Sen. Christine Radogno
Filed: 3/11/2008
|
|||||||
| |||||||
| |||||||
1 | AMENDMENT TO SENATE BILL 2113
| ||||||
2 | AMENDMENT NO. ______. Amend Senate Bill 2113 by replacing | ||||||
3 | everything after the enacting clause with the following:
| ||||||
4 | "Section 1. Short title. This Act may be cited as the | ||||||
5 | Identity Protection Act.
| ||||||
6 | Section 5. Definitions. In this Act: | ||||||
7 | "Local government agency" means that term as it is defined | ||||||
8 | in Section 1-8 of the Illinois State Auditing Act.
| ||||||
9 | "Person" means any individual in the employ of a State | ||||||
10 | agency or local government agency. | ||||||
11 | "Publicly post" or "publicly display" means to | ||||||
12 | intentionally communicate or otherwise intentionally make | ||||||
13 | available to the general public. | ||||||
14 | "State agency" means that term as it is defined in Section | ||||||
15 | 1-7 of the Illinois State Auditing Act.
|
| |||||||
| |||||||
1 | Section 10. Prohibited activities. | ||||||
2 | (a) Except as otherwise provided in this Act,
beginning | ||||||
3 | July 1, 2010, no
person or State or local government agency may | ||||||
4 | do any of the following: | ||||||
5 | (1) Publicly post or publicly display in any manner an | ||||||
6 | individual's social security number. | ||||||
7 | (2) Print an individual's social security number on any | ||||||
8 | card
required for the individual to access products or | ||||||
9 | services provided by the person or entity; however, a | ||||||
10 | person or entity that provides an insurance card must print | ||||||
11 | on the card an identification number unique to the holder | ||||||
12 | of the card in the format prescribed by Section 15 of the
| ||||||
13 | Uniform Prescription Drug Information Card Act. | ||||||
14 | (3) Require an individual to transmit his or her social | ||||||
15 | security number over the Internet, unless the connection is | ||||||
16 | secure or the social security number is encrypted. | ||||||
17 | (4) Require an individual to use his or her social | ||||||
18 | security number to access an Internet web site, unless a | ||||||
19 | password or unique personal identification number or other | ||||||
20 | authentication device is also required to access the | ||||||
21 | Internet web site. | ||||||
22 | (5) Print an individual's social security number on any | ||||||
23 | materials that are mailed to the individual, through the | ||||||
24 | U.S. Postal Service, any private mail service, electronic | ||||||
25 | mail, or any similar method of delivery, unless State or | ||||||
26 | federal law requires the social security number to be on |
| |||||||
| |||||||
1 | the document to be mailed. Notwithstanding any provision in | ||||||
2 | this Section to the contrary, social security numbers may | ||||||
3 | be included in applications and forms sent by mail, | ||||||
4 | including, but not limited to, any material mailed in | ||||||
5 | connection with the administration of the Unemployment | ||||||
6 | Insurance Act, any material mailed in connection with any | ||||||
7 | tax administered by the Department of Revenue, and | ||||||
8 | documents sent as part of an application or enrollment | ||||||
9 | process or to establish, amend, or terminate an account, | ||||||
10 | contract, or policy or to confirm the accuracy of the | ||||||
11 | social security number. A social security number that may | ||||||
12 | permissibly be mailed under this Section may not be | ||||||
13 | printed, in whole or in part, on a postcard or other mailer | ||||||
14 | that does not require an envelope or be visible on an | ||||||
15 | envelope or visible without the envelope having been | ||||||
16 | opened. | ||||||
17 | (6) Collect a social security number from an | ||||||
18 | individual, unless required to do so under State or federal | ||||||
19 | law, rules, or regulations, unless the collection of the | ||||||
20 | social security number is otherwise necessary for the | ||||||
21 | performance of that agency's duties and responsibilities. | ||||||
22 | Social security numbers collected by a State or local | ||||||
23 | government agency must be relevant to the purpose for which | ||||||
