Topics: 

PM-07-003 Statewide Data Sharing

Issue Date: 1/01/2007

Effective Date: 1/01/2007

PURPOSE

Data created and maintained by the State of Georgia and its political subdivisions is public property and is ultimately for the benefit of the citizens of the State.  This policy is aimed at creating a cooperative culture among State Agencies that will encourage responsible sharing of data whenever possible and will encourage the removal of barriers to sharing data whenever possible.  Creating an environment where the data’s use can be maximized is of utmost importance in balance with the care required to ensure security and privacy. 

It will be the State’s goal to create such an environment where increasing the sharing of data between agencies will benefit the State of Georgia and its constituents by improving decision-making, supporting business process improvement, reducing redundancy, minimizing errors, and allowing more responsive service to citizens.  Requiring the implementation of strictly adhered to data protection processes and supporting technology will enable the State to achieve its goals.

POLICY

Principles:

The decision to release information to any state agency which adheres to adequate security and privacy guidelines should be guided by two principles: 

(1) The State of Georgia owns the data that its employees have created or aggregated to the extent that a property interest in the data exists and rests with the State of Georgia; and

(2) Georgia adheres to a statewide policy of open government, and should release data and records to other agencies unless specifically prohibited by statutory or appropriate regulatory authority.  Additionally, even when there is a statutory or regulatory barrier preventing value added data sharing, the impacted agencies should propose solutions to addressing these barriers.

Data Ownership and Stewardship:

Data Ownership and Stewardship within the State of Georgia need to be assigned to provide responsible and accountable management of state data.  The Data Owner will be responsible for ensuring the quality of the data and the protection of the data, based on its classification, as it is used throughout the state data enterprise.  User or recipient agencies are responsible to the Data Owner and assigned Data Steward to conform to the protection and usages agreed upon based on the data’s specific data classification. 

Data Classification:

Defining the classification of all data owned by the State of Georgia and its political subdivisions is essential to effective data sharing.   Knowledge about the classification, including specific sub-classifications of confidential or sensitive data is required to ensure that data is shared to its maximum extent and to ensure that it is protected as required.  Data should be shared under classification standards which account for the security, privacy, accuracy, integrity and commercial value of the data.

Data Classification is a means to standardize and identify the attributes of data.  Agencies will also work with the Georgia Technology Authority to apply data classifications to data they hold.  This effort will improve the State’s ability to make data sharing decisions both between State Agencies and with external entities.

Trusted Partner Concept:

The State can benefit from agencies working together to develop processes for data sharing that respect the sensitivity of data and furthermore ensures that their own information security and privacy efforts meet minimum standards for protecting data.  For instance, protected or sensitive data need not be transmitted between agencies when the need for information is simply for obtaining an answer derived from the sensitive data (e.g. the birth date of a person need not be transmitted if the requestor merely needs to confirm that this person has reached the age of majority).

Agencies shall negotiate an agreement outlining minimum efforts to make information available and minimum security and privacy protections.  Parties to this agreement will be considered “Trusted Partners” within the data sharing enterprise.  An agency shall not be entitled to be a Trusted Partner if it is unable to adhere to security and privacy requirements or fails to conform to the policies and procedures set forth in the agreement.  The agencies shall by consensus determine within the agreement a procedure to resolve data-sharing disputes.

Trusted Partners shall ultimately refer unresolved disputes to the Department of Law for final resolution, and Trusted Partners shall be bound to adhere to the Department of Law’s decision. 

The Office of the General Counsel of the Georgia Technology Authority is charged with the creation and maintenance of a master catalog of statutory and regulatory restrictions on the dissemination of data and information.  Agencies shall work with the Office of the General Counsel of the Georgia Technology Authority by submitting restrictions and interpretations of restrictions on data held by State Agencies.

Because of limited agency resources, there may be agency data sharing situations where a full Trusted Partner Agreement may not be appropriate or even necessary.  Upon a request from a non-partner, the Data Steward of the requested data should attempt to fulfill the request when the requested data is sufficiently protected and statutory requirements are met.

Data Sharing Beyond the Executive Branch:

The value of sharing data extends beyond the executive branch and to every level of government.  State agencies should structure information systems in ways that encourage horizontal, as well as vertical sharing and exchange of data within the state data sharing enterprise, and with other government branches and agencies, political subdivisions, academic institutions and where appropriate, private sector organizations.

TERMS and DEFINITIONS

Agency – Every state department, agency, board, bureau, commission, and authority including the judicial branch of state government and the University System of Georgia.

Data – Any representation of facts, concepts or instructions (structured, semi-structured or unstructured) in a formalized manner suitable for communication, interpretation or processing by people or by machines.

Data Classification - Applying standard descriptions of characteristics to data.  In the case of data sharing, this specifically refers to security, privacy, integrity and commercial value of the data.

Data Owner – The agency which is responsible for creating and/or maintaining specific data, and its accuracy and completeness is the data owner.  The agency head will assign this responsibility to one or more individuals within the agency.  These individuals shall be responsible for protecting and managing the use and sharing of the specific data.

Data Steward – The specific employee or position assigned by a Data Owner to protect and manage the use of specific data.

Data-sharing – Data-sharing is allowing data to be used in an agency outside of the Data Owner’s agency. 

Trusted Partner – An Agency of the State of Georgia that has met the requirements set forth in a data sharing agreement between agencies and agreed to be bound by the principles, policies and procedures established in that agreement.

RELATED POLICIES, STANDARDS AND GUIDELINES

Data Steward SM-15-001

Data Sharing Guidelines GM-15-008

Integration Middleware SA-07-020