In July of 2021, a new law established under SB 5432 went into effect and created a requirement to implement data sharing agreements (DSAs) with other public agencies when sharing data classified as category 3 or higher.

According to the state Office of the Chief Information Officer (OCIO), category 3 data includes confidential information, such as personal information, information about public employees, and information about network infrastructure and security. Category 4 data includes confidential information that requires special handling. This would include information that is specifically protected from disclosure by law.

DSAs must include the following elements:

• The data that will be shared;
• The specific authority for sharing the data;
• The classification of the data shared;
• Access methods for the shared data;
• Authorized users and operations permitted;
• Protection of the data in transport and at rest;
• Storage and disposal of data no longer required;
• Backup requirements for the data, if applicable; and
• Other applicable data handling requirements.

As a reminder to our members, cities are only required to enter into DSAs with other public agencies, such as county governments or state agencies. We encourage those cities that share data classified as category 3 or 4 with outside public agencies to work with your legal counsel to develop a model DSA that can be used with outside organizations.

For examples of data sharing agreements, please refer to a recent blog post by MRSC.