8320.01 - UNAUTHORIZED ACQUISITION OF STAFF PERSONAL INFORMATION
The District Records Custodian (DRC) will maintain a personnel file, a payroll file, an I-9 file, and a medical file for each employee. The files will be maintained in paper format.
If the DRC becomes aware of the unauthorized acquisition of "Personal Information" the DRC shall make reasonable efforts to notify each affected staff member that their personal information has been accessed. "Personal Information" includes the individual's social security number, driver's license number, State identification number, the number of financial accounts or access codes, the individual's deoxyribonucleic acid profile, or the individual's unique biometric data including fingerprint, voice print, retina or iris image, or any other unique physical representation.
No such notification is required if either (a) the acquisition of data does not create a material risk of identity theft or fraud to the individual; or (b) the personal information was acquired in good faith by a District employee or agent, and was used only for lawful purposes.
The notice shall be issued within a reasonable time, not to exceed forty-five (45) days after the District learns of the acquisition of the personal information. The notice shall indicate that the District knows of the unauthorized acquisition of personal information pertaining to the staff member. The notice shall be by mail or by a method the District has previously employed to communicate with the staff member.
Required Notice for Unauthorized Acquisition of Information
If, as the result of a single incident, the District is required to notify 1,000 or more individuals, the DRC shall without unreasonable delay notify all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the notices sent to the staff members.
Upon written request from a staff member who has received a notice, the District shall identify the personal information that was acquired.
A law enforcement agency may, in order to protect an investigation or homeland security, ask the District not to provide a notice for any period of time and the District's notification process shall begin at the end of that time period.
Revised 2/5/18
© Neola 2020