Ohio Administrative Code › Title 113 - Treasurer of State › Chapter 113-25 - Confidential Personal Information Systems › Section 113-25-01 - Confidential personal information systems

Current through all regulations passed and filed through July 1, 2024
The treasurer of state herein
				establishes a rule for the protection of confidential personal information. The
				treasurer of state systems maintained in the regular course of business that
				contain personal information that is confidential in nature will be accessed in
				accordance with this rule established pursuant to division (B) of section
				1347.15 of the Revised
				Code.
(A)
								 Definitions.
(1)
									 "Access" as a
			 noun means an instance of copying, viewing, or otherwise perceiving whereas
			 "access" as a verb means to copy, view, or otherwise perceive.
(2)
									 "Acquisition of
			 a new computer system" means the purchase of a "computer system," as defined in
			 this rule, that is not a computer system currently in place nor one for which
			 the acquisition process has been initiated as of the effective date of the
			 treasurer of state rule addressing requirements in section
			 1347.15 of the Revised
			 Code.
(3)
									 "Computer system" means a "system," as defined by
			 division (F) of section
			 1347.01 of the Revised Code that
			 stores, maintains, or retrieves personal information using electronic data
			 processing equipment.
(4)
									 "Confidential personal information" (CPI) has the
			 meaning as defined by division (A)(1) of section
			 1347.15 of the Revised Code and
			 identified by rules promulgated by the treasurer of state in accordance with
			 division (B)(3) of section
			 1347.15 of the Revised Code that
			 reference the federal or state statutes or administrative rules that make
			 personal information maintained by the treasurer of state confidential.
(5)
									
			 "Incidental contact" means contact with the information that is secondary or
			 tangential to the primary purpose of the activity that resulted in the
			 contact.
(6)
									 "Individual" means a natural person or the natural
			 person's authorized representative, legal counsel, legal custodian, or legal
			 guardian.
(7)
									 "Information owner" means the individual appointed in
			 accordance with division (A) of section
			 1347.05 of the Revised Code to
			 be directly responsible for a system.
(8)
									 "Person" means a
			 natural person.
(9)
									 "Personal information" has the same meaning as defined
			 in division (E) of section
			 1347.01 of the Revised
			 Code.
(10)
									 "Personal information system" means a "system" that
			 "maintains" "personal information" as those terms are defined in division (E)
			 of section 1347.01 of the Revised Code.
			 "System" includes manual and computer systems.
(11)
									 "Research"
			 means a methodical investigation into a subject.
(12)
									 "Routine" means
			 commonplace, regular, habitual, or ordinary.
(13)
									 "Routine
			 information that is maintained for the purpose of internal office
			 administration, the use of which would not adversely affect a person" as that
			 phrase is used in division (F) of section
			 1347.01 of the Revised Code
			 means personal information relating to employees and maintained by the
			 treasurer of state for internal administrative and human resource
			 purposes.
(14)
									 "System" has the same meaning as defined by division
			 (F) of section 1347.01 of the Revised
			 Code.
(15)
									 "Upgrade" means a substantial redesign of an existing
			 computer system for the purpose of providing a substantial amount of new
			 application functionality, or application modifications that would involve
			 substantial administrative or fiscal resources to implement, but would not
			 include maintenance, minor updates and patches, or modifications that entail a
			 limited addition of functionality due to changes in business or legal
			 requirements.