SB-272, California Public Records Act: Local Agencies: Inventory
SB 272 requires local agencies, except a local education agency, to create catalogs of all enterprise systems that store information about the public, and to post this catalog on the local agency’s Internet websites, if they have a website. If they do not have a website, they are required to publish the catalog in a way that can be provided to anyone who asks. This law applies to all California special districts, cities and counties.
What Is Covered By SB 272?
Section 6270.5 defines an enterprise system as a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is:
- a multi-departmental system or system that contains information collected about the public and
- a system of record
A system of record means a system that serves as an original source of data within an agency.
SB 272 requires local agencies to create a catalog of multi-departmental systems or systems containing information about the public that store original records and post the catalog on their agency website.
What Is Required:
The catalog shall disclose a list of the enterprise systems utilized by the agency and, for each system, shall also disclose all of the following:
- Current system vendor
- Current system product
- The purpose of the system
- What kind of data is stored in it
- The department that serves as the system’s primary custodian
- How frequently system data is collected
- How frequently system data is updated
What Is Excluded:
Enterprise systems shall not include any of the following:
- Information technology security systems, including firewalls and other cybersecurity systems.
- Physical access control systems, employee identification management systems, video monitoring, and other physical control systems.
- Infrastructure and mechanical control systems, including those that control or manage street lights, electrical, natural gas, or water or sewer functions.
- Systems related to 911 dispatch and operation or emergency services.
- Systems that would be restricted from disclosure pursuant to Section 6254.19.
- The Specific records that the information technology system collects, stores, exchanges, or analyzes.