Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy topic
No spam. Unsubscribe anytime.
Town of Daniel briefed on 2024 Government Data Privacy Act; privacy program report due Dec. 31
Summary
A state-funded adviser told the Daniel Town Council a single privacy program report must be filed by Dec. 31, 2025, and recommended appointing a CAO and records officer, performing a data inventory, and annual staff training to comply with the new law.
Spencer Foster, a local administrative advisor with MAG, briefed the Daniel Town Council on the Government Data Privacy Act passed in 2024 and what the law requires of every public agency, including small towns.
Foster said the only mandatory step for 2025 is completion of a privacy program report by Dec. 31, 2025. That report asks how the agency collects and uses personal data, who manages the program, and where records are stored. Foster said the report is internal for 2025 and is not subject to general records-request rules except by the state Data Privacy Office.
The presentation laid out additional steps the law eventually requires: appointing a chief administrative officer (CAO) and a records officer, adopting a written privacy policy, conducting a data inventory to document where personal data are stored and how vendors are used, and providing annual privacy training for anyone who touches agency data (council members, staff, planning commissioners). Foster recommended the mayor serve as CAO and the town recorder (Mary) serve as records officer because the records officer must have GRAMA certification.
Foster described practical next steps: (1) watch the state’s eight-minute privacy-awareness video and document completion for the privacy-program report; (2) assign a CAO and a records officer (some municipalities use a resolution to record those appointments); and (3) complete the privacy-program report and retain it in the town’s archives. He said he will provide templates for a privacy-program report, a sample resolution, and a data-inventory template and that his assistance is provided through a state-funded program at no cost to the town.
Council members asked clarifying questions about the deadline and rollout. Foster said the legislature extended the original due date to Dec. 31, 2025 (the statute was enacted in 2024) and that the law’s more substantial requirements would be phased in after the initial report. He emphasized best practices: collect only data the town needs, notify people when the town collects personal data, avoid selling data unless legally required, and train staff annually.
The council did not take formal action on the presentation; Foster offered to follow up with the town and with Mary on any templates or questions.
The town will place fuller compliance steps (appointment of officials, privacy-policy adoption and data-inventory work) on a later schedule for 2026 implementation work.
