Information Management Practices

A. INTRODUCTION

The Information Practices Act of 1977 (Civil Code Sections 1798, et seq.) provides measures to assure fair treatment of individuals who are the subjects of State agency records. The Act places specific requirements on State agencies in the collection, use, maintenance and dissemination of information relating to individuals. With exceptions, individuals may review, obtain copies, request amendments and corrections, and dispute information pertaining to them in State records. Civil remedies and penalties are provided for violations which adversely affect individuals who are the subjects of State agency records.

The Chief Counsel is the Departmental officer responsible for ensuring that the agency complies with all of the provisions of the Act and this implementing policy.

B. DEFINITIONS (1798.3 Civil Code)

1. The term "personal information" means any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual.
2. The term "disclose" means to disclose, release, transfer, disseminate, or otherwise communicate all or any part of any record orally, in writing, or by electronic or any other means to any person or entity.
3. The term "individual" means a natural person.
4. The term "maintain" includes maintain, acquire, use, or disclose.
5. The term "person" means any natural person, corporation, partnership, firm, or association.
6. The term "record" means any file or grouping of information about an individual that is maintained by an agency by reference to an identifying particular such as the individual's name, photograph, finger or voice print, or a number or symbol assigned to the individual.
7. The term "system of records" means one or more records, which pertain to one or more individuals, which is maintained by any agency, from which information is retrieved by the name of an individual or by some identifying number, symbol or other identifying particular assigned to the individual.

C. GENERAL DEPARTMENTAL REQUIREMENTS (1798.14 through 1798.17 Civil Code)

The Department of Real Estate:

1. Shall maintain in its records only personal information which is relevant and necessary to accomplish the purpose of the Department as set forth in Section 10050 of the Business and Professions Code or as authorized by the California Constitution or statute or mandated by the federal government.
2. Shall collect personal information to the greatest extent practicable directly from the individual who is the subject of the information rather than from another source.
3. Shall maintain the source or sources of the information, unless the source is the data subject or has received a copy of the source document, including, but not limited to, the name of any source who is an individual acting in his or her own private or individual capacity. If the source is an agency, governmental entity or other organization, such as a corporation or association, this requirement can be met by maintaining the name of the agency, governmental entity, or organization, as long as the smallest reasonably identifiable unit of that agency, governmental entity, or organization is named.
   
   The Department shall maintain the source or sources of the information in a readily accessible form so as to be able to provide it to the data subject when they inspect any record pursuant to Section 1798.34. This section shall not apply if the source or sources are exempt from disclosure under the provisions of this chapter.
4. Shall provide, on or with any form used to collect personal information from individuals, the appropriate notices. Refer to Exhibit 0210-1 for a list of forms which contain Privacy Notices. When contact with the individual is of a regularly recurring nature, an initial notice followed by a periodic notice of not more than one-year intervals shall satisfy this requirement. This requirement is also satisfied by notification to individuals of the availability of the notice in annual tax-related pamphlets or booklets provided for them. The notice shall include all of the following:
   
   
   1. The name of the agency and the division within the agency that is requesting the information.
   2. The title, business address, and telephone number of the agency official who is responsible for the system of records and who shall, upon request, inform an individual regarding the location of his or her records and the categories of any persons who use the information in those records.
   3. The authority, whether granted by statute, regulation, or executive order which authorizes the maintenance of the information.
   4. With respect to each item of information, whether submission of such information is mandatory or voluntary.
   5. The consequences, if any, of not providing all or any part of the requested information.
   6. The principal purpose or purposes within the agency for which the information is to be used.
   7. Any known or foreseeable disclosures which may be made of the information pursuant to subdivision (e) or (f) of Section 1798.24.
   8. The individual's right of access to records containing personal information which are maintained by the agency.

This section does not apply to any enforcement document issued by an employee of a law enforcement agency in the performance of his or her duties wherein the violator is provided an exact copy of the document, or to accident reports whereby the parties of interest may obtain a copy of the report pursuant to Section 20012 of the Vehicle Code.

The notice required by this section does not apply to agency requirements for an individual to provide his or her name, identifying number, photograph, address, or similar identifying information, if this information is used only for the purpose of identification and communication with the individual by the agency, except that requirements for an individual's social security number shall conform with the provisions of the Federal Privacy Act of 1974 (Public Law 93 - 579).

D. CONDITIONS OF DISCLOSURE (1798.24 Civil Code)

1. The Department may not disclose any personal information in a manner that would link the information disclosed to the individual to whom it pertains unless the disclosure of the information is:
   
   
   1. To the individual to whom the information pertains.
   2. With the prior written voluntary consent of the individual to whom the record pertains, but only if such consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent.
   3. To the duly appointed guardian or conservator of the individual or a person representing the individual, provided that it can be proven with reasonable certainty through the possession of agency forms, documents or correspondence that such person is the authorized representative of the individual to whom the information pertains.
   4. To those officers, employees, attorneys, agents, or volunteers of the agency which has custody of the information if the disclosure is relevant and necessary in the ordinary course of the performance of their official duties and is related to the purpose for which the information was acquired.
   5. To a person, or to another agency where the transfer is necessary for the transferee agency to perform its constitutional or statutory duties, and the use is compatible with a purpose for which the information was collected and the use or transfer is listed in the notice provided pursuant to Section 1798.9, or accounted for in accordance with Section 1798.25. With respect to information transferred from a law enforcement or regulatory agency, or information transferred to another law enforcement or regulatory agency, a use is compatible if the use of the information requested is needed in an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
   6. To a governmental entity when required by state or federal law.
   7. Pursuant to the California Public Records Act, Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code.
   8. To a person who has provided the agency with advance adequate written assurance that the information will be used solely for statistical research reporting purposes, but only if the information to be disclosed is in a form that will not identify any individual.
   9. Pursuant to a determination by the agency which maintains information that compelling circumstances exist which affect the health or safety of an individual, if upon the disclosure, notification is transmitted to the individual to whom the information pertains at his or her last known address. Disclosure shall not be made if it is in conflict with other state or federal law.
   10. To the State Archives of the State of California as a record which has sufficient historical or other value to warrant its continued preservation by the California state government, or for evaluation by the Director of General Services or his or her designee to determine whether the record has further administrative, legal, or fiscal value.
   11. To any person pursuant to a subpoena, court order, or other compulsory legal process if, before the disclosure, the agency makes reasonable attempts to notify the individual to whom the record pertains, and if the notification is not prohibited by law.
   12. To any person pursuant to a search warrant.
   13. Pursuant to Article 3 (commencing with Section 1800) of Chapter 1 of Division 2 of the Vehicle Code.
   14. For the sole purpose of verifying and paying government health care service claims made pursuant to Division 9 (commencing with Section 10000) of the Welfare and Institutions Code.
   15. To a law enforcement agency or regulatory agency then required for an investigation of unlawful activity or for licensing, certification, or regulatory purposes, unless the disclosure is otherwise prohibited by law.
   16. To another person or governmental organization to the extent necessary to obtain information from the person or governmental organization as necessary for an investigation by the agency of a failure to comply with a specific state law which the agency is responsible for enforcing.
   17. To the Office of Information Practices when the transfer is necessary for that office to investigate a complaint it has received regarding an alleged violation of this chapter or to perform its mediation functions, provided that the Office of Information Practices has received the written voluntary consent of the individual to whom the information pertains for such a transfer.
   18. To an adopted person, and is limited to general background information pertaining to the adopted person's natural parents, provided that the information does not include or reveal the identity of the natural parents.
   19. To a child or a grandchild of an adopted person, and disclosure is limited to medically necessary information pertaining to the adopted person's natural parents. However, the information, or the process for obtaining the information, shall not include or reveal the identity of the natural parents. The State Department of Social Services shall adopt regulations governing the release of information pursuant to this subdivision by July 1, 1985. The regulations shall require licensed adoption agencies to provide the same services provided by the department as established by this subdivision.
   20. To a committee of the Legislature or to a member of the Legislature, or his or her staff, when authorized in writing by the member, where such member has permission to obtain the information from the individual to whom it pertains, or where the member provides reasonable assurance that he or she is acting in behalf of the individual.
   21. To the University of California or a nonprofit educational institution conducting scientific research, provided the request for information includes assurances of the need for personal information, procedures for protecting the confidentiality of the information, and assurances that the personal identity of the subject shall not be further disclosed in individually identifiable form.
   22. To an insurer, if authorized by Chapter 5 (commencing with Section 10900) of Division 4 of the Vehicle Code.
   
   This article shall not be construed to require the disclosure of personal information to the individual to whom the information pertains, when that information may otherwise be withheld as set forth in Section 1798.40.

2. Unless otherwise indicated, requests for disclosure of personal or confidential information from departmental records will be referred to the following persons for a determination that one of the above conditions for disclosure exists:

Records	Person Determining
Licensing or Examination	Real Estate Manager IV Licensing, Education, and Examinations
Enforcement	Real Estate Manager-in-Charge of the District Office Maintaining the Record
Personnel Record	Manager of Personnel Services or Personnel Analysts

Disclosures requested pursuant to a legal process as described in subdivisions (k) and (l) will also be referred to a staff attorney before the information is disclosed to determine the legal sufficiency of the document compelling disclosure.

