Privacy policy

[steveoh]

Explain how the data the app collects is used.

[nathankota]

Is the privacy policy expected to be available (via a link or something) on all the app pages?

[steveoh]

i don't know

[nathankota]

Engaged client to find out what they may have in place for other apps, how they'd like to handle this, and if there is a record series and retention schedule already in place for UIC data.

[nathankota]

@rsparker-utah: can you check with your web team, and possibly even DEQ executive team and/or AGs to see if there are any recommendations on how to proceed? The standard utah.gov policy is here, but it does not address users being able to delete their accounts (#199), and what happens to the data in that situation; which is something that needs to be considered.

[rsparker-utah]

@nathankota Certainly, I'll look into this and get back to you asap.

[rsparker-utah]

@nathankota I was able to chat with both our DWQ records officer as well as our DEQ Data Management Specialist (who oversees privacy/data management for the department) regarding privacy policy and data retention. Here are the key takeaways from my chats:

• Currently, there is no DEQ specific privacy policy. There is one in the works, but it likely won’t be ready/available for a few years while more guidance comes from gov ops.
• DWQ has a records retention policy (#81505) pertaining to the UIC program. In chatting with our Data Management Specialist, there should be a mechanism to store this data according to the aforementioned retention policy, even if a user deletes their account.

In addition, our data management specialist recommended including a statement within the application explaining the reason we're asking for the UIC Inventory information. Our current paper forms have the following explanation text that we could likely use:

"Owners or operators of all Class V injection wells, existing and new, must submit inventory information according to Section R317-7- 6.4(C) of the Utah Administrative Rules for the Underground Injection Control Program. Required information includes: facility name and location; name and address of legal contact; ownership of facility; nature and type of injection wells; and operating status of injection wells. The Utah UIC Inventory Information Form is designed to assist owners or operators to comply with this requirement, to collect sufficient information regarding the injection activity such that authorization-by-rule status can be assessed, and to coordinate UIC Program regulatory action with other agencies having regulatory authority over the subject facility. Inventory information must be submitted prior to injection for new wells.

This submission does not relieve the applicant of any liability for ground water cleanup or any claim for resource damage if ground water contamination is traced to the injection wells shown on this form. Nor does authorization-by-rule under the UIC Program relieve the applicant, in any way, of obligations to comply with other applicable regulatory requirements, or to obtain other necessary applicable permits or authorizations from local or other agencies. The applicant may contact the local health department for compliance with local requirements."

The above text looks to be the same across all of the existing paper forms. For example, see page 4 of the Storm Water Drainage Inventory Form under the "Class V Inventory Information Forms" section on our UIC forms and Applications Page.

[nathankota]

@rsparker-utah Where should we include this text on the inventory app, or is it somewhere else on a DEQ website that we could link to? The default inventory app page could be an option if it doesn't already exist somewhere else.

[rsparker-utah]

@nathankota After chatting with Mark and Porter, we were thinking the text could go on the main login screen. As an example, I reworded the text slightly to fit with the current app login page:

"Owners or operators of all Class V injection wells, existing and new, must submit inventory information according to Section R317-7- 6.4(C) of the Utah Administrative Rules for the Underground Injection Control Program. As of August 15, 2021 all Class V injection well inventory information forms must be submitted via online web form. This online web form is designed to assist owners or operators to comply with this requirement, to collect sufficient information regarding the injection activity such that authorization-by-rule status can be assessed, and to coordinate UIC Program regulatory action with other agencies having regulatory authority over the subject facility. Inventory information must be submitted prior to injection for new wells.

To submit, you must first create a Utah ID account and provide UIC user profile information. Please visit Utah ID to register with Utah ID and then return to this page to login and complete your profile. If you already have a Utah ID account you may login using the link above. Once you have an account you will be able to:

• Submit Class V UIC inventory information forms
• Check inventory form status
• Update well operating status
• Add new wells to existing facilities
• View previous authorizations

This submission does not relieve the applicant of any liability for ground water cleanup or any claim for resource damage if ground water contamination is traced to the injection wells shown on this form. Nor does authorization-by-rule under the UIC Program relieve the applicant, in any way, of obligations to comply with other applicable regulatory requirements, or to obtain other necessary applicable permits or authorizations from local or other agencies. The applicant may contact the local health department for compliance with local requirements."

I removed the section from the original text stating "Required information includes: facility name and location; name and address of legal contact; ownership of facility; nature and type of injection wells; and operating status of injection wells" with my reasoning being that the app will require/collect this information by default.

Here is a mock of what this could potentially look like for reference:

I am open to other suggestions as well.

[nathankota]

@rsparker-utah This looks good to me. One thing we'll need to change is the date, or just not include it at all?

As of August 15, 2021 all Class V injection well inventory information forms must be submitted via online web form.

[steveoh]

I removed the section from the original text stating "Required information includes: facility name and location; name and address of legal contact; ownership of facility; nature and type of injection wells; and operating status of injection wells" with my reasoning being that the app will require/collect this information by default.

The idea with a privacy policy is to explain why these pieces of data are collected, how they are used, and who they are shared with.

[rsparker-utah]

Thank you both for the comments. I'm fine omitting the date on the homepage. Here is a reworded example based on the comments:

"Owners or operators of all Class V injection wells, existing and new, must submit inventory information according to Section R317-7- 6.4(C) of the Utah Administrative Rules for the Underground Injection Control Program. Required information includes: facility name and location; name and address of legal contact; ownership of facility; nature and type of injection wells; and operating status of injection wells. This online web form is designed to assist owners or operators to comply with this requirement, to collect sufficient information regarding the injection activity such that authorization-by-rule status can be assessed, and to coordinate UIC Program regulatory action with other agencies having regulatory authority over the subject facility. Inventory information must be submitted prior to injection for new wells.

To submit, you must first create a Utah ID account and provide UIC user profile information. Please visit Utah ID to register with Utah ID and then return to this page to login and complete your profile. If you already have a Utah ID account you may login using the link above. Once you have an account you will be able to:

• Submit Class V UIC inventory information forms
• Check inventory form status
• Update well operating status
• Add new wells to existing facilities
• View previous authorizations

This submission does not relieve the applicant of any liability for ground water cleanup or any claim for resource damage if ground water contamination is traced to the injection wells shown on this form. Nor does authorization-by-rule under the UIC Program relieve the applicant, in any way, of obligations to comply with other applicable regulatory requirements, or to obtain other necessary applicable permits or authorizations from local or other agencies. The applicant may contact the local health department for compliance with local requirements."

Updated mock up:

[nathankota]

validated, as provided by client