Santa Clara County Municipal Code Div. A16 Privacy Protections

Footnotes:

--- (1) ---

Editor's note— Sec. 1 of Ord. No. NS-300.964, adopted September 27, 2022, repealed Div. A16, which pertained to Information Practices and Individual Privacy, consisted of §§ A16-1—A16-13, and derived from Ord. No. 300.288, adopted June 12, 1979. Sec. 2 of said ordinance added new provisions to read as herein set out.

The Board of Supervisors finds as follows:

(a) The California Constitution provides that all people have an inalienable right to privacy, which is just as explicitly described in the California Constitution as the right to enjoy and defend life and liberty; the right to acquire, possess, and protect property; and the right to pursue and obtain safety and happiness.

(b) In recognition of the County's responsibility to protect and safeguard individuals' right to privacy, in 2017, the Board of Supervisors established the Privacy Office within the County under the authority of the County Executive.

(c) The privacy of an individual can be directly impacted by the collection, storage, use, and sharing of that individual's personal information by government and other entities.

(d) The widespread digitization of information and services, while essential to the efficient operations of government, enables the quick and easy transfer of information, and increases the potential risk to individual privacy that can occur from any collection, storage, use, or sharing of personal information.

(e) At the same time, the sharing of personal information is a critical tool for the County to fulfill its mission, and to provide robust and efficient evidence-based services and programs to individuals in the County. The sharing of personal information is essential for the County to evaluate the effectiveness and efficiency of County-funded services.

(f) The County strives to balance the County's need to collect and process personal information when providing services to the community with the County's responsibility to safeguard individuals' personal information.

(g) The intent of this Ordinance [division] is to help County departments best balance the competing needs of collecting and processing personal information to fulfill the County's mission and to provide effective services with safeguarding individuals' personal information.

(Ord. No. NS-300.964, § 3, 9-27-22)

The following definitions apply to this Division:

(a) "CMIA" means the California Confidentiality of Medical Information Act, Civil Code sections 56-56.37.

(b) "County contract" means a contract or other legally binding agreement entered into by the County.

(c) "County Contractor" means any person, as defined by Section A1-21 of Division A1 of Title A of the Ordinance Code of the County of Santa Clara, that enters into a County contract.

(d) "County Department" means any County department or agency with a recognized County budget unit, except that County department shall not include the Board of Supervisors or individual Board Offices.

(e) "Genetic data" means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes, but is not limited to, deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

(f) "Health insurance information" means an individual's health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual's application and claims history, including any appeals records.

(g) "HIPAA" means the U.S. Health Insurance Portability and Accountability Act of 1996, 45 CFR Parts 160 and 164.

(h) "Individual" means a natural person.

(i) "Medical information" means any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.

(j) "Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements:

(1) Social Security number.

(2) Driver's license number, California identification card number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual.

(3) Unique identifiers assigned by the County and state and federal governments to an individual when they are fingerprinted by a criminal justice agency, including Person File Number (PFN), Criminal Identification and Information (CII) number, and Federal Bureau of Investigation (FBI) Number.

(4) Bank account number, credit card number, or any other financial information.

(5) Precise geolocation data.

(6) Medical information.

(7) Genetic data.

(8) Health insurance information.

(9) Information identified in Government Code section 6254.4 collected by the Registrar of Voters for voter registration purposes.

(k) Personal information does not include:

(1) County employee records.

(2) All records pertaining to worker's compensation and liability claim investigatory files.

(3) Publicly available information that is lawfully made available from federal, state, or local government records, or information that a County department has a reasonable basis to believe is lawfully made available to the general public by the individual or from widely distributed media.

(Ord. No. NS-300.964, § 3, 9-27-22)

(a) County departments shall only collect, store, use, disclose, and share personal information if doing so advances the mission of the County department or the County's ability to provide services to clients and in compliance with local, state, and federal law. These laws include, but are not limited to, the following:

(1) Election Code sections 2166, 2166.5, 2166.7, 2170, 2194, and 17100(c);

(2) Government Code sections 6253.5, 6253.6, and 6254.4;

(3) Welfare and Institutions Code sections 827 et seq., 10850 et seq., 17006, and 17006.5;

(4) HIPAA;

(5) CMIA;

(6) Revenue and Taxation Code sections 63.1(i), 69.5(n), 408, 408.1, 408.2, 451, 481, and 1609.6; and

(7) Penal Code sections 11100 et seq., 11167.5, and 13100 et seq.

(b) County departments shall retain personal information for only as long as doing so advances the mission of the County department and/or the County's ability to provide services to clients, and in compliance with County record retention policies and local, state, and federal law.

(c) County departments shall frequently evaluate best practices and revise procedures as necessary to further ensure the security, confidentiality, and integrity of personal information by safeguarding all County data and IT resources.

(1) County departments shall follow existing County policies and state and federal law in protecting collected personal information from unauthorized or unlawful access, processing, or disclosure.

(2) In the case of a breach of the security of a County system, as defined by Civil Code section 1798.29(f), County departments shall provide notification to any affected individuals as required by Civil Code section 1798.29 and any relevant existing County policies.

