441—9.16(22) Personally identifiable information—human rights programs. This rule describes the nature and extent of personally identifiable information which is collected, maintained, and retrieved by the agency by personal identifier in record systems as defined in rule 441—9.1(17A,22). For each record system, this rule describes the legal authority for the collection or maintenance of that information; the means of storage of that information and indicates when applicable; if a data processing system matches, collates, or permits the comparison of personally identifiable information in one record system with personally identifiable information in another record system; and when the record system is confidential, indicates the statutory authority. The record systems maintained within the agency are:
	9.16(1) Personnel records.
	a. 	The agency maintains files containing information about employees, families and dependents, and applicants for staff positions within the agency. These files include, but are not limited to, payroll records, biographical information, medical information relating to disability, performance reviews and evaluations, disciplinary information, information required for tax withholding, information concerning employee benefits, affirmative action reports and other information concerning employees and related issues. Some of this information is confidential under Iowa Code section 22.7(11).
	b. 	The legal authority for maintaining the records for state-funded programs is Iowa Code section 8A.106 and chapter 216A. The legal authority for maintaining the records for federally funded programs is the Omnibus Budget Reconciliation Act, P.L.	97-35; Freedom of Information Act, 5 U.S.C. 552a; Juvenile Justice and Delinquency Prevention Act, P.L.	93-415; Victims Compensation and Assistance Act, P.L.	98-473; and other federal statutes from which federal funds are granted.
	c. 	The information is maintained on paper and some parts are on a data processing system that matches, collates or permits the comparison of some personally identifiable information within the state’s automated data processing system.
	d. 	Certain information contained within this record system is confidential under the authority of Iowa Code section 22.7(11).
	9.16(2) Advocacy records.
	a. 	The agency maintains files containing information pertaining to clients receiving advocacy or referral services to help alleviate or solve a problem. Such information may include, but is not limited to, names and addresses of clients, documents or other material relating to advocacy issues, social or economic conditions or circumstances of particular clients, department evaluations of information about clients, medical or psychiatric data provided to the department concerning a client, and legal data related to the client. These files may be indexed by advocacy files, client files, interpreting files or any direct service involving individual client assistance set forth in this rule or by statute.
	b. 	The authority for maintaining these records is Iowa Code chapter 216A; the Omnibus Budget Reconciliation Act, P.L.	97-35; Juvenile Justice and Delinquency Prevention Act, P.L.	93-415; Victims Compensation and Assistance Act, P.L.	98-473; and other federal statutes from which federal funds are granted.
	c. 	Information is maintained on paper, electronically, and in other available mediums.
	d. 	Information contained within this record system is confidential under the authority of Iowa Code sections 22.7(18) and 216A.6.
	9.16(3) Fiscal records.
	a. 	The agency maintains files containing fiscal information for state-funded programs and federally funded grants or contracts that may contain personally identifiable information.
	b. 	The authority for maintaining these records is Iowa Code chapter 216A and federal statutes from which federal funds are granted.
	c. 	These records are stored on paper and on the state’s automated data processing system that matches, collates or permits the comparison of some personally identifiable information.
	d. 	Certain information contained within this record system is confidential under the authority of Iowa Code section 22.7(11).
	9.16(4) General correspondence, mailing lists, and program or grant data.
	a. 	The agency maintains correspondence files, grant notices and applications, conference or committee listings and reports, board and commission meeting minutes, mailing lists, program and grant information including surveys or specialized reports and activities that contain some personally identifiable information that may include names, addresses or other descriptive data.
	b. 	The authority for maintaining these records is Iowa Code chapter 216A; the Omnibus Budget Reconciliation Act, as amended, P.L.	97-35; Juvenile Justice and Prevention Act, P.L.	93-415; Victims Compensation and Assistance Act, P.L.	98-473; and other federal statutes from which federal funds are granted.
	c. 	The information is maintained on paper and in computer systems.
	d. 	These records are generally open to the public unless otherwise authorized to be confidential by law.
	9.16(5) Criminal and juvenile justice information obtained from other agencies.
	a. 	The agency maintains files containing criminal and juvenile justice information obtained from other agencies to conduct research and evaluations, to provide data and analytical information to federal, state and local governments, and to assist other agencies in the use of criminal and juvenile justice data. These files may contain personally identifiable information.
	b. 	The agency maintains these records pursuant to the authority of Iowa Code sections 216A.136 and 216A.138 and by interagency agreements.
	c. 	The information is maintained on paper, some of which is also in computer files, or in computer files and not on paper, or on a data processing system. Some of these files and systems are capable of matching, collating or permitting the comparison of some personally identifiable information.
	d. 	Certain criminal and juvenile justice information contained within these records and record systems is confidential under state or federal law or rule.
[ARC 6101C, IAB 12/29/21, effective 2/2/22; Editorial change: IAC Supplement 6/14/23]