Chapter 4 – Information Technology

49010.4 Statutory References Concerning the Confidentiality and Security of Information Within CDC

• GCGovernment Code 1171 requires the director of each department that uses, receives or provides data processing services to designate an Information Security Officer (ISOInformation Security Officer) who shall be responsible for implementing State policies and standards regarding the confidentiality and security of information within the Department. These policies and standards shall include, but are not limited to, strict controls to prevent unauthorized access of: data maintained in computer files, program documentation, data processing systems, data files, and data processing equipment located physically in the Department.

• The primary provisions affecting the classification and dissemination of information under the control of California State agencies is found in the State Constitution, in statutes, and in administrative policies:

  • Article 1, Section 1, of the Constitution of the State of California defines pursuing and obtaining privacy as an inalienable right.

  • The IPAInformation Practices Act of 1977 (CCCorrectional Counselor 1798, et seq.), places specific requirements on State agencies in the collection, use, maintenance, and dissemination of information relating to individuals.

  • The PRAPublic Records Act (GCGovernment Code 6250-6265), provides for the inspection of public records.

  • The State Records Management Act (GCGovernment Code 14740-14770), provides for the application of management methods to create, use, maintain, retain, preserve, and dispose of State records, including the determination of records essential to the continuation of State government in the event of a major disaster. SAMState Administrative Manual 1601 through 1699 contain administrative policies to implement provisions of this law.

  • The California Computer Crime Statute (Calif. Rev. Stat 1987, Sect. 502, Ch. 1499, 1 January 1988) covers five offenses:

    • Manipulating data, a computer system, or computer network to devise or execute a fraud.

    • Knowingly accessing and without permission taking copies or using any data from a computer or taking any supporting documentation, internal or external, to a computer.

    • Theft of computer services.

    • Knowingly accessing and without permission damaging data, computer software, or computer programs, internal or external, to a computer.

    • Disrupting or denying computer services to an authorized user.

  • The Federal Copyright Act of 1976, provides for the prosecution of persons guilty of the theft of computer programs.