(3) The County Executive or designee shall have the authority to issue and implement any additional information security policies to ensure the security, confidentiality, integrity, and privacy of the County's IT resources, including, but not limited to, the protection of personal information collected or maintained by County departments, and as necessary to meet local, state, and federal statutory and regulatory requirements.

(d) County departments shall ensure that uses of personal information outside the ordinary scope of County operations are subject to an appropriate privacy review to ensure legal compliance.

(e) County departments shall consult as necessary and appropriate with the County Privacy Office, or any successor organization within the County, and the Office of the County Counsel on fulfilling their obligations under this Section.

(Ord. No. NS-300.964, § 3, 9-27-22)

(a) County departments may share personal information with other departments and offices within the County and with external entities when doing so is related to an important County purpose and if permitted by local, state, and federal law.

(b) County departments may only share health information (including "protected health information" as defined by HIPAA, "medical information" as defined by CMIA, and substance use disorder records as defined by 42 C.F.R. Part 2), with other departments, external entities, and contractors in accordance with applicable state and federal laws, Board of Supervisors policies, and County of Santa Clara Health System policies.

(c) County departments may only share protected Criminal Justice Information (CJI), Criminal Offender Record Information (CORI) and summary criminal history information (as defined by federal and California law and policies) with departments and external entities in accordance with applicable federal and California law, the FBI Criminal Justice Information Services (CJIS) Security Policy, and the California Law Enforcement Telecommunications System (CLETS) Policies, Practices, and Procedures.

(d) When appropriate, County departments shall memorialize the information sharing arrangement with a memorandum of understanding or other document that explains:

(1) Restrictions on the recipient's access to and use of the personal information;

(2) Secure transmission and storage of the personal information;

(3) Requirements for the recipient to maintain the confidentiality of the personal information;

(4) A time period for retention or destruction of the personal information, such as upon termination of the agreement; and

(5) The legal authority for sharing the personal information.

(e) Except as required by the order of a court of competent jurisdiction, no County department may provide any information or expend or use time, money, facilities, property, equipment, personnel, or other resources in furtherance of any investigation or proceeding initiated in or by another governmental entity that seeks to impose civil or criminal liability or professional sanction upon a person or entity for:

(1) The provision, securing, receiving of, or any inquiry concerning reproductive health care services that are legal in the State of California; or

(2) Any assistance given to any person or entity that relates to the provision, securing, receiving of, or any inquiry concerning reproductive health care services that are legal in the State of California.

This restriction shall not apply to any investigation or proceeding where the conduct that is subject to potential liability under the investigation or proceeding initiated in or by the other governmental entity would be subject to civil or criminal liability or professional sanction under the laws of the State of California if committed in the State of California. Notwithstanding the general prohibition of this Section and as otherwise permitted by County, state, and federal law, County departments may provide information or assistance in connection with such an investigation or proceeding in response to the written request of a person who is the subject of such an investigation or proceeding.

(f) County departments shall not disclose an individual's personal information for commercial purposes unless such action is specifically authorized by law.

(Ord. No. NS-300.964, § 3, 9-27-22)

(a) No County Contractor shall, without County's written permission, use or disclose nonpublic information provided by the County to the County Contractor for the purpose of County Contractor's performance under the County contract, other than in the performance of County Contractor's obligations under the County contract.

(b) Any violation of this Section shall be an infraction for which the County may seek administrative and civil remedies. A separate violation occurs on each occasion the violation is committed, on each day during which the violation continues to exist, and, if applicable, for each individual whose personal information was used or disclosed in violation of subsection (a).

(c) In addition to the civil remedy authorized by subsection (d) and any contractual remedies available to the County, any person who violates subsection (a) may be subject to any of the administrative remedies set forth in Division A37 of this Code and shall be liable for not more than $2,500 for each violation.

(d) The County Counsel may bring a civil action against any County Contractor who has violated or is violating subsection (a). Any County Contractor determined by a court to have violated subsection (a) shall be subject to injunctive relief, civil penalties in the amounts established by this Section, attorneys' fees and costs, and any other relief ordered by the court.

(Ord. No. NS-300.964, § 3, 9-27-22)

(a) This Division shall be construed and applied so as not to conflict with applicable federal or state laws.

(b) Nothing in this Division shall be construed to prohibit or limit the disclosure of personal information that is required to be disclosed pursuant to federal or state laws.

(c) This Division shall not be deemed to abridge or limit the rights of litigants, including parties to administrative proceedings, to discovery under state or federal law.

(d) Nothing in this Division shall be construed to authorize the disclosure of any record containing personal information in violation of any other law.

(e) Nothing in this Division shall be construed to deny or limit any right of privacy arising under Section 1 of Article I of the California Constitution.

(f) Nothing in this Division shall be construed to modify or nullify the exemptions from disclosure of records under the California Public Records Act, including, but not limited to, Government Code section 6254.

(Ord. No. NS-300.964, § 3, 9-27-22)