Regulations of Connecticut State Agencies
(a) Definitions. The following definitions shall apply to this section:
(1) "Board" means the Connecticut State Board of Accountancy as defined in Chapter 389 of the Connecticut General Statutes.
(2) "Category of Personal Data" means the classifications of personal information set forth in the Personal Data Act, Section 4-190 (9) of the Connecticut General Statutes.
(3) "Freedom of Information Act" means Chapter 14 of the Connecticut General Statutes.
(4) "Other Data" means any information which because of name, identification number, mark or description can be readily associated with a particular person.
(5) "Personal Data Act" means Chapter 55 of the Connecticut General Statutes.
(6) Terms defined in Section 4-190 of the Connecticut General Statutes shall apply to this section.
(b) General nature and purpose of personal data systems. The Board shall maintain a personal data system for the Connecticut Certified Public Accountant Records as follows:
(1) The maintenance of Connecticut Certified Public Accountancy certificate, license and firm records are the responsibility of the Connecticut State Board of Accountancy, located at 30 Trinity Street, Hartford, Connecticut 06106.
(2) Connecticut Certified Public Accountancy certificate, license and firm records are maintained in both automated and manual form.
(3) Connecticut Certified Public Accountancy certificate, license and firm records are maintained for the purposes of determining the qualifications of certified public accountant certificate, license and firm applicants and the continued suitability of appointees applying for renewal of their certificate, license and firm permits.
(4) All requests for disclosure or amendment of Certified Public Accountancy certificate, license and firm permit records should be directed to the Connecticut State Board of Accountancy, located at 30 Trinity Street, Hartford, Connecticut 06106.
(5) Routine sources of information retained in licensing records include applicant's personal data information, transcripts, employment information, and examination information.
(6) Personal data in Certified Public Accountancy certificate, license and firm permit records are collected, maintained and used under authority of Chapter 389 of the Connecticut General Statutes.
(c) Categories of personal data. Certified PublicAccountancy certificate, license and firm permit records.
(1) The following categories of personal data may be maintained in Certified Public Accountancy certificate, license and firm permit records:
(A) Personal data.
(B) Employment or business history.
(C) Criminal records.
(D) Transcripts.
(E) Exam grades.
(2) The following categories of other data may be maintained in Certified Public Accountancy certificate, license and firm permit records:
(A) Addresses.
(B) Telephone numbers.
(C) Last four digits of the Social Security Number.
(D) Date of birth.
(E) Renewal records.
(3) Certified Public Accountancy certificate, license and firm permit records are maintained on Certified Public Accountancy certificate, license and firm permit holders for licensing and renewal.
(d) Maintenance of personal data—general.
(1) Personal data shall not be maintained unless relevant and necessary to accomplish the lawful purposes of the Connecticut State Board of Accountancy. Where the Board finds irrelevant or unnecessary public records in its possession, the Board shall dispose of the records in accordance with its records retention schedule and with the approval of the Public Records Administrator in accordance with the provisions of Section 11-8a of the Connecticut General Statutes, or if the records are not disposable under the records retentions schedule, request permission from the Public Records Administrator to dispose of the records under Section 11-8a of the Connecticut General Statutes.
(2) The Board shall collect and maintain all records with accurateness and completeness.
(3) Insofar as it is consistent with the needs and mission of the Board, wherever practical, the Board shall collect personal data directly from the persons to whom a record pertains.
(4) Employees of the Board involved in the operations of the Board’s personal data systems shall be informed of the provisions of (A) the Personal Data Act, (B) the Board’s regulations adopted pursuant to Section 4-196 of the Connecticut General Statutes, (C) the Freedom of Information Act, and (D) any other state or federal statute or regulations concerning maintenance or disclosure of personal data kept by the Board.
(5) All employees of the Board shall take reasonable precautions to protect personal data under their custody from the danger of fire, theft, flood, natural disaster and other physical threats.
(6) The Board shall incorporate by reference the provisions of the Personal Data Act and regulations promulgated thereunder in all contracts, agreements or licenses for the operation of a personal data system or for research, evaluation and reporting of personal data for the Board or on its behalf.
(7) The Board shall have an independent obligation to ensure that personal data requested from any other state agency is properly maintained.
(8) Only employees of the Board who have a specific need or legal authority to review personal data records for lawful purposes of the Board shall be entitled to access to such records under the Personal Data Act.
