§ 4-1-6-7 — State agencies maintaining one or more systems; requirements

(a) Any state agency maintaining one (1) or more
personal information systems shall file an annual report on the
existence and character of each system added or eliminated since the
last report with the governor on or before December 31.
(b) The agency shall include in such report at least the following
information:
(1) The name or descriptive title of the personal information
system and its location.
(2) The nature and purpose of the system and the statutory or
administrative authority for its establishment.
(3) The categories of individuals on whom personal information
is maintained including the approximate number of all individuals
on whom information is maintained and the categories of personal
information generally maintained in the system including
identification of those which are stored in computer accessible
records and those which are maintained manually.
(4) All confidentiality requirements, specifically:
(A) those personal information systems or parts thereof which
are maintained on a confidential basis pursuant to a statute,
contractual obligation, or rule; and
(B) those personal information systems maintained on an
unrestricted basis.
(5) In the case of subdivision (4)(A) of this subsection, the agency
shall include detailed justification of the need for statutory or
regulatory authority to maintain such personal information
systems or parts thereof on a confidential basis and, in making
such justification, the agency shall make reference to section 8 of
this chapter.
(6) The categories of sources of such personal information.
(7) The agency's policies and practices regarding the
implementation of section 2 of this chapter relating to information
storage, duration of retention of information, and elimination of
information from the system.
(8) The uses made by the agency of personal information
contained in the system.
(9) The identity of agency personnel, other agencies, and persons
or categories of persons to whom disclosures of personal
information are made or to whom access to the system may be
granted, together with the purposes therefor and the restriction, if
any, on such disclosures and access, including any restrictions on
redisclosure.
(10) A listing identifying all forms used in the collection of
personal information.
(11) The name, title, business address, and telephone number of
the person immediately responsible for bringing and keeping the
system in compliance with the provisions of this chapter.
As added by Acts 1977, P.L.21, SEC.1. Amended by Acts 1978,
P.L.10, SEC.3; P.L.19-1983, SEC.2.