Which Enterprise Systems Are Covered by SB 272?

Governor Brown approved SB 272 in October 2015, adding section 6270.5 to the California Public Records Act (the "Act", Government Code Sections 6250-6276.48).  Section 6270.5 defines an enterprise system as a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is (1) a multi-departmental system or system that contains information collected about the public and (2) a system of record.  A system of record means a system that serves as an original source of data within an agency.  Stated plainly, SB 272 requires local agencies to create a catalog of multi-departmental systems containing information about the public that store original records and post the catalog on their agency website.

Which Systems Are Excluded?

Enterprise systems do not include cybersecurity systems, infrastructure and mechanical control systems, or information that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, a public agency's IT system.  Additionally, section 6270.5 does not automatically require disclosure of the specific records that the IT systems collect, store, exchange or analyze, however, the Act's other provisions pertaining to disclosure of such records still apply.

Notes

PPHCSD Catalog of Enterprise Systems July 1, 2018.  In accordance with 6270.5, this document is available here and may be requested by the public at the District's office.  This information is updated annually.  For this document, an enterprise system is a multi-department system of record.

This catalog excludes: (A) Information technology security systems, including firewalls and other cyber security systems.  (B) Physical access control systems, employee identification management systems, video monitoring, and other physical control systems.  (C) Infrastructure and mechanical control systems, including those that control or manage street lights, electrical, or water functions.  (D) Systems that would be restricted from disclosure pursuant to Section 6254.19 of the Government Code.  (E) The specific records that the information technology system collects, stores, exchanges, or analyzes.

Nothing in this section shall be construed to permit public access to records held by an agency to which access is otherwise restricted by statute or to alter the process for requesting public records.