E. ACCOUNTING OF DISCLOSURES (1798.25 Civil Code)

1. Using RE 732 (Personal/Confidential Information Disclosure - Exhibit 0210-2), the Department shall keep an accurate accounting of the date, nature, and purpose of each disclosure of a record made pursuant to subdivision (i), (k), (l), (o), or (p) of Section D.1. This accounting shall also be required for disclosures made pursuant to subdivisions (e) or (f) of Section D.1., unless notice of the type of disclosure has been provided pursuant to Sections 1798.9 and 1798.10. The accounting shall also include the name, title, and business address of the person or agency to whom the disclosure was made. For the purpose of an accounting of a disclosure made under subdivision (o) of Section D.1., it shall be sufficient for a law enforcement or regulatory agency to record the date of disclosure, the law enforcement or regulatory agency requesting the disclosure, and whether the purpose of the disclosure is for an investigation of unlawful activity under the jurisdiction of the requesting agency or for licensing, certification, or regulatory purposes by that agency.
   
   Routine disclosures of information pertaining to crimes, offenders, and suspected offenders to law enforcement or regulatory agencies of federal, state, and local government shall be deemed to be disclosures pursuant to subdivision (e) of Section D.1., for the purpose of meeting this requirement.

F. ACCESS TO RECORDS (1798.30 Civil Code)

1. Agency Regulations or Guidelines
   
   The Department shall either adopt regulations or publish guidelines specifying procedures to be followed in order to fully implement each of the rights of individuals set forth in this article. See Public Record Access Guidelines (RE 103).
   
   
2. Inquiries Regarding Personal Information (1798.32 Civil Code)
   
   Each individual shall have the right to inquire and be notified as to whether the agency maintains a record about himself or herself. Inquiries shall specify the name or title of the system of records as filed under Section 1798.9. Agencies shall allow individuals to review the notices that they have submitted to the Office of Information Practices pursuant to Section 1798.9, and shall take other reasonable steps to assist individuals in making their requests sufficiently specific.
   
   Any such notice sent to an individual which in any way indicates that the agency maintains any such record shall include the title and business address of the agency official responsible for maintaining the records, the procedures to be followed to gain access to the records, and the procedures to be followed for an individual to contest the contents of such records unless the individual has received this notice from the agency during the past year.
   
   In implementing the right conferred by this section, an agency may specify in its rules or regulations reasonable times, places, and requirements for identifying an individual who requests access to a record, and for disclosing the contents of a record.
   
   
3. Fees for Copies (1798.33 Civil Code)
   
   Each agency may establish fees to be charged, if any, to an individual for making copies of a record. Such fees shall exclude the cost of any search for and review of the record, and shall not exceed ten cents ($0.10) per page, unless the agency fee for copying is established by statute.
   
   
4. Individual's Right of Access to Personal Information (1798.34 Civil Code)
   
   
   1. The Department shall permit any individual upon request and proper identification to inspect all the personal information in any record containing personal information and maintained by reference to an identifying particular assigned to the individual within 30 days of the agency's receipt of the request for active records, and within 60 days of the agency's receipt of the request for records that are geographically dispersed or which are inactive and in central storage. Failure to respond within these time limits shall be deemed denial. In addition, the individual shall be permitted to inspect any personal information about himself or herself where it is maintained by reference to an identifying particular other than that of the individual, if the agency knows or should know that the information exists. The individual also shall be permitted to inspect the accounting made pursuant to Article 7 (commencing with Section 1798.25).
      
      
   2. The Department shall permit the individual, and, upon the individual's request, another person of the individual's own choosing to inspect all the personal information in the record and have an exact copy made of all or any portion thereof within 15 days of the inspection. It may require the individual to furnish a written statement authorizing disclosure of the individual's record to another person of the individual's choosing.
      
      
   3. The Department shall present the information in the record in a form reasonably comprehensible to the general public.
      
      
   4. Whenever the Department is unable to access a record by reference to name only, or when access by name only would impose an unreasonable administrative burden, it may require the individual to submit such other identifying information as will facilitate access to the record.
      
      
   5. When an individual is entitled under this chapter to gain access to the information in a record containing personal information, the information or a true copy thereof shall be made available to the individual at a location near the residence of the individual or by mail, whenever reasonable.
      
