§ 23-1202 Collection, retention and disclosure of identifying information.
AC § 23-1202
a. Employees, contractors, and subcontractors shall collect, retain, and disclose identifying information only in accordance with this chapter. b. Collection.
1.Absent exigent circumstances, no employee shall collect identifying information without the written approval of the privacy officer of such employee's agency. In addition, such collection shall not be allowed unless it: (a) furthers the purpose or mission of such city agency; or (b) is required by law or treaty.
2.Notwithstanding the provisions of paragraph 1 of this subdivision: (a) the privacy officer of an employee's agency may approve in advance certain routine collections of identifying information; (b) the chief privacy officer may approve in advance a collection of identifying information not otherwise authorized by paragraph 1 of this subdivision upon the determination that such collection is in the best interests of the city; and (c) the provisions of paragraph 1 of this subdivision do not apply: (1) to any collection of identifying information by or to the police department in connection with an investigation of a crime that has been committed or credible information about an attempted or impending crime, or (2) where the collection is in connection with an open investigation by a city agency concerning the welfare of a minor or an individual who is otherwise not legally competent. Any such collections shall not require any additional approval by the privacy officer or chief privacy officer. c. Disclosure.
3.Any request for identifying information or a proposal for the unsolicited disclosure of identifying information by an employee that does not concern a routine disclosure shall be sent to the privacy officer of such employee's agency as soon as practicable.
4.If an individual's identifying information is disclosed in violation of this chapter, the privacy officer of such employee's agency that becomes aware of such disclosure shall notify the chief privacy officer as soon as practicable and, if such disclosure is one described in policies and protocols issued pursuant to subdivision 6 of section 23-1203, the agency responsible for the disclosure shall make reasonable efforts to notify such individual in writing of the identifying information disclosed and to whom it was disclosed as soon as practicable; provided, however, that this paragraph shall not require any notification that would violate the provisions of subdivision e of section 23-1204. The chief privacy officer shall submit a quarterly report containing an anonymized compilation or summary of such disclosures to the speaker of the council and shall make such report available online. Such report may be combined with the report required by subdivision d of this section. d. Exigent circumstances.
