4.1 ERMUSR 03-13-2018 - Laserfiche WebLink

Home Browse Search

ERMU Management Policy—A.21 Records Management Policy Under special circumstances, a record not yet listed on the State Records Retention Schedule for Minnesota Cities can be destroyed. The Executive Administrative Assistant must submit a PRI Form -Authority to Destroy Records to the State Records Disposition Panel and receive approval from the panel before these records can be destroyed. SUSPENSION OF RECORDS DESTRUCTION—PENDING LITIGATION, GOVERNMENT INVESTIGATION OR AUDIT: If litigation is pending or threatened,the retention policy must be suspended for the document that could be subject to the litigation(litigation hold). The manager and the records coordinator must review all records prior to destruction to ensure that pending actions (litigation, government investigation, or audit)will not be affected by the destruction. If a department has been notified that litigation, government investigation, or audit is imminent or pending, all destruction must be suspended for records involved with the action. Departments should contact the city attorney to clarify the specific records involved in an action to ensure that all record production and discovery obligations can be met. SECURITY ASSESSMENT: At least annually,the responsible authority and department managers will conduct a comprehensive security assessment of any personal information maintained by ERMU. The responsible authorities shall also have all employees within their departments review ERMU's Data Practices policies. The responsible authorities will take measures to assure the employees are staying in compliance with the policies. If ERMU discover a data breach,the responsible authority for that department will give written notice by first class mail of that breach to the person who is the subject of the data. The person must also be informed that ERMU will perform an investigation of the data breach, and instructions on how the report can be accessed after completion. Upon completion of an investigation into any breach in the security of data and final disposition of any disciplinary action, including exhaustion of all rights of appeal under any applicable collective bargaining agreement,the responsible authority shall prepare a report on the facts and results of the investigation. If the breach involves unauthorized access to or acquisition of data by an employee, contractor, or agent of ERMU,the report must at a minimum include: • A description of the type of data that was accessed or acquired. • The number of individuals whose data was improperly accessed or acquired. • The names of each employee responsible for the unauthorized access, if there has been final disposition of disciplinary actions. • The final disposition of any disciplinary action taken as a result. If ERMU discovers circumstances requiring notification under this section of more than 1,000 individuals at one time, ERMU will also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as Page 4 of 5 156