Section 129.2.12. Availability of records.

         2.12(1) General. Office records are open for public inspection and copying unless otherwise provided by rule or law.

         2.12(2) Confidential records. The following records may be withheld from public inspection. Records are listed by category, according to the legal basis for withholding them from public inspection.

            a.               The office is a depository for the records of other public bodies. Records are maintained on paper, audiotape, and microform, and in electronic information storage and media systems. Although these records are in the physical possession of the office, the responsibility for compliance with Iowa Code chapter 22 remains with the “lawful custodian.” The public body requesting creation or storage of the record by the office is the lawful custodian (see Iowa Code section 22.1, definition of “lawful custodian”). All such records are confidentially maintained while in the possession of the office. Requests for access to any such records must be directed to the lawful custodian. In the event the office receives a request for access to any such records, the office may, in its discretion, direct the person making such a request to the lawful custodian of the subject records, or forward such request to the lawful custodian of the subject records. Additionally, any records maintained by the office concerning the content, location, or disposition of such records are confidential in order to maintain security for access to confidential records pursuant to Iowa Code section 22.7.

            b.               Records which are exempt from disclosure under Iowa Code section 22.7.

            c.               Sealed bids received prior to the time set for public opening of bids. (Iowa Code section 72.3)

            d.               Procurement proposals prior to completion of the evaluation process and the issuance of a notice of intent to award a contract by the appropriate procurement authority. (11—subrule 117.19(3), Iowa Administrative Code)

            e.               Tax records made available to the office. (Iowa Code sections 422.20 and 422.72)

            f.                Minutes or audio recordings of closed meetings of a government body. (Iowa Code section 21.5(4))

            g.               Identifying details in final orders, decisions, and opinions to the extent required to prevent a clearly unwarranted invasion of personal privacy or trade secrets under Iowa Code section 17A.3(1)“e.”

            h.               Those portions of office staff manuals, instructions, or other statements issued which set forth criteria or guidelines to be used by office staff in auditing, in making inspections, in settling commercial disputes or negotiating commercial arrangements, or in the selection or handling of cases, such as operational tactics or allowable tolerances of criteria for the defense, prosecution, or settlement of cases, when disclosure of these statements would:

             (1)             Enable law violators to avoid detection;

             (2)             Facilitate disregard of requirements imposed by law; or

             (3)             Give a clearly improper advantage to persons who are in an adverse position to the office. (Iowa Code sections 17A.2(11)“f”  and 17A.3(1)“d” )

            i.                Records which constitute attorney work products or attorney-client communications or which are otherwise privileged pursuant to Iowa Code section 22.7(4), 622.10 or 622.11, state and federal rules of evidence or procedure, the Code of Professional Responsibility, and case law.

            j.                Computer resource security files containing names, identifiers, and passwords of users of computer resources. Such files must be kept confidential to maintain security for access to confidential records pursuant to Iowa Code section 22.7. (Iowa Code section 22.7(50))

            k.               Data or information collected for the purpose of assessing, analyzing, measuring, preparing for, or responding to suspected, potential, or actual information security threats. (Iowa Code section 22.7(50))

            l.                Data or information collected for the purpose of assessing, analyzing, or classifying the severity of, nature of, ability to remediate, or ability to migrate data. (Iowa Code section 22.7(50))

            m.              Detailed security audit information. Such information includes but is not limited to security assessment reports; information directly related to vulnerability assessments; information contained in records relating to security measures such as security and response plans, security codes and combinations, passwords, restricted area passes, keys, and security or response procedures; emergency response protocols; and information contained in records that if disclosed would significantly increase the vulnerability of critical physical systems or infrastructures of the office. (Iowa Code section 22.7(50))

            n.               Information security data, information security proposals, or information security assessments compiled, prepared, or developed by a governmental body, or compiled, prepared, or developed by a nongovernment body and used by a government body pursuant to a contractual relationship with the nongovernment body. (Iowa Code section 22.7(50))

            o.               Data processing software, as defined in Iowa Code section 22.3A, which is developed by a government body, or developed by a nongovernment body and used by a government body pursuant to a contractual relationship with the nongovernment body. (Iowa Code section 22.3A(2)“a” )

            p.               Log-on identification passwords, Internet protocol addresses, private keys, or other records containing information which might lead to the disclosure of private keys used in a digital signature or other similar technologies as provided in Iowa Code chapter 554D.

            q.               Records which if disclosed might jeopardize the security of an electronic transaction pursuant to Iowa Code chapter 554D.

            r.                Any other records made confidential by law.

         2.12(3) Authority to release confidential records. The office may have discretion to disclose some confidential records which are exempt from disclosure under Iowa Code section 22.7 or other law. Any person may request permission to inspect records withheld from inspection under a statute which authorizes limited or discretionary disclosure as provided in rule 129—2.4(8B,17A,22). If the office initially determines that it will release such records, the office may where appropriate notify interested parties and withhold the records from inspection as provided in subrule 2.4(3).

[ARC 2542C, IAB 5/25/16, effective 6/29/16]