24 | the number was collected and must not be collected unless | ||||||
25 | and until the need for social security numbers for that | ||||||
26 | purpose has been clearly documented. |
| |||||||
| |||||||
1 | (7) Use the social security number for any purpose | ||||||
2 | other than the purpose for which it was collected. | ||||||
3 | (8) Intentionally communicate or otherwise make | ||||||
4 | available to the general public a person's social security | ||||||
5 | number. | ||||||
6 | (b) The prohibitions in subsection (a) do not apply in the | ||||||
7 | following circumstances: | ||||||
8 | (1) The disclosure of social security numbers to | ||||||
9 | agents, employees, or contractors of a governmental entity | ||||||
10 | or disclosed by a governmental entity to another | ||||||
11 | governmental entity or its agents, employees, or | ||||||
12 | contractors if disclosure is necessary in order for the | ||||||
13 | entity to perform its duties and responsibilities and if | ||||||
14 | the governmental entity and its agents, employees, and | ||||||
15 | contractors maintain the confidential and exempt status of | ||||||
16 | the social security numbers. | ||||||
17 | (2) The disclosure of social security numbers pursuant | ||||||
18 | to a court order, warrant, or subpoena. | ||||||
19 | (3) The collection, use, or disclosure of social | ||||||
20 | security numbers in order to ensure the safety of: State | ||||||
21 | and local government employees; persons committed to | ||||||
22 | correctional facilities, local jails, and other | ||||||
23 | law-enforcement facilities or retention centers; wards of | ||||||
24 | the State; and all persons working in or visiting a State | ||||||
25 | or local government agency facility. | ||||||
26 | (4) The disclosure of social security numbers by a |
| |||||||
| |||||||
1 | State agency to any entity for the collection of delinquent | ||||||
2 | child support or of any State debt. | ||||||
3 | (5) The collection, use, or disclosure of social | ||||||
4 | security numbers to investigate or prevent fraud, to | ||||||
5 | conduct background checks, to conduct social or scientific | ||||||
6 | research, to collect a debt, to obtain a credit report from | ||||||
7 | or furnish data to a consumer reporting agency under the | ||||||
8 | federal Fair Credit Reporting Act, to undertake any | ||||||
9 | permissible purpose that is enumerated under the federal | ||||||
10 | Gramm Leach Bliley Act, or to locate a missing person, a | ||||||
11 | lost relative, or a person who is due a benefit, such as a | ||||||
12 | pension benefit or an unclaimed-property benefit. | ||||||
13 | (c) If any State agency or local government agency has | ||||||
14 | adopted standards for the collection, use, or disclosure of | ||||||
15 | social security numbers that are stricter than the standards | ||||||
16 | under this Act with respect to the protection of that | ||||||
17 | identifying information, then, in the event of any conflict | ||||||
18 | with the provisions of this Act, the stricter standards adopted | ||||||
19 | by the State agency or local government agency shall control. | ||||||
20 | Section 15. Public inspection and copying of information | ||||||
21 | and documents. Notwithstanding any other provision of this Act | ||||||
22 | to the contrary, a person or State or local government agency | ||||||
23 | must comply with the provisions of any other State law with | ||||||
24 | respect to allowing the public inspection and copying of | ||||||
25 | information or documents containing all or any portion of an |
| |||||||
| |||||||
1 | individual's social security number. | ||||||
2 | Section 20. Applicability. | ||||||
3 | (a) This Act does not apply to the collection, use, or | ||||||
4 | release
of a social security number as required by State or | ||||||
5 | federal law, rule, or regulation, or
the use of a social | ||||||
6 | security number or other identifying information for internal | ||||||
7 | verification or
administrative purposes. | ||||||
8 | (b) This Act does not apply to documents that are recorded | ||||||
9 | with a county recorder or
