprimand shall be entered in the employee's personal file. (C) The board shall monitor its personal information system by: (1) Maintaining the personal information system with the accuracy, relevance, timeliness, and completeness necessary to assure fairness in any determination made by the board which is based on information contained in the system; and, (2) Eliminating unnecessary information from the system. (D) The board shall investigate, upon request, the accuracy, relevance timeliness or completeness of the personal information which is disputed by the subject of a record contained in this system within ninety days after receipt of a request from the disputant; and, (1) Notify the disputant of the results of the investigation and any action the board intends to take with respect to the disputed information; and, (2) Delete any information that the board cannot verify or that the board finds to be inaccurate; and, (3) Permit the disputant, if the disputant is not satisfied with the determination made by the board, to include within the system: (a) A brief statement of the disputant's position on the disputed information; or, (b) A brief statement that the disputant finds the information in the system to be inaccurate, irrelevant, outdated, or incomplete. (4) The board shall maintain a copy of all statements made by a disputant. (E) The board shall not place personal information into an interconnected or combined system, unless said system contributed to the efficiency of other agencies or organizations authorized to use the system in implementing programs which are required or authorized by law. (F) The board shall not use personal information placed into an interconnected or combined system by another state or local agency or an organization, unless the personal information is necessary and relevant to the performance of a lawful function of the board. (G) The board shall make available, upon request, all information concerning charges made by the board for reproduction of materials contained in its personal information system. (H) Nothing in this rule shall be construed as to prevent access of board members to case records and files. Ohio Admin. Code 4747-1-21
Effective: 8/12/2019
Five Year Review (FYR) Dates: 5/23/2019
Promulgated Under: 119.03
Statutory Authority: 4744.28, 4747.04
Rule Amplifies: 1347.06
Prior Effective Dates: 04/15/1984, 06/01/2008