The policies and protocols promulgated by the chief privacy officer pursuant to subdivision h of section 8 of the charter shall, at a minimum:
1. require that identifying information is anonymized where appropriate in accordance with the purpose or mission of a city agency;
2. require the privacy officer of each city agency to issue guidance to city agency employees, contractors and subcontractors regarding such agency's collection, retention, and disclosure of identifying information;
3. require any city agency disclosing identifying information to a third party when such a disclosure is not classified as routine pursuant to section 23-1202 to enter into an agreement ensuring that the anticipated use and any potential future use of such information by such third party occurs only in a manner consistent with this chapter unless: (i) such disclosure is made under exigent circumstances, or (ii) such an agreement would not further the purposes of this chapter due to the absence of circumstances in which such disclosure would unduly compromise an important privacy interest.
4. describe disclosures of identifying information to third parties when such a disclosure is classified as routine pursuant to section 23-1202 for which, because of the nature or extent of such disclosures or because of the nature of the relationship between the city agency and third party, such disclosing agency is required to enter into an agreement with such third party requiring that the anticipated use and any potential future use of such information by such third party occurs only in a manner consistent with this chapter;
5. describe disclosures of identifying information that are not to be treated as routine pursuant to section 23-1202, as determined by the nature and extent of such disclosures, and require an additional level of review and approval by the privacy officer of such agency or the contractor or subcontractor before such disclosures are made;
6. describe circumstances when disclosure of an individual's identifying information to third parties in violation of this chapter would, in light of the nature, extent, and foreseeable adverse consequences of such disclosure, require the disclosing city agency, contractor, or subcontractor to make reasonable efforts to notify the affected individual as soon as practicable;
7. establish standard contract provisions, or required elements of such provisions, related to the protection of identifying information;
8. require the privacy officer of each city agency to arrange for dissemination of information to agency employees, contractors, and subcontractors and develop a plan for compliance with this chapter and any policies and protocols developed under this chapter; and
9. establish a mechanism for accepting and investigating complaints for violations of this chapter.
(L.L. 2017/245, 12/17/2017, eff. 6/15/2018)
Editor's note: For related unconsolidated provisions, see Appendix A at L.L. 2017/245.