required to be open to the public | ||||||
10 | under any State or federal law, rule, or regulation, applicable | ||||||
11 | case law, Supreme Court Rule, or the Constitution of the State | ||||||
12 | of Illinois. Notwithstanding this Section, county recorders | ||||||
13 | must comply with the provisions of Section 35 of this Act. | ||||||
14 | Section 25. Compliance with federal law. If a federal law | ||||||
15 | takes effect requiring any federal agency to establish a | ||||||
16 | national
unique patient health identifier program, any State or | ||||||
17 | local government agency that complies with the federal law | ||||||
18 | shall be deemed to be in compliance with this
Act. | ||||||
19 | Section 30. Embedded social security numbers. Beginning | ||||||
20 | December 31, 2009, no person or State or local government | ||||||
21 | agency may encode or embed a social security
number in or on a | ||||||
22 | card or document, including, but not limited to,
using a bar | ||||||
23 | code, chip, magnetic strip, RFID technology, or other |
| |||||||
| |||||||
1 | technology, in place
of removing the social security number as | ||||||
2 | required by this Act. | ||||||
3 | Section 35. Identity-protection policy; local government. | ||||||
4 | Each local government agency must establish an | ||||||
5 | identity-protection policy and must implement that policy on or | ||||||
6 | before December 31, 2009. The policy must do all of the | ||||||
7 | following:
| ||||||
8 | (1) Identify all employees of the local government | ||||||
9 | agency who may have access to social security numbers in | ||||||
10 | the course of performing their duties. | ||||||
11 | (2) Require all employees of the local government | ||||||
12 | agency identified as having access to social security | ||||||
13 | numbers in the course of performing their duties to be | ||||||
14 | trained to protect the confidentiality of social security | ||||||
15 | numbers and to understand the requirements of this Section. | ||||||
16 | (3) Prohibit the unlawful disclosure of social | ||||||
17 | security numbers. | ||||||
18 | (4) Limit the number of employees who have access to | ||||||
19 | information or documents that contain social security | ||||||
20 | numbers. | ||||||
21 | (5) Describe how to properly dispose of information and | ||||||
22 | documents that contain social security numbers. | ||||||
23 | (6) Establish penalties for violation of the privacy | ||||||
24 | policy.
| ||||||
25 | (7) Prevent the intentional communication of or |
| |||||||
| |||||||
1 | ability of the general public to access an individual's | ||||||
2 | social security number. | ||||||
3 | (8) Require that social security numbers requested | ||||||
4 | from an individual be segregated on a separate page from | ||||||
5 | the rest of the record, provide a discrete location for a | ||||||
6 | social security number when required on a standardized | ||||||
7 | form, or otherwise place the number in a manner that makes | ||||||
8 | it easily redacted if required to be released as part of a | ||||||
9 | public records request. | ||||||
10 | (9) Require that, when collecting a social security | ||||||
11 | number from an individual, at the time of or prior to the | ||||||
12 | actual collection of the social security number or upon | ||||||
13 | request by the individual, a statement of the purpose or | ||||||
14 | purposes for which the agency is collecting and using the | ||||||
15 | social security number be provided. | ||||||
16 | Each local government agency must file a written copy of | ||||||
17 | its privacy policy with the governing board of the unit of | ||||||
18 | local government. Each local government agency must also | ||||||
19 | provide a written copy of the policy to each of its employees, | ||||||
20 | and must also make its privacy policy available to any member | ||||||
21 | of the public, upon request. If a local government agency | ||||||
22 | amends its privacy policy, then that agency must file a written | ||||||
23 | copy of the amended policy with the appropriate entity and must | ||||||
24 | also provide each of its employees with a new written copy of | ||||||
25 | the amended policy.
