CHAPTER 24
PUBLIC RECORDS AND FAIR INFORMATION PRACTICES
The auditor of state hereby adopts, with the following exceptions and amendments, rules of the Governor’s Task Force on Uniform Rules of Agency Procedure relative to public records and fair information practices which are printed in Volume I of the Iowa Administrative Code:
81—24.1(22) Definitions. As used in this chapter:
“Agency.” In lieu of the words “(official or body issuing these rules)”, insert “auditor of state”.
81—24.3(22) Requests for access to records.
	24.3(1) Location of record. In lieu of the words “(insert agency head)”, insert “auditor of state”. Also in lieu of the words “(insert agency name and address)”, insert “Auditor of State, State Capitol Building, Des Moines, Iowa 50319”.
	24.3(2) Office hours. In lieu of the words “(insert customary office hours and, if agency does not have customary office hours of at least thirty hours a week, insert hours specified in Iowa Code section 24.4)”, insert “which are 8 a.m.	to 4:30 p.m., Monday through Friday”.
	24.3(7) Fees.
	c. 	Supervisory fee. In lieu of the words “(specify time period)”, insert “one hour”.
81—24.6(22) Procedure by which additions, dissents, or objections may be entered into certain records. In lieu of the words “(designate office)”, insert “auditor of state”.
81—24.9(22) Disclosures without the consent of the subject.
	24.9(1) Open records are routinely disclosed without the consent of the subject.
	24.9(2) To the extent allowed by law, disclosure of confidential records may occur without the consent of the subject. Following are instances where disclosure, if lawful, will generally occur without notice to the subject:
	a. 	For a routine use as defined in 24.10(22) or in the notice for a particular record system.
	b. 	To a recipient who has provided the agency with advance written assurance that the record will be used solely as a statistical research or reporting record; provided that, the record is transferred in a form that does not identify the subject.
	c. 	To another government agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if an authorized representative of such government agency or instrumentality has submitted a written request to the agency specifying the record desired and the law enforcement activity for which the record is sought.
	d. 	To an individual pursuant to a showing of compelling circumstances affecting the health or safety of any individual if a notice of the disclosure is transmitted to the last known address of the subject.
	e. 	To the legislative services agency under Iowa Code section 2A.3.
	f. 	Disclosures in the course of employee disciplinary proceedings.
	g. 	In response to a court order or subpoena.
	24.9(3) Obtaining information from a third party. The agency is required to obtain information to provide appropriate audit service. Requests to third parties for this information may involve the release of confidential identifying information about individuals.
81—24.10(22) Routine use.
	24.10(1) Defined. “Routine use” means the disclosure of a record without the consent of the subject or subjects, for a purpose which is compatible with the purpose for which the record was collected. It includes disclosures required to be made by statute other than the public records law, Iowa Code chapter 22.
	24.10(2) To the extent allowed by law, the following uses are considered routine uses of all agency records:
	a. 	Disclosure to those supervisory personnel and agents of the agency who have a need for the record in the performance of their duties. The custodian of the record may upon request of any supervisory personnel or employee, or on the custodian’s own initiative, determine what constitutes legitimate need to use confidential records.
	b. 	Disclosure of information indicating an apparent violation of the law to appropriate law enforcement authorities for investigation and possible criminal prosecution, civil court action, or regulatory order.
	c. 	Disclosure to the department of inspections and appeals for matters in which it is performing services or functions on behalf of the agency.
	d. 	Transfers of information within the agency, to other state agencies, or to local units of government as appropriate to administer the program for which the information is collected.
	e. 	Information obtained from or released to staff of federal, state and local entities for audit purposes or for purposes of determining whether the agency or other agencies are operating a program lawfully.
	f. 	Any disclosure specifically authorized by the statute under which the record was collected or maintained.
81—24.11(22) Consensual disclosure of confidential records.
