South Carolina General Assembly
116th Session, 2005-2006

Download This Version in Microsoft Word format

Bill 4297


Indicates Matter Stricken
Indicates New Matter


(Text matches printed bills. Document has been reformatted to meet World Wide Web specifications.)

A BILL

TO AMEND THE CODE OF LAWS OF SOUTH CAROLINA, 1976, SO AS TO ENACT THE "IDENTITY THEFT PROTECTION ACT", BY ADDING CHAPTER 20 TO TITLE 37 PROVIDING FOR PROTECTIONS IN CONNECTION WITH CONSUMER CREDIT-REPORTING AGENCIES AND WITH THE USE AND COMMUNICATION OF A CONSUMER'S SOCIAL SECURITY NUMBER, IMPOSITION OF A SECURITY FREEZE ON A CONSUMER'S CREDIT REPORT, PRESCRIPTION OF MEASURES FOR DISPOSAL OF PERSONAL IDENTIFYING INFORMATION AND DISCLOSURE OF UNAUTHORIZED ACCESS TO PERSONAL IDENTIFYING INFORMATION, AND CIVIL DAMAGES, INCLUDING ATTORNEY'S FEES AND COSTS AND INJUNCTIVE RELIEF; BY REDESIGNATING THE FAMILY PRIVACY PROTECTION ACT OF CHAPTER 2, TITLE 30, AS ARTICLE 1 AND BY ADDING ARTICLE 3 PROVIDING FOR PROTECTION OF PERSONAL IDENTIFYING INFORMATION PRIVACY IN CONNECTION WITH A PUBLIC BODY AND ITS USE AND COMMUNICATION OF A RESIDENT'S SOCIAL SECURITY NUMBER, PRESCRIPTION FOR DISCLOSURE OF SOCIAL SECURITY INFORMATION AND IDENTIFYING INFORMATION BY AND TO CERTAIN PUBLIC BODIES, PROHIBITION OF REQUIRING THE USE OF PERSONAL IDENTIFYING INFORMATION ON A MORTGAGE AND IN PREPARATION OF DOCUMENTS FOR PUBLIC FILING; AND PROCEDURE FOR REDACTING CERTAIN PERSONAL IDENTIFYING INFORMATION FROM PUBLIC RECORDS; BY ADDING SECTION 16-13-540 SO AS TO PROVIDE FOR THE EXPUNCTION OF THE CRIMINAL RECORD OF A NAMED INDIVIDUAL INCURRED AS A RESULT OF THE UNLAWFUL USE OF HIS IDENTIFYING INFORMATION; BY ADDING SECTION 16-13-550 SO AS TO PROVIDE FOR REPORTING OF THE CRIME OF FINANCIAL IDENTITY FRAUD TO THE LOCAL LAW ENFORCEMENT AGENCY AND REFERENCE BY THE LOCAL AGENCY TO THE AGENCY WITH JURISDICTION TO INVESTIGATE AND PROSECUTE; BY AMENDING SECTION 16-13-510, RELATING TO THE OFFENSE OF FINANCIAL IDENTITY FRAUD, SO AS TO INCLUDE THE USE OF ANOTHER'S INFORMATION TO OBTAIN ANYTHING OF VALUE, INCLUDING CREDIT, TO AVOID LEGAL CONSEQUENCES, OR TO OBTAIN EMPLOYMENT, AND TO PROVIDE, FOR EXCEPTIONS, TO FURTHER DEFINE "IDENTIFYING INFORMATION", AND TO PROVIDE FOR CRIMINAL PENALTIES, INCLUDING RESTITUTION; BY AMENDING SECTION 16-13-520, RELATING TO PROSECUTION OF THE CRIME OF FINANCIAL IDENTITY FRAUD, SO AS TO FURTHER PROVIDE FOR THE COUNTY IN WHICH THE CRIME IS CONSIDERED TO HAVE BEEN COMMITTED; BY ADDING SECTION 1-11-490 SO AS TO PROVIDE FOR DISCLOSURE BY AN AGENCY OF THIS STATE OF UNAUTHORIZED ACCESS TO THE PERSONAL IDENTIFYING INFORMATION OF A RESIDENT WHOSE INFORMATION THE AGENCY OWNS OR LICENSES AND TO PROVIDE FOR CIVIL DAMAGES, ATTORNEY'S FEES, AND INJUNCTIVE RELIEF; AND TO PROVIDE VARIOUS EFFECTIVE DATES.

