a. No later than July 31, 2018, and every two years thereafter by July 31, each city agency shall provide a report regarding the collection, retention, and disclosure of identifying information by such agency and any contractors or subcontractors utilized by such agency. Each such report shall include:
1. information concerning identifying information collected, retained, and disclosed, including:
(a) the types of identifying information collected, retained, and disclosed, including, but not limited to, where practicable, those types enumerated in the definition of identifying information;
(b) the types of collections and disclosures classified as routine and any collections or disclosures approved by the chief privacy officer;
(c) current policies regarding collection, retention, and disclosure, including:
(1) policies regarding requests for disclosures from other city agencies, local public authorities or local public benefit corporations, and third parties;
(2) policies regarding proposals for disclosures to other city agencies, local public authorities or local public benefit corporations, and third parties;
(3) policies regarding the classification of disclosures as necessitated by the existence of exigent circumstances or as routine; and
(4) which divisions and categories of employees within an agency make disclosures of identifying information following the approval of the privacy officer;
(d) use of agreements regarding the anticipated use and any potential future use of identifying information disclosed;
(e) types of entities requesting the disclosure of identifying information or proposals for disclosures of identifying information, the reasons why an agency discloses identifying information in response to requests or proposes the disclosure of identifying information, and why any such disclosures furthers the purpose or mission of such agency; and
(f) the reasons why any collection and retention of identifying information furthers the purposes or mission of such agency;
2. the impact of any privacy policies and protocols issued by the chief privacy officer, any guidance issued by the privacy officer of such agency or the committee, the provisions of this chapter, and other applicable law on the agency's collection, retention, and disclosure of identifying information;
3. consideration and implementation, where applicable, of alternative policies that minimize the collection, retention, and disclosure of identifying information to the greatest extent possible while furthering the purpose or mission of such agency; and
4. policies on access to identifying information by employees, contractors, and subcontractors, including consideration of the necessity of access to such information for the performance of their duties and implementation of policies that minimize such access to the greatest extent possible while furthering the purpose or mission of an agency.
b. Each city agency shall submit the report prepared pursuant to subdivision a of this section to the mayor, the speaker of the council, the chief privacy officer, and the committee.
c. No information that is otherwise required to be reported or disclosed pursuant to this section shall be reported or disclosed in a manner that would violate any applicable provision of federal, state, or local law relating to the privacy of information or that would interfere with a law enforcement investigation or other investigative activity by an agency or would compromise public safety.
(L.L. 2017/245, 12/17/2017, eff. 6/15/2018)
Editor's note: For related unconsolidated provisions, see Appendix A at L.L. 2017/245.