      

5. Requests for Amendments (1798.35 Civil Code)
   
   The Department shall permit an individual to request in writing an amendment of a record and, shall within 30 days of the date of receipt of such request:
   
   
   1. Make each correction in accordance with the individual's request of any portion of a record which the individual believes is not accurate, relevant, timely, or complete and inform the individual of the corrections made in accordance with their request; or
      
      
   2. Inform the individual of its refusal to amend the record in accordance with such individual's request, the reason for the refusal, the procedures established by the agency for the individual to request a review by the head of the agency or an official specifically designated by the head of the agency of the refusal to amend, and the name, title, and business address of the reviewing official.
      
      

6. Review of Refusal to Amend (1798.36 Civil Code)
   
   The Department shall permit any individual who disagrees with the refusal of the agency to amend a record to request a review of such refusal by the head of the agency or an official specifically designated by the head of such agency, and, not later than 30 days from the date on which the individual requests such review, complete such review and make a final determination unless, for good cause shown, the head of the agency extends such review period by 30 days. If, after such review, the reviewing official refuses to amend the record in accordance with the request, the agency shall permit the individual to file with the agency a statement of reasonable length setting forth the reasons for the individual's disagreement.
   
   

G. EXEMPT INFORMATION (1798.40 Civil Code)

The Department is not required to disclose personal information to the individual to whom the information pertains, if the information meets any of the following criteria:

1. Is compiled for the purpose of identifying individual criminal offenders and alleged offenders and consists only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status.
   
   
2. Is compiled for the purpose of a criminal investigation of suspected criminal activities, including reports of informants and investigators, and associated with an identifiable individual.
   
   
3. Is contained in any record which could identify an individual and which is compiled at any stage of the process of enforcement of the criminal laws, from the arrest or indictment stage through release from supervision and including the process of extradition or the exercise of executive clemency.
   
   
4. Is maintained for the purpose of an investigation of an individual's fitness for licensure or public employment, or of a grievance or complaint, or a suspected civil offense, so long as the information is withheld only so as not to compromise the investigation, or a related investigation. The identities of individuals who provided information for the investigation may be withheld pursuant to Section 1798.38.
   
   
5. Would compromise the objectivity or fairness of a competitive examination for appointment or promotion in public service, or to determine fitness for licensure, or to determine scholastic aptitude.
   
   
6. Pertains to the physical or psychological condition of the individual, if the agency determines that disclosure would be detrimental to the individual. The information shall, upon the individual's written authorization, be disclosed to a licensed medical practitioner or psychologist designated by the individual.
   
   
7. Relates to the settlement of claims for work related illnesses or injuries and is maintained exclusively by the State Compensation Insurance Fund.
   
   
8. Is required by statute to be withheld from the individual to whom it pertains.

This section shall not be construed to deny an individual access to information relating to him or her if access is allowed by another statute or decisional law of this state.

H. CONDUCT OF EMPLOYEES

The employees of the Department of Real Estate are responsible for the collection, maintenance, use and dissemination of information about individuals which relates to their personal life, including their employment and medical history, financial transactions, marital status and dependents. The employees shall comply with the provisions of the Information Practices Act, Civil Code Sections 1798 through 1798.78. The guidelines to the Act issued by the Office of Information Practices shall be used as a basic source of guidance in administering the Act's provisions.

Employees shall not require individuals to disclose personal information which is not necessary and relevant to the lawful State function for which the employee is responsible.

Employees shall make every reasonable effort to see that inquiries and requests by individuals for their personal records are responded to quickly and without requiring the individual to unnecessarily repeat his or her inquiry to others.

Employees shall assist individuals who seek information pertaining to themselves in making their inquiry sufficiently specific and descriptive so as to facilitate locating the records requested.

Employees shall respond to inquiries from individuals, and requests from them to review, obtain copies of, amend, correct or dispute their personal records in a courteous and businesslike manner, and in accordance with Sections 1798.30 through 1798.42 of the Civil Code.

Employees shall not disclose personal information relating to individuals to unauthorized persons or entities. The improper disclosure of personal information may be cause for disciplinary action.

Employees shall not seek out or use personal information relating to others for their own interest or advantage. The intentional violation of this policy may be cause for disciplinary action.

Employees responsible for maintenance of records containing personal information shall take all necessary precautions to assure that proper administrative, technical and physical safeguards are established and followed in order to protect the confidentiality of records containing personal information, and to assure that such records are not disclosed to unauthorized individuals or entities.

I. DISSEMINATION OF THE POLICY

1. The text of this policy shall be maintained on the Department's Web site and be displayed at each District Office's public counter.
   
   
2. Any Request for Proposal (RFP) or Invitation for Bid (IFB) shall include a requirement that the successful vendor/contractor comply with the policy if the vendor/contractor will have access to Department records. A copy of the policy shall be provided to all potential contractors in the RFP or IFB package.