Be it enacted by the General Assembly of the State of South Carolina:

SECTION    1.    This act may be cited as the "Identity Theft Protection Act".

SECTION    2.    Title 37 of the 1976 Code is amended by adding:

"CHAPTER 20

Identity Theft Protection

Section 37-20-10.    For purposes of this chapter:

(1)    'Consumer' means an individual residing in the State of South Carolina who undertakes a transaction for personal, family, or household purposes.

(2)    'Consumer credit-reporting agency' means a person that, for monetary fees or dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information about consumers for the purpose of furnishing consumer reports to third parties.

(3)    'Consumer report' or 'credit report' means any written, oral, electronic, or other communication of information by a consumer credit-reporting agency regarding a consumer's creditworthiness, credit standing, credit capacity, character, debts, general reputation, personal characteristics, or mode of living that is used or expected to be used or collected in whole or in part for the purpose of establishing a consumer's eligibility for any of the following:

(a)    credit to be used primarily for personal, family, or household purposes;

(b)    employment purposes means the use of a consumer report for the purpose of evaluating a consumer for employment, promotion, reassignment, or retention as an employee;

(c)    any other purpose authorized pursuant to 15 U.S.C. Section 168lb.

'Consumer report' or 'credit report' does not include a report containing information as to a transaction between the consumer and the person making the report; an authorization or approval by the issuer of a credit card or similar device, directly or indirectly, of a specific extension of credit; or a report in which a person conveys an adverse decision in response to a request from a third party to make a specific extension of credit, directly or indirectly, to the consumer, if the third party advises the consumer of the name and address of the person to whom the request was made and the person makes the required disclosures to the consumer pursuant to the provisions of the federal 'Fair Credit Reporting Act'.

(4)    'Credit card' has the same meaning as in Section 103 of the Truth in Lending Act, 15 U.S.C. Section 160 and includes a lender credit card, as defined in Section 37-1-301(16) and a seller credit card, as defined in Section 37-1-301(26).

(5)    'Creditworthiness' means an entry in a consumer's credit file that affects the ability of a consumer to obtain and retain credit, employment, business or professional licenses, investment opportunities, or insurance. Entries affecting creditworthiness include, but are not limited to, payment information, defaults, judgments, liens, bankruptcies, collections, records of arrest and indictments, and multiple credit inquiries.

(6)    'Debit card' means a card or device issued by a financial institution to a consumer for use in initiating an electronic fund transfer from the account holding assets of the consumer at that financial institution, for the purpose of transferring money between accounts or obtaining money, property, labor, or services.

(7)    'Disposal' means the:

(a)    discarding or abandonment of records containing personal identifying information; or

(b)    sale, donation, discarding, or transfer of any medium, including computer equipment or computer media, containing records of personal identifying information, other nonpaper media upon which records of personal identifying information are stored, or other equipment for nonpaper storage of information.

(8)    'Person' means an individual, sole proprietorship, partnership, corporation, trust, estate, cooperative, association, government or governmental subdivision or agency, or other entity.

(9)    'Personal identifying information' means an individual's first name or first initial and last name in combination with identifying information as defined in Section 16-13-510(C). 'Personal identifying information' does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, including name, address, and telephone number.

(10)    'Proper identification' means information generally considered sufficient to identify a person. If a person is unable reasonably to identify himself or herself with the information described in item (9), a consumer reporting agency may require additional information concerning the consumer's employment and personal or family history in order to verify the consumer's identity.

(11)    'Records' means material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

(12)    'Security breach' means an incident of unauthorized access to, and acquisition of, records or data containing personal identifying information that compromises the security, confidentiality, or integrity of personal identifying information maintained by a person. Good faith acquisition of personal identifying information by an employee or agent of the person for a legitimate purpose is not a security breach, if the personal identifying information is not used for a purpose other than a lawful purpose of the person and is not subject to further unauthorized disclosure.

(13)    'Security freeze' means a notice placed in a consumer credit report, at the request of the consumer and subject to certain exceptions, that prohibits the consumer credit-reporting agency from releasing a credit report containing all or any part of the consumer's credit report or any information derived from it without the express authorization of the consumer.

