SB 2113 — IDENTITY PROTECTION ACT

*LRB09518762HLH44882b* SB2113 95THEngrossed GENERALLRB095 ASSEMBLY18762 StateHLH of44882 Illinoisb andAN 2008ACT SB2113concerning IntroducedState 2/14/2008,government. by Sen.

Christine Radogno SYNOPSIS AS INTRODUCED:

New Act ILCS 805/8.32 new Creates the Identity Protection Act.

Prohibits a State or local government agency from using an individual’s social security number in certain ways, subject to various exceptions.

Requires each State or local government agency to develop and implement an identity protection plan.

Provides that any employee of a State or local government agency who intentionally violates the provisions of the Act is guilty of a Class B misdemeanor.

Preempts the concurrent exercise of home rule powers.

Amends the State Mandates Act to require implementation without reimbursement by the State.

Effective immediately.

LRB095 18762 HLH 44882 b FISCAL NOTE ACT HOME RULE NOTE STATE MANDATES MAY APPLY ACT MAY APPLY AREIMBURSEMENTE A BILL FOR SB2113 LRB095 18762 HLH 44882 b AN ACT concerning State government.

(a) Except as otherwise provided in this Act, beginning July 1, 2009,2010, no person or State or local government agency may do any of the following:

(2) Print an individual’s social security number on any SB2113 Engrossed - 2 - LRB095 18762 HLH 44882 b card required for the individual to access products or services provided by the person or entity;

Notwithstanding any provision in this Section to the contrary, social security numbers may be included in applications and forms sent by mail, including, but not limited to, any material mailed in connection with the administration of the Unemployment Insurance Act, any material mailed in connection with any tax administered by the Department of Revenue, and SB2113 Engrossed - 3 - LRB095 18762 HLH 44882 b documents sent as part of an application or enrollment process or to establish, amend, or terminate an account, contract, or policy or to confirm the accuracy of the social security number.

(6) CollectCollect, use, or disclose a social security number from an individual, unless required to do so under State or federal law, rules, or regulations, or unless the collectioncollection, use, or disclosure of the social security number is otherwise necessary for the performance of that agency’s duties and responsibilities.

(7) WhenUse requesting a social security number from an individual or when filing a document with the clerk of the circuit court or with the recorder of deeds that has been generated by a person or agency and on which the person or agency has requested a social security number, fail to segregate the social security number onfor aany separatepurpose pageother fromthan the restpurpose of the record, provide a discrete location SB2113 - 4 - LRB095 18762 HLH 44882 b for awhich social security number when required on a standardized form, or otherwise place the number in a manner that makes it easilywas redactedcollected. if required to be released as part of a public records request.

(8) WhenIntentionally collectingcommunicate aor socialotherwise securitymake numberavailable from an individual, fail to provide to the individual,general atpublic the time of or prior to the actual collection of the social security number by that agency, upon request by the individual, a statementperson’s of the purpose or purposes for which the agency is collecting and using the social security number.

(9)(b) UseThe theprohibitions socialin securitysubsection number(a) fordo anynot purposeapply otherin than the purposeSB2113 statedEngrossed in- the4 statement- providedLRB095 under18762 itemHLH (8).44882 b following circumstances:

(10)(1) IntentionallyThe communicatedisclosure orof otherwisesocial makesecurity availablenumbers to theagents, generalemployees, publicor contractors of a person’sgovernmental socialentity securityor numberdisclosed by a governmental entity to another governmental entity or otherits identifyingagents, information.employees, or contractors if disclosure is necessary in order for the entity to perform its duties and responsibilities and if the governmental entity and its agents, employees, and contractors maintain the confidential and exempt status of the social security numbers.

(b)(2) The prohibitionsdisclosure inof subsectionsocial (a)security donumbers notpursuant applyto ina thecourt followingorder, circumstances:warrant, or subpoena.

(1)(3) The collection, use, or disclosure of social security numbers or other identifying information disclosed to agents, employees, or contractors of a governmental entity or disclosed by a governmental entity to another governmental entity or its agents, employees, or contractors if disclosure is necessary in order for the entity to performensure its duties and responsibilities and if the governmentalsafety entityof: and its agents, employees, and contractors maintain the SB2113 - 5 - LRB095 18762 HLH 44882 b confidential and exempt status of the social security numbers or other identifying information.

