SB 272 – Enterprise System Catalog

Senate Bill 272

Approved on October 11, 2015, SB 272 adds a section to the California Public Records Act requiring local agencies to create a catalog of Enterprise Systems by July 1, 2016 with annual updates.

Enterprise System

A software application or computer system that collects, stores, exchanges and analyzes information that the agency uses that is both of the following:

• A multi-departmental system or a system that contains information collected about the public.
• A system that serves as an original source of data within an agency.

Enterprise systems do not include cybersecurity systems, infrastructure and mechanical control systems, or information that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, a public agency’s IT system. Additionally, section 6270.5 does not automatically require disclosure of the specific records that the IT systems collect, store, exchange or analyze, however, the Act’s other provisions pertaining to disclosure of such records still apply.

Requirements

1. Create a catalog of enterprise systems, containing the following:

• Current system vendor
• Current system product
• System’s purpose
• A description of categories or types of data
• The frequency that system data is collected
• The frequency that system data is updated

2. To make the catalog publicly available upon request

3. To post the catalog in a prominent location on the agency’s website

Exception

If the public interest served by not disclosing the information described clearly outweighs the public interest served by the disclosure, the local agency may instead provide a system name, brief title or identifier of the system.