Connecticut General Statutes Title 4. Management of State Agencies § 4-193. Agency's duties re personal data

(a) Inform each of its employees who operates or maintains a personal data system or who has access to personal data, of the provisions of (1) this chapter, (2) the agency's regulations adopted pursuant to section 4-196, (3) the Freedom of Information Act, as defined in section 1-200, and (4) any other state or federal statute or regulation concerning maintenance or disclosure of personal data kept by the agency;

(b) Take reasonable precautions to protect personal data from the dangers of fire, theft, flood, natural disaster or other physical threats;

(c) Keep a complete record, concerning each person, of every individual, agency or organization who has obtained access to or to whom disclosure has been made of personal data and the reason for each such disclosure or access; and maintain such record for not less than five years from the date of obtaining such access or disclosure or maintain such record for the life of the record, whichever is longer;

(d) Make available to a person, upon written request, the record kept under subsection (c) of this section;

(e) Maintain only that information about a person which is relevant and necessary to accomplish the lawful purposes of the agency;

(f) Inform an individual in writing, upon written request, whether the agency maintains personal data concerning him;

(g) Except as otherwise provided in section 4-194, disclose to a person, upon written request, on a form understandable to such person, all personal data concerning him which is maintained by the agency. If disclosure of personal data is made under this subsection, the agency shall not disclose any personal data concerning persons other than the requesting person;

(h) Establish procedures which: