a. Employees, contractors, and subcontractors shall collect, retain, and disclose identifying information only in accordance with this chapter.
b. Collection.
1. Absent exigent circumstances, no employee shall collect identifying information without the written approval of the privacy officer of such employee's agency. In addition, such collection shall not be allowed unless it:
(a) furthers the purpose or mission of such city agency; or
(b) is required by law or treaty.
2. Notwithstanding the provisions of paragraph 1 of this subdivision:
(a) the privacy officer of an employee's agency may approve in advance certain routine collections of identifying information;
(b) the chief privacy officer may approve in advance a collection of identifying information not otherwise authorized by paragraph 1 of this subdivision upon the determination that such collection is in the best interests of the city; and
(c) the provisions of paragraph 1 of this subdivision do not apply:
(1) to any collection of identifying information by or to the police department in connection with an investigation of a crime that has been committed or credible information about an attempted or impending crime, or
(2) where the collection is in connection with an open investigation by a city agency concerning the welfare of a minor or an individual who is otherwise not legally competent.
Any such collections shall not require any additional approval by the privacy officer or chief privacy officer.
c. Disclosure.
1. Absent exigent circumstances, no employee shall disclose identifying information to any party outside such employee's agency, including an employee of another city agency, without the written approval of the privacy officer of such agency. In addition, such disclosure shall not be allowed unless it:
(a) has been authorized in writing by the individual to whom such information pertains or, if such individual is a minor or is otherwise not legally competent, by such individual's parent, legal guardian, or other person with legal authority to consent on behalf of the individual;
(b) furthers the purpose or mission of such city agency; or
(c) is required by law or treaty.
2. Notwithstanding the provisions of this subdivision:
(a) the privacy officer of an employee's agency may approve in advance certain routine disclosures of identifying information;
(b) the chief privacy officer may approve in advance a disclosure to another city agency or agencies not otherwise authorized by paragraph 1 of this subdivision upon the determination that such disclosure is in the best interests of the city; and
(c) the provisions of paragraph 1 of this subdivision do not apply:
(1) to any disclosure of identifying information by or to the police department in connection with an investigation of a crime that has been committed or credible information about an attempted or impending crime, or
(2) where the disclosure is in connection with an open investigation by a city agency concerning the welfare of a minor or an individual who is otherwise not legally competent.
Any such disclosure shall not require any additional approval by the privacy officer or chief privacy officer.
3. Any request for identifying information or a proposal for the unsolicited disclosure of identifying information by an employee that does not concern a routine disclosure shall be sent to the privacy officer of such employee's agency as soon as practicable.
4. If an individual's identifying information is disclosed in violation of this chapter, the privacy officer of such employee's agency that becomes aware of such disclosure shall notify the chief privacy officer as soon as practicable and, if such disclosure is one described in policies and protocols issued pursuant to subdivision 6 of section 23-1203, the agency responsible for the disclosure shall make reasonable efforts to notify such individual in writing of the identifying information disclosed and to whom it was disclosed as soon as practicable; provided, however, that this paragraph shall not require any notification that would violate the provisions of subdivision e of section 23-1204. The chief privacy officer shall submit a quarterly report containing an anonymized compilation or summary of such disclosures to the speaker of the council and shall make such report available online. Such report may be combined with the report required by subdivision d of this section.
d. Exigent circumstances.
1. In the event identifying information is collected or disclosed under exigent circumstances, information about such collection or request and disclosure, along with an explanation of why such exigent circumstances existed, shall be sent to the chief privacy officer as soon as practicable after such collection or disclosure. This subdivision shall not require any such notification where:
(a) the collection or disclosure is by or to the police department in connection with an open investigation of criminal activity;
(b) the collection or disclosure is in connection with an open investigation concerning the welfare of a minor or an individual who is otherwise not legally competent; or
(c) the collection or disclosure is by or to an employee acting in furtherance of law enforcement or public health or safety powers of such employee's agency under exigent circumstances and such collections or disclosures occur during the normal course of such agency's business.
2. The chief privacy officer shall submit a quarterly report containing an anonymized compilation or summary of such disclosures to the speaker of the council and make such report available online.
e. Retention. A city agency shall retain identifying information where required by law. In addition, a city agency may retain identifying information to further the purpose or mission of such city agency, or when retention is in the interest of the city and is not contrary to the purpose or mission of such agency. This subdivision shall not prohibit a city agency from retaining aggregate demographic information that is anonymized.
f. Agency policies and protocols. Each city agency, acting in accordance with the policies and protocols of the chief privacy officer, may issue additional agency-specific guidance in furtherance of this chapter, including the policies and protocols promulgated pursuant to section 23-1203.
g. Contractors and subcontractors. Each city agency shall require contractors that obtain identifying information, whether directly or through subcontractors, to apply the requirements of subdivisions b, c, d, and e of this section and any applicable policies and protocols adopted pursuant to this chapter; provided, however, that the duties of the privacy officer may be exercised by such contractors and subcontractors by designation of the agency.
h. Private right of action. Nothing in this chapter shall be construed to create a private right of action to enforce any provision of such chapter.
i. Construction. Nothing in this chapter shall prohibit city officers and employees from performing their duties in accordance with federal, state, and local law.
(L.L. 2017/247, 12/17/2017, eff. 6/15/2018)
Editor's note: For related unconsolidated provisions, see Appendix A at L.L. 2017/247.