	24.11(1) Consent to disclosure by a subject individual. To the extent permitted by law, the subject may consent in writing to agency disclosure of confidential records as provided in 24.7(22).
	24.11(2) Complaints to public officials. A letter from a subject of a confidential record to a public official which seeks the official’s intervention on behalf of the subject in a matter that involves the agency may be, to the extent permitted by law, treated as an authorization to release sufficient information about the subject to the official to resolve the matter.
81—24.12(22) Release to subject.
	24.12(1) The subject of a confidential record may file a written request to review confidential records about that person as provided in 24.6(22). However, the agency need not release the following records to the subject:
	a. 	The identity of a person providing information to the agency need not be disclosed directly or indirectly to the subject of the information when the information is authorized to be held confidential pursuant to Iowa Code section 22.7(18) or other provisions of law.
	b. 	Records need not be disclosed to the subject when they are the work product of an attorney or are otherwise privileged.
	c. 	Peace officers’ investigative reports may be withheld from the subject, except as required by the Iowa Code. (See Iowa Code section 22.7(5))
	d. 	As otherwise authorized by law.
	24.12(2) Where a record has multiple subjects with interest in the confidentiality of the record, the agency may take reasonable steps to protect confidential information relating to another subject.
81—24.13(22) Availability of records.
	24.13(1) General. Agency records are open for public inspection and copying unless otherwise provided by rule or law.
	24.13(2) Confidential records. The following records may be withheld from public inspection. Records are listed by category, according to the legal basis for withholding them from public inspection.
	a. 	Sealed bids received prior to the time set for public opening of bids. (Iowa Code section 72.3)
	b. 	Tax records made available to the agency. (Iowa Code section 422.72)
	c. 	Records which are exempt from disclosure under Iowa Code section 22.7.
	d. 	Identifying details in final orders, decisions and opinions to the extent required to prevent a clearly unwarranted invasion of personal privacy or trade secrets under Iowa Code section 17A.3(1)“d.”
	e. 	Those portions of agency staff manuals, instructions or other statements issued which set forth criteria or guidelines to be used by agency staff in auditing, in making inspections, in settling commercial disputes or negotiating commercial arrangements, or in the selection or handling of cases, such as operational tactics or allowable tolerances or criteria for the defense, prosecution or settlement of cases, when disclosure of these statements would:
	(1)	Enable law violators to avoid detection;
	(2)	Facilitate disregard of requirements imposed by law; or
	(3)	Give a clearly improper advantage to persons who are in an adverse position to the agency. (See Iowa Code sections 17A.2 and 17A.3)
	f. 	Audit working papers and audit reports not yet published or filed. (Iowa Code sections 11.4(6), 11.17 and rule 81—25.9(17A,11))
	g. 	Agency personnel records. (Iowa Code section 22.7(11))
	h. 	Records which constitute attorney work product, attorney-client communications, or which are otherwise privileged. Attorney work product is confidential under Iowa Code sections 22.7(4), 622.10 and 622.11, Iowa R.C.P. 122(c), Fed.	R. Civ.	P. 26(b)(3), and case law. Attorney-client communications are confidential under Iowa Code sections 622.10 and 622.11, the rules of evidence, the Code of Professional Responsibility, and case law.
	i. 	Any other records made confidential by law.
	24.13(3) Authority to release confidential records. The agency may have discretion to disclose some confidential records which are exempt from disclosure under Iowa Code section 22.7 or other law. Any person may request permission to inspect records withheld from inspection under a statute which authorizes limited or discretionary disclosure as provided in 24.4(22). If the agency initially determines that it will release such records, the agency may, where appropriate, notify interested parties and withhold the records from inspection as provided in subrule 24.4(3).
