4123-16-05. Collection, maintenance and use of only personal information which is necessary and relevant

The bureau shall collect, maintain and use only personal information which is necessary and relevant to the functions it is required or authorized to perform by statute, ordinance, code or rule and eliminate such information when it is no longer necessary to those functions.

(A) Within three months after any change in the purpose of the personal information system, the privacy officer shall review a random sampling of records to determine if personal information in the system is necessary for and relevant to the performance of lawful functions. Personal information which does not meet these requirements shall no longer be collected.

(B) When an existing personal information system is substantially enlarged or a new personal information system is established, the privacy officer shall examine:

(1) The function for which the personal information system is being enlarged or created to ensure that it is required or authorized by statute, ordinance, code or rule; and

(2) The personal information to be collected and maintained to ensure that it is necessary and relevant to the function to be performed.

(C) Retention periods shall be established to ensure the deletion of personal information which is no longer necessary for or relevant to the performance of lawful functions. The establishment of retention periods shall conform to sections 121.211 and 149.34 of the Revised Code.

Five Year Review (FYR) Dates: 5/2/2018 and 05/01/2022
Promulgated Under: 119.03
Statutory Authority: 4121.12, 4121.121
Rule Amplifies: 1347.05
Prior Effective Dates: 03/15/1982, 10/14/2002

Prior History: (R.C. 119.032 review dates: 05/08/2013 and 07/01/2018
Promulgated Under: 119.03
Statutory Authority: 4121.12, 4121.121
Rule Amplifies: 1347.05
Prior Effective Dates: 3/15/82, 10/14/02)