CCAgenda_05Apr27 - Laserfiche WebLink

Home Browse Search

36 Section IV: Duties Relating to Right of Subjects • Does a Tennessen warning notice have to be given in writing? The law does not require that the notice be given in writing. For practical and legal purposes, it is best to give the notice in writing (or in another recorded format). Although there is no law that requires an individual to sign an acknowledgment that s/he has received the notice, many entities ask the data subject to sign and date a written notice, in which case a copy of a written notice should be given to the data subject. When information is collected over the phone, the notice should be provided orally. The entity should record such details as whether the notice was given, the date given, and the identity of the person giving the notice. If given orally, the subject also should be given the notice in writing, as described above, as soon as practicable. What authority does the entity have when it has given the notice? Once the proper notice has been given, the entity may lawfully collect, store, use and disseminate the data, as described in the notice. What are the consequences of not giving the notice? Data on individuals cannot legally be collected or stored if a proper Tennessen warning notice was not given. The Commissioner of Administration has issued numerous advisory opinions on this point. See, in particular, Opinions 95-028, 95-035, and 98-001. Does this mean that the data never can be stored if a Tennessen warning notice was not • given? Not necessarily. Private or confidential data collected before August 1, 1975 (the effective date of the Tennessen warning notice requirement), may be stored for the reasons the data were collected. These data also may be stored for reasons of public health, safety or welfare, if the entity obtains the approval of the Commissioner of Administration. Actions when data are used or re/eased by the entity What controls are placed on the use and dissemination of data on individuals? Government entities may use and disseminate private or confidential data on individuals only if necessary to administer or manage a program that is authorized by state law or local ordinance, or mandated by the federal government. An entity may not use or disseminate any private or confidential data on individuals without proper legal authority, either express or implied. This limitation on use and dissemination does not apply to public data on individuals because public data may be used or disseminated to anyone for any purpose. What actions must an entity take before using or releasing private or confidential data on individuals? Each entity must identify its specific legal authority(ies) for using and disseminating private and confidential data on individuals. The entity must use this information to comply with the Tennessen warning notice requirements discussed above. • July, 2000 Model Policy: Access to Government Data & Rights of Subjects Data