81—24.14(22) Personally identifiable information. This rule describes the nature and extent of personally identifiable information which is collected, maintained, and retrieved by the agency by personal identifier in record systems as defined in 24.2(22). For each record system, this rule describes the legal authority for the collection of that information, the means of storage of that information and indicates whether a data processing system matches, collates, or permits the comparison of personally identifiable information in one record system with personally identifiable information in another record system. The record systems maintained by the agency are:
	24.14(1) Personnel files. Employee personnel files containing information relative to an individual’s employment history, such as hiring and recruitment correspondence, salary and payroll and benefit information, record of personnel actions, military status, affirmative action statistics, education and training completed, professional certification achievements, professional organizational involvement, independence statements, performance evaluation reports, personal information data and so on.
These records contain personally identifiable information, collected under the authority of Iowa Code section 19A.11. The information is maintained on paper and certain parts are also contained on the agency’s data processing system as well as the state’s mainframe automated data processing system. Personal information in employee personnel files is confidential under the authority of Iowa Code section 22.7(11).
	24.14(2) Payroll records. Records showing individual earnings, hours worked, leave usage, class, position, salary range, deductions, net pay with agency summaries, and other related information.
These records contain personally identifiable information, collected under the authority of Iowa Code section 91A.6. The information is maintained on paper with certain records maintained on the state’s payroll automated data processing system. Certain information contained in these records is confidential under the authority of Iowa Code section 22.7(11).
The information cited in subrules 24.14(1) and 24.14(2) above can be compared between record systems to a limited extent.
	24.14(3) Litigation files. These files or records contain information regarding litigation or anticipated litigation, which includes judicial and administrative proceedings. The records include briefs, depositions, docket sheets, documents, correspondence, attorneys’ notes, memoranda, research materials, witness information, investigation materials, information compiled under the direction of the attorney, and case management records. The files contain materials which are confidential as attorney work product and attorney-client communications. Some materials are confidential under other applicable provisions of law or because of a court order. Persons wishing copies of pleadings and other documents filed in litigation should obtain these from the clerk of the appropriate court which maintains the official copy.
81—24.15(22) Other groups of records. This rule describes groups of records maintained by the agency other than record systems as defined in 24.2(22). These records are routinely available to the public. However, the agency’s files of these records may contain confidential information as discussed in 24.13(22). In addition, the records listed in 24.15(1) to 24.15(3) may contain information about individuals; however, these records are not retrieved by the name of the individual. All records are stored both on paper and in automated data processing systems unless otherwise noted.
	24.15(1) Published audit reports. Audit reports and supporting working papers may contain information about individuals working for or doing business with the subject of the audit report. This information is collected pursuant to Iowa Code section 11.4. These reports and working papers are stored both on paper and microfiche records.
	24.15(2) Rule-making records. Rule-making records may contain information about individuals making written or oral comment on proposed rules. This information is collected pursuant to Iowa Code section 17A.4. This information is not stored in an automated data processing system.
	24.15(3) Publications. Project reports, agency newsletters, brochures, etc., may contain information about individuals, including agency staff or members of agency committees. This information is not stored in an automated data processing system.
	24.15(4) Published materials. The agency uses many legal and technical publications in its work. The public may inspect these publications upon request. Some of these materials may be protected by copyright law.
	24.15(5) Agency employees’ handbook. The agency employees’ handbook does not contain information about individuals.
	24.15(6) Other records. All other records that are not exempted from disclosure by law.
81—24.16(22) Data processing systems. All data processing systems used by the agency for record systems described in 24.14(22) may permit the comparison of personally identifiable information in one record system with personally identifiable information in another record system.
81—24.17(22) Applicability. This chapter does not:
	1.	Require the agency to index or retrieve records which contain information about individuals by that person’s name or other personal identifier.
	2.	Make available to the general public records which would otherwise not be available under the public records law, Iowa Code chapter 22.
	3.	Govern the maintenance or disclosure of, notification of or access to, records in the possession of the agency which are governed by the rules of another agency.
These rules are intended to implement Iowa Code section 22.11.
[Filed 4/29/88, Notice 3/23/88—published 5/18/88, effective 6/22/88]