191—2.11(17A,22) Personally identifiable information collected by the division. The division collects and maintains open records, some of which may contain personally identifiable information, and some of which may be shared with other state or federal agencies or organizations or vendors. This rule describes the nature and extent of personally identifiable information that is collected, maintained, and retrieved by the division. Unless otherwise stated, the authority for the collection of the record is provided by Iowa Code chapter 502 or 505. Some personally identifiable information is protected by Iowa Code sections 502.607(2)“e” and 505.8(9).
	2.11(1) Nature and extent. The following records may contain personally identifiable information:
	a. 	Confidential records. Records listed as confidential records are described in rule 191—2.12(17A,22).
	b. 	Rulemaking records. Rulemaking records may contain information about people who make written or oral comments about proposed rules.
	c. 	Contested case records. Contested case records contain names and identifying numbers of people involved. Evidence and documents submitted as a result of a contested case are contained in contested case records.
	d. 	Licensing records. Licensing records of individuals and entities regulated by the division contain names and identifying numbers of the regulated individual or individuals designated as responsible for the regulated entity.
	e. 	Complaint, inquiry, investigation, and examination records. Complaint, inquiry, investigation, and examination records contain names and identifying numbers of the people who submit, are the subject of, or are otherwise involved in the complaint, inquiry, investigation or examination.
	f. 	Personnel files. The division maintains files containing information about employees of the division and applicants for positions with the division.
	2.11(2) Redaction. To the extent that the division finds it necessary to allow inspection of records containing personally identifiable information, the division must, when allowed by law, redact the personally identifiable information prior to allowing the inspection.
	2.11(3) Means of storage. Paper and various electronic means of storage are used to store records containing personally identifiable information.
[ARC 7730C, IAB 3/20/24, effective 4/24/24]