UGRC data privacy and records management

nathankota commented 9 months ago

Benefit

Compliance with state laws related to data privacy policies and practices.

Acceptance Criteria

[x] Assign/define a UGRC Administrative Records Officer (ARO) to work with DTS Chief Administrative Officer (CAO - Stephanie Weteling) to ensure the care, maintenance, scheduling, disposal, classification, designation, access and preservation of records, per Utah Code 63A-12-103(2).
[ ] Review and update the current record series and retention schedules for UGRC data.
[ ] Compose legal notification(s) and include in UGRC websites/pages that collect personal information, explaining the intended use and consequences of the data and the record series in which the data are included.
- Question: Do we also need a general notification for all SGID, etc. data?
[ ] Engage agencies whose apps we support that collect personal information to compose notifications
- [x] UIC
- [x] ~Enviro~ (new app won't collect personal info)
- [ ] Roadkill

Notes

Recording and transcript of meeting with Christopher Bramwell, October 16, 2023

Risks

No response

Issue Reference

refs #

steveoh commented 9 months ago

@gregbunce silently became our certified records officer. I'm going to check that off.

gregbunce commented 9 months ago

happy to assit

nathankota commented 9 months ago

Sprint 2

[ ] Attempt a notification statement for a site where we collect data, using UIC as a reference.

steveoh commented 1 month ago

Where are we at with this currently?

nathankota commented 1 month ago

Where are we at with this currently?

I haven't heard that we need to do anything since Greg was silently assigned as the ARO. @brigsz or @gregbunce have either of you heard anything about this?

gregbunce commented 1 month ago

I haven't heard anything.

steveoh commented 1 month ago

I think this is a proactive task as opposed to someone telling us to do something if I remember correctly.

brigsz commented 1 month ago

After the finance meeting today at 12:30 I will look closer

brigsz commented 1 month ago

Okay, yes, proactive, however has Chris Bramwell put out an example of what sites should say etc? I would expect some type of template to come from his office. FWIW I have not listened to the recording or read the transcript of the Chris Bramwell meeting from last year. I would assume that all of DTS or the state for that matter would have the same pattern etc

steveoh commented 1 month ago

Is that what this bullet item intends to find out?

Work with CAO to create new and/or apply existing record series and retention schedules to UGRC records.

nathankota commented 1 month ago

@brigsz can the second bullet be checked off, based on your response to the emails with Kate S. and her questions about prepping to send data to Archives, which made it sound like we have record series and retention schedules defined for "UGRC data"?

brigsz commented 1 month ago

UGRCRecordSeries.pdf

For me, the second bullet does not make sense, I am not sure what is intended. However I have attached our current record series list that may help clarify things

nathankota commented 1 month ago

UGRCRecordSeries.pdf

For me, the second bullet does not make sense, I am not sure what is intended. However I have attached our current record series list that may help clarify things

I also don't fully understand the intent, but the pdf you provided seems to be related.

brigsz commented 1 month ago

Okay, then I feel the issue should read "Review and update the current record series and retention schedules for UGRC data"

On a side note, much of this came out of an effort called GEOMAPP with the Library of Congress, North Carolina, Kentucky, and Utah. Geospatial Multi-state Archive And Preservation Project (GEOMAPP) This is around 2008 or so. The UGRC staff person just went super crazy on this and I believe a significant portion is overkill. We should document the data we curate and use the appropriate schedules and classifications. Other agencies should do the same for their data. Where possible I think data should be thought of under the state geographic region as opposed to counties, so you have state wide parcels, state wide roads, state wide address points as opposed to calling out a record series for each county.

Overall, yes, this is proactive and hopefully one day DTS and Archives will have a true plan.

There is a formal way to submit UGRC data for archives, and I think Greg knows it. There is a form you fill out and put the data out on a Google drive share where Archives can access it.

gregbunce commented 1 month ago

Thanks for backstory, Matt. That's helpful for me. On a side note, I also backup the SGID vector data every 6 months on the Google Drive.

steveoh commented 1 month ago

My memory was that we were going to shrink this PDF list to something more generic and manageable. A lot of those series listed don't really make sense to continue with e.g. Chukar records. I thought the intent of that bullet was to shrink it down to one item that would include all SGID data and the retention yada yada would reflect our current policies with porter.

agrc / planning-queue