(9) The Board shall keep a written up-to-date list of individuals entitled to access to each of the Board’s personal data systems.
(10) The Board shall ensure against unnecessary duplication of personal data records. In the event it is necessary to send personal data records through interdepartmental mail, such records shall be sent in envelopes or boxes sealed and marked ‘‘personal and confidential.’’
(11) The Board shall ensure that all records in manual personal data systems are kept under lock and key and, to the greatest extent practical, are kept in controlled access areas.
(e) Maintenance of personal data—automated systems.
(1) To the greatest extent practical, automated equipment and records pertaining to personal data shall be located in a limited access area.
(2) To the greatest extent practical, the Board shall require visitors to such limited access area to sign a visitor’s log and permit access to said area on a bona fide need-to-enter basis only.
(3) To the greatest extent practical, the Board will ensure that regular access to automated equipment pertaining to personal data is limited to operations personnel.
(4) The Board shall utilize appropriate access control mechanisms to prevent disclosure of personal data to unauthorized individuals.
(f) Maintenance of personal data—disclosure.
(1) Not later than four business days after of receipt of a written request therefor, the Board shall mail or deliver to the requesting individual a written response in plain language, informing him or her as to whether or not the Board maintains personal data on that individual, the category and location of the personal data maintained on that individual and procedures available to review the records.
(2) Except where nondisclosure is required or specifically permitted by law, the Board shall disclose to any person upon written request all personal data concerning that individual which is maintained by the Board. The procedures for disclosure shall be in accordance with the Freedom of Information Act. If the personal data is maintained in coded form, the Board shall transcribe the data into a commonly understandable form before disclosure.
(3) The Board is responsible for verifying the identity of any person requesting access to his or her own personal data.
(4) The Board is responsible for ensuring that disclosure made pursuant to the Personal Data Act is conducted so as not to disclose any personal data concerning persons other than the person requesting the information.
(5) The Board may refuse to disclose to a person medical, psychiatric or psychological data on that person if the Board determines that such disclosure would be detrimental to that person.
(6) In any case where the Board refuses disclosure, it shall advise the person of his or her right to seek judicial relief pursuant to the Personal Data Act.
(7) If the Board refuses to disclose medical, psychiatric or psychological data to a person based on its determination that disclosure would be detrimental to that person and nondisclosure is not mandated by law, the Board shall, at the written request of such person, permit a qualified medical doctor to review the personal data contained in the person’s records to determine if the personal data should be disclosed. If disclosure is recommended by the person’s medical doctor, the Board shall disclose the personal data to such person; if nondisclosure is recommended by such person’s medical doctor, the Board shall not disclose the personal data and shall inform such person of the judicial relief provided under the Personal Data Act.
(8) The Board shall maintain a complete log of each person, individual, agency or organization who has obtained access to, or to whom disclosure has been made of personal data, under the Personal Data Act, together with the reason for each such disclosure or access. This log shall be maintained for not less than five years from the date of such disclosure or access or for the life of the personal data record, whichever is longer.
(g) Contesting the content of personal data records.
(1) Any person who believes that the Board is maintaining inaccurate, incomplete or irrelevant personal data concerning him or her may file a written request with the Board for correction of said personal data.
(2) Not later than thirty days after receipt of such request, the Board shall give written notice to that person that it will make the requested correction, or if the correction is not to be made as submitted, the Board shall state the reason for its denial of such request and notify the person of his or her right to add his or her own statement to his or her personal data records.
(3) Following such denial by the Board, the person requesting such correction shall be permitted to add a statement to his or her personal data record setting forth what that person believes to be an accurate, complete and relevant version of the personal data in question. Such statements shall become a permanent part of the Board’s personal data system and shall be disclosed to any individual, agency or organization to which the disputed personal data is disclosed.
(h) Uses to be made of the personal data.
(1) Certified Public Accountancy certificate, license and firm permit holder records are used to determine the qualifications of applicants as Certified Public Accountancy certificate, license or firm permit holders and the continued qualification of certificate, license and firm permit holders. Users include all employees of the Board, and others where permitted or required by law.
(2) When an individual is asked to supply personal data to the Board, the Board shall disclose to that individual, upon request, the legal authority under which the Board is empowered to collect and maintain the personal data, the individual’s rights pertaining to such records under the Personal Data Act and the Board’s regulations, the known consequences arising from supplying or refusing to supply the requested personal data, and the proposed use to be made of the requested personal data.
(Effective October 19, 2015)