California Information Practices Act (IPA) (California Civil Code 1798)
The California Information Practices Act of 1977 established certain requirements for the collection, maintenance, and dissemination of any information that identifies or describes an individual.
The Act does not apply to student records, i.e., those records pertaining to an individual directly in his or her capacity as a student. But it does apply to records of potential students before enrollment, i.e., records of applicants for admission.
Three Major Concerns in the IPA
What information can an agency legitimately collect on individuals (and how?)
- DISCLOSURE TO THIRD PARTIES WITHOUT CONSENT OF INDIVIDUAL
What information can be disclosed to 3rd parties without the consent of the individual to whom the record pertains?
- ACCESS BY THE INDIVIDUAL
What rights does an individual have to see personal information maintained by an agency that pertains to that individual?
“Personal Information” defines very broadly to include “any information that is maintained by an agency that identifies or describes an individual, including, but not limited to, his or her name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It includes statements made by, or attributed to, the individual.” (California Civil Code Section 1798.3(a))
How the IPA Deals with its Three Basic Concerns:
- “Relevant and necessary”. Each agency shall maintain in its records only personal information which is relevant and necessary to accomplish a purpose of the agency.
- Collect information directly from the individual whenever possible, and maintain a record of the source of information.
- Must provide a privacy notice to individual when collecting information about individual. This is a cumbersome administrative requirement. The notice must include the purpose for collecting the information, whether it is mandatory to provide the information, any disclosures that will be made, etc. Model privacy notices are in RMP-8.
DISCLOSURE TO THIRD PARTIES WITHOUT CONSENT OF INDIVIDUAL
- No disclosure of personal information unless specific statutory basis for disclosure
- Key disclosure categories
- To the individual to whom information pertains
- With the consent of the individual
- To guardian or conservator of the individual
- To those officers, employees, attorneys, agents, or volunteers of the agency, if disclosure is:
- Necessary and relevant in the ordinary course of the performance of official duties, and is related to the purpose for which the information was acquired.
- To person or agency where transfer is necessary for transferee agency to perform constitutional or statutory duties. E.g. EEOC, DFEH.
- To government entities when required by state or federal law
- Pursuant to the Public Records Act. [Note: this is the basis for releasing employee compensation or other information that would otherwise be deemed to be “personal
- information.” Because it does not constitute an “unwarranted invasion of personal privacy,” it is required to be disclosed under the PRA, and therefore permitted to be disclosed under the IPA.]
- Where compelling circumstances exist which affect health or safety of individual (but must simultaneously notify the individual)
- To any person pursuant to a subpoena, court order, or other compulsory process (but must attempt to notify the individual in advance of compliance)
- Pursuant to a search warrant
- To law enforcement or regulatory agency when required for an investigation
- Several others relating to various agencies
ACCESS BY THE INDIVIDUAL
- Every individual has broad access rights to records containing personal information about themselves, with very limited exceptions. Includes, but is not limited to, University employees.
- Inspection within 30 days of request (60 days if archived). Copies within 15 days of inspection. Can charge $0.10/page for duplication if copies are requested.
- Right to amend record if inaccurate, or insert statement in the record if amendment denied.
- There are only very limited categories where the University can deny inspection by individual:
- Criminal investigations exemptions
- Records maintained for purpose of an investigation of individual’s fitness for licensure or public employment, or of a grievance or complaint. But only to not compromise investigation or a related investigation. Once investigation is over, then must disclose.
- Pertains to physical or psychological condition of the individual if disclosure would be harmful to the individual. [But must disclose to individual’s health care professional.]
- Attorney-client privileged material
- Academic Peer Review (identity of confidential reviewers)
- Personal information (about others) intertwined in the record should be redacted
- Identities of Confidential sources of information (people promised confidentiality when writing letters of reference, etc.) can be protected
Content on this page derived from:
The ABC's of Privacy and Public Record by Maria Shanle