|
| |||||||
| |||||||
1 | Section 37. Identity-protection policy; State. Each State | ||||||
2 | agency must recommend to the Social Security Number Task Force | ||||||
3 | an identity-protection policy on or before September 30, 2009. | ||||||
4 | The policy must do all of the following:
| ||||||
5 | (1) Identify all employees of the State agency who may | ||||||
6 | have access to social security numbers in the performance | ||||||
7 | of their duties. | ||||||
8 | (2) Require all employees of the State agency | ||||||
9 | identified as having access to social security numbers in | ||||||
10 | the performance of their duties to be trained to protect | ||||||
11 | the confidentiality of social security numbers and to | ||||||
12 | understand the requirements of this Section. | ||||||
13 | (3) Prohibit the unlawful disclosure of social | ||||||
14 | security numbers. | ||||||
15 | (4) Limit the number of employees who have access to | ||||||
16 | information or documents that contain social security | ||||||
17 | numbers. | ||||||
18 | (5) Describe how to properly dispose of information and | ||||||
19 | documents that contain social security numbers. | ||||||
20 | (6) Establish penalties for violation of the privacy | ||||||
21 | policy.
| ||||||
22 | (7) Prevent the intentional communication of or | ||||||
23 | ability of the general public to access an individual's | ||||||
24 | social security number. | ||||||
25 | (8) Require that social security numbers requested | ||||||
26 | from an individual be segregated on a separate page from |
| |||||||
| |||||||
1 | the rest of the record, provide a discrete location for a | ||||||
2 | social security number when required on a standardized | ||||||
3 | form, or otherwise place the number in a manner that makes | ||||||
4 | it easily redacted if required to be released as part of a | ||||||
5 | public records request. | ||||||
6 | (9) Require that, when collecting a social security | ||||||
7 | number from an individual, at the time of or prior to the | ||||||
8 | actual collection of the social security number or upon | ||||||
9 | request by the individual, a statement of the purpose or | ||||||
10 | purposes for which the agency is collecting and using the | ||||||
11 | social security number be provided. | ||||||
12 | The Task Force will study the recommendations from the | ||||||
13 | State agencies and will make its recommendation to the General | ||||||
14 | Assembly of the changes needed to implement the policies by | ||||||
15 | December 31, 2009. | ||||||
16 | Section 40. Judicial branch and clerks of courts. The | ||||||
17 | judicial branch and clerks of the circuit court are not subject | ||||||
18 | to the provisions of this Act, except that the Supreme Court | ||||||
19 | shall, under its rulemaking authority or by administrative | ||||||
20 | order, adopt requirements applicable to the judicial branch, | ||||||
21 | including clerks of the circuit court, regulating the | ||||||
22 | disclosure of social security numbers consistent with the | ||||||
23 | intent of this Act and the unique circumstances relevant in the | ||||||
24 | judicial process. |
| |||||||
| |||||||
1 | Section 45. Violation. Any person who intentionally | ||||||
2 | violates the prohibitions in Section 10 of this Act is guilty | ||||||
3 | of a Class B misdemeanor. | ||||||
4 | Section 50. Home rule. A home rule unit of local | ||||||
5 | government, any non-home rule municipality, or any non-home | ||||||
6 | rule county may regulate the use of social security numbers, | ||||||
7 | but that regulation must be no less restrictive than this Act. | ||||||
8 | This Act is a limitation under subsection (i) of Section 6 of | ||||||
9 | Article VII of the Illinois Constitution on the concurrent | ||||||
10 | exercise by home rule units of powers and functions exercised | ||||||
11 | by the State.
| ||||||
12 | Section 55. This Act does not supersede any more | ||||||
13 | restrictive law, rule, or regulation regarding the collection, | ||||||
14 | use, or release of social security numbers. | ||||||
15 | Section 90. The State Mandates Act is amended by adding | ||||||
16 | Section 8.32 as follows: | ||||||
17 | (30 ILCS 805/8.32 new) | ||||||
18 | Sec. 8.32. Exempt mandate. Notwithstanding Sections 6 and 8 | ||||||
19 | of this Act, no reimbursement by the State is required for the | ||||||
20 | implementation of any mandate created by this amendatory Act of | ||||||
21 | the 95th General Assembly.
|
| |||||||
| |||||||
1 | Section 99. Effective date. This Act takes effect upon | ||||||
2 | becoming law.".
|