(2) The disclosure of social security numbers or other identifying information disclosed pursuant to a court order, warrant, or subpoena.

(3) The collection, use, or disclosure of social security numbers or other identifying information in order to ensure the safety of:

(5) The collection, use, or disclosure of social security numbers or other identifying information to investigate or prevent fraud, to conduct background checks, to conduct social or scientific research, to collect a debt, to obtain a credit report from SB2113 Engrossed - 5 - LRB095 18762 HLH 44882 b or furnish data to a consumer reporting agency under the federal Fair Credit Reporting Act, to undertake any permissible purpose that is enumerated under the federal Gramm Leach Bliley Act, or to locate a missing person, a lost relative, or a person who is due a benefit, such as a pension benefit or SB2113 - 6 - LRB095 18762 HLH 44882 b an unclaimed-property benefit.

(c) If any State agency or local government agency has adopted standards for the collection, use, or disclosure of social security numbers or other identifying information that are stricter than the standards under this Act with respect to the protection of that identifying information, then, in the event of any conflict with the provisions of this Act, the stricter standards adopted by the State agency or local government agency shall control.

Notwithstanding any other provision of this Act to the contrary, a person or State or local government agency must comply with the provisions of any other State law with respect to allowing the public inspection and copying of information or documents containing all or any portion of an individual’s social security numbernumber. or other identifying information.

(a) This Act does not apply to the collection, use, or release of a social security number or other identifying information, as required by State or federal law, rule, or regulation, or the use of a social SB2113 Engrossed - 6 - LRB095 18762 HLH 44882 b security number or other identifying information for internal verification or administrative purposes.

SB2113 - 7 - LRB095 18762 HLH 44882 b (b) This Act does not apply to documents that are recorded with a county recorder or required to be open to the public under any State or federal law, rule, or regulation, applicable case law, Supreme Court Rule, or the Constitution of the State of Illinois.

Notwithstanding this Section, county recorders must comply with the provisions of Section 35 of this Act.

Identity-protection policy.policy;

Each State agency and local governmentgovernment. agency must establish an identity-protection policy and must implement that policy on or before December 31, 2009.

Each local government agency must establish an identity-protection policy and must implement that policy on or SB2113 Engrossed - 7 - LRB095 18762 HLH 44882 b before December 31, 2009.

(1) RequireIdentify all employees of the State or local government agency towho bemay trainedhave access to protect the SB2113 - 8 - LRB095 18762 HLH 44882 b confidentiality of social security numbers andin to understand the requirementscourse of thisperforming Section.their duties.

(2) ProhibitRequire all employees of the unlawfullocal disclosuregovernment agency identified as having access to social security numbers in the course of performing their duties to be trained to protect the confidentiality of social security numbers.numbers and to understand the requirements of this Section.

(3) LimitProhibit the numberunlawful ofdisclosure employeesof who have access to information or documents that contain social security numbers.

(4) DescribeLimit howthe tonumber properlyof disposeemployees ofwho have access to information andor documents that contain social security numbers.

(5) EstablishDescribe penaltieshow forto violationproperly dispose of theinformation privacyand policy.documents that contain social security numbers.

(6) PreventEstablish thepenalties intentionalfor communicationviolation of or ability of the generalprivacy publicpolicy. to access an individual’s social security number.

Each(7) StatePrevent agencythe mustintentional filecommunication a written copy of itsor privacyability policy with the Clerk of the Housegeneral ofpublic Representativesto andaccess thean Secretaryindividual’s ofsocial thesecurity Senate.number.

(8) Require that social security numbers requested from an individual be segregated on a separate page from the rest of the record, provide a discrete location for a social security number when required on a standardized SB2113 Engrossed - 8 - LRB095 18762 HLH 44882 b form, or otherwise place the number in a manner that makes it easily redacted if required to be released as part of a public records request.

(9) Require that, when collecting a social security number from an individual, at the time of or prior to the actual collection of the social security number or upon request by the individual, a statement of the purpose or purposes for which the agency is collecting and using the social security number be provided.