R895-8-7. Notification and Posting Requirements

(1) If either of the exceptions listed in R895-5-6 Subsection (1)(a) or (b) apply or if the State agency issues an agency privacy policy for its website as permitted under this rule, then the agency shall conspicuously post that information on the Web pages where personally identifiable information is collected or on the home page of its Website including the following:

(a) a notice that such personally identifiable information is subject to public access, if such information is public record;

(b) a notice and a summary or link to the citation of any State statute, federal statute, or federal regulation that supercedes part or all of this rule;

(c) a link to the agency's privacy policy;

(d) a link from the agency's website to this rule and

(e) a link from the agency's website to the State Policy.

(2) The agency privacy policy shall indicate:

(a) the name of the issuing agency;

(b) a statement that the agency privacy policy applies to its own website only;

(c) a statement about what personally identifiable information the policy specifically applies to; and

(d) a statement defining how its agency privacy policy differs from this rule.

(3) The effective date for this subsection shall be four months from the effective date of this rule for information collected through existing online applications. If requested in writing by the agency, an additional extension for up to 30-days may be given by the chief information officer. For all new online applications the conditions of this subsection must be met prior to the application going "live."