Iowa Administrative Code › Agency 129 - Chief Information Officer, Office of The › Title I - General Office Procedures › Chapter 2 - Public Records and Fair Information Practices › Rule 129-2.12 - Availability of Records

Current through Register Vol. 47, No. 3, July 24, 2024
(1)
General.
Office records are open for public inspection and
				copying unless otherwise provided by rule or law.
(2)
Confidential records.
The following records may be withheld from public inspection. Records are
				listed by category, according to the legal basis for withholding them from
				public inspection.
a. The office is a
				depository for the records of other public bodies. Records are maintained on
				paper, audiotape, and microform, and in electronic information storage and
				media systems. Although these records are in the physical possession of the
				office, the responsibility for compliance with Iowa Code chapter 22 remains
				with the "lawful custodian." The public body requesting creation or storage of
				the record by the office is the lawful custodian (see Iowa Code section
				22.1, definition of
				"lawful custodian"). All such records are confidentially maintained while in
				the possession of the office. Requests for access to any such records must be
				directed to the lawful custodian. In the event the office receives a request
				for access to any such records, the office may, in its discretion, direct the
				person making such a request to the lawful custodian of the subject records, or
				forward such request to the lawful custodian of the subject records.
				Additionally, any records maintained by the office concerning the content,
				location, or disposition of such records are confidential in order to maintain
				security for access to confidential records pursuant to Iowa Code section
				22.7.
b. Records which are exempt from disclosure
				under Iowa Code section
				22.7.
c. Sealed bids received prior to the time set
				for public opening of bids. (Iowa Code section
				72.3
				)
d. Procurement proposals prior to
				completion of the evaluation process and the issuance of a notice of intent to
				award a contract by the appropriate procurement authority. (11-subrule
				117.19(3), Iowa Administrative Code)
e. Tax records made available to the office.
				(Iowa Code sections
				422.20
				and
				422.72
				)
f. Minutes or audio recordings of
				closed meetings of a government body. (Iowa Code section
				21.5(4)
				)
g. Identifying details in final
				orders, decisions, and opinions to the extent required to prevent a clearly
				unwarranted invasion of personal privacy or trade secrets under Iowa Code
				section
				17A.3(1)
"e."
h. Those
				portions of office staff manuals, instructions, or other statements issued
				which set forth criteria or guidelines to be used by office staff in auditing,
				in making inspections, in settling commercial disputes or negotiating
				commercial arrangements, or in the selection or handling of cases, such as
				operational tactics or allowable tolerances of criteria for the defense,
				prosecution, or settlement of cases, when disclosure of these statements would:
(1) Enable law violators to avoid
				detection;
(2) Facilitate disregard
				of requirements imposed by law; or
(3) Give a clearly improper advantage to
				persons who are in an adverse position to the office. (Iowa Code sections
				17A.2(11)
				7" and 17A.3(1)"J")
i.
				Records which constitute attorney work products or attorney-client
				communications or which are otherwise privileged pursuant to Iowa Code section
				22.7(4),
				622.10
				or
				622.11, state and
				federal rules of evidence or procedure, the Code of Professional
				Responsibility, and case law.
j.
				Computer resource security files containing names, identifiers, and passwords
				of users of computer resources. Such files must be kept confidential to
				maintain security for access to confidential records pursuant to Iowa Code
				section
				22.7. (Iowa Code
				section
				22.7(50)
				)
k. Data or information collected
				for the purpose of assessing, analyzing, measuring, preparing for, or
				responding to suspected, potential, or actual information security threats.
				(Iowa Code section
				22.7(50)
				)
l. Data or information collected
				for the purpose of assessing, analyzing, or classifying the severity of, nature
				of, ability to remediate, or ability to migrate data. (Iowa Code section
				22.7(50)
				)
m. Detailed security audit
				information. Such information includes but is not limited to security
				assessment reports; information directly related to vulnerability assessments;
				information contained in records relating to security measures such as security
				and response plans, security codes and combinations, passwords, restricted area
				passes, keys, and security or response procedures; emergency response
				protocols; and information contained in records that if disclosed would
				significantly increase the vulnerability of critical physical systems or
				infrastructures of the office. (Iowa Code section
				22.7(50)
				)
n. Information security data,
				information security proposals, or information security assessments compiled,
				prepared, or developed by a governmental body, or compiled, prepared, or
				developed by a nongovernment body and used by a government body pursuant to a
				contractual relationship with the nongovernment body. (Iowa Code section
				22.7(50)
				)
o. Data processing software, as
				defined in Iowa Code section
				22.3A,
				which is developed by a government body, or developed by a nongovernment body
				and used by a government body pursuant to a contractual relationship with the
				nongovernment body. (Iowa Code section
				22.3A(2)
"a")
p. Log-on
				identification passwords, Internet protocol addresses, private keys, or other
				records containing information which might lead to the disclosure of private
				keys used in a digital signature or other similar technologies as provided in
				Iowa Code chapter 554D.
q. Records
				which if disclosed might jeopardize the security of an electronic transaction
				pursuant to Iowa Code chapter 554D.
r. Any other records made confidential by
				law.