Sec.46a-54-152. Disclosure of personal data

(a) Upon written request pursuant to subsection (c) of section 46a-54-143 or subsection (c) of 46a-54-145, the Commission shall disclose all personal data maintained on the person making the request, unless nondisclosure is required or specifically permitted by law. The Commission shall ensure that disclosure made pursuant to the personal data act is conducted so as not to disclose any personal data concerning persons other than the person requesting the information. The Commission may disclose personal data to effectuate its law enforcement responsibilities.

(b) Within four (4) business days after the receipt of a written request, the Commission shall mail or deliver a written response in plain language, informing the person making the request as to:

(1) whether the Commission maintains personal data on him or her;

(2) the category and location of the data; and

(3) the procedure to access and review the data. Disclosure procedures shall accord with sections 1-15 to 1-21k, inclusive, of the Connecticut General Statutes.

(c) The Commission shall verify the identity of any person requesting access to his or her own personal data, and may refuse disclosure if the documentation is inadequate. The Commission may refuse to disclose medical, psychiatric or psychological data if, in the opinion of the Commission, disclosure would be detrimental to the person making the request. If the Commission refuses disclosure, it shall advise that person of the right to seek judicial relief pursuant to the personal data act.

(d) If the Commission refuses to disclose medical, psychiatric or psychological data based upon a determination that disclosure would be detrimental to that person and nondisclosure is not mandated by law, the Commission shall, at the written request of such person, permit a qualified medical doctor to review the data contained in the person's record to determine if the data should be disclosed. If disclosure is recommended, the Commission shall disclose the personal data. If nondisclosure is recommended, the Commission shall not disclose the data and shall inform such person of the right to seek judicial relief pursuant to the personal data act.

(e) The Commission shall maintain a complete log of each person, individual, agency and organization who has obtained access or to whom disclosure has been made of personal data under the personal data act, together with the reason for each disclosure or access. This log shall be maintained for no less than five (5) years from the date of such disclosure or access or for the life of the personal data record, whichever is longer.

(Effective January 1, 1993)