Section 37-20-20.    (A)    Except as provided in subsection (B) of this section, a person may not:

(1)    intentionally communicate or otherwise make available to the general public a consumer's social security number or a portion of it containing six digits or more;

(2)    intentionally print or imbed a consumer's social security number or any portion of it containing six digits or more on any card required for the consumer to access products or services provided by the person;

(3)    require a consumer to transmit his social security number or a portion of it containing six digits or more over the Internet, unless the connection is secure or the social security number is encrypted;

(4)    require a consumer to use his social security number or a portion of it containing six digits or more to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site;

(5)    print a consumer's social security number or a portion of it containing six digits or more on materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed;

(6)    sell, lease, loan, trade, rent, or otherwise intentionally disclose a consumer's social security number or a portion of it containing six digits or more to a third party without written consent to the disclosure from the consumer, unless the third party seeking disclosure of the social security number does so for a legitimate business purpose. A legitimate business purpose of the third party includes locating an individual to provide a benefit to that individual, such as a pension, insurance, or unclaimed property benefit, or to find an individual who is missing or a lost relative, or to serve civil process. A legitimate purpose of the third party does not include the bulk purchase or rental of social security numbers or use in marketing.

(B)    This section does not apply:

(1)    if a social security number is included in an application or in documents related to an enrollment process, or to establish an account, contract, or policy, or to confirm the accuracy of the social security number for the purpose of obtaining a credit report pursuant to the federal Fair Credit Reporting Act. A social security number that is permitted to be mailed pursuant to this section may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope or may not be visible on or through the envelope;

(2)    to the collection, use, or release of a social security number for internal verification or administrative purposes;

(3)    to the opening of an account or the provision of or payment for a product or service authorized by a consumer;

(4)    to the collection, use, or release of a social security number to investigate or prevent fraud, conduct background checks, conduct social or scientific research, collect a debt, or obtain a credit report from or furnish data to a consumer reporting agency, pursuant to the federal Fair Credit Reporting Act;

(5)    to a person acting pursuant to a court order, warrant, subpoena, or other legal process;

(6)    to a person providing the social security number to a federal, state, or local government entity, including a law enforcement agency or court, or their agents or assigns.

(C)    A violation of this section is a violation of Section 37-20-60.

Section 37-20-30.    (A)    A consumer who has reason to believe he is the victim of financial identify fraud, as evidenced by a copy of a valid police report, investigative report, or complaint made pursuant to Section 16-13-510, may place a security freeze on his credit report by making a request in writing by certified mail to a consumer credit-reporting agency. A security freeze prohibits the consumer credit-reporting agency from releasing the consumer's credit report or information from it without the express authorization of the consumer. If a security freeze is in place, a consumer credit-reporting agency may not release the consumer's credit report or information to a third party without prior express authorization from the consumer. This subsection does not prevent a consumer credit-reporting agency from advising a third party that a security freeze is in effect with respect to the consumer's credit report.

(B)    A consumer credit-reporting agency shall place a security freeze on a consumer's credit report no later than five business days after receiving a written request from the consumer.

(C)    The consumer credit-reporting agency shall send a written confirmation of the security freeze to the consumer within ten business days of placing the freeze and, at the same time, provide the consumer with a unique personal identification number or password, other than the consumer's social security number, to be used by the consumer when providing authorization for the release of the consumer's credit report for a specific period of time.

(D)    If the consumer wishes to allow the consumer's credit report to be accessed for a specific period of time while a freeze is in place, the consumer shall communicate to the consumer credit-reporting agency:

(1)    proper identification;

(2)    the unique personal identification number or password provided by the consumer credit-reporting agency pursuant to subsection (C) of this section;

(3)    the request that the freeze be lifted temporarily and proper information regarding the time period for which the report must be available to users of the credit report or to only a properly identified user.

(E)    A consumer credit-reporting agency may develop procedures involving the use of telephone, facsimile machine, the Internet, or another electronic medium to receive and process a request from a consumer to temporarily lift a freeze on a credit report pursuant to this section.

(F)    A consumer credit-reporting agency that receives a request from a consumer to lift temporarily a freeze on a credit report pursuant to this section shall comply with the request no later than three business days after receiving the request.

(G)    A consumer credit-reporting agency shall remove or lift temporarily a freeze placed on a consumer's credit report only:

(1)    upon the consumer's request, pursuant to this section;

(2)    if the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer. If a consumer credit-reporting agency intends to remove a freeze upon a consumer's credit report pursuant to this item, the consumer credit-reporting agency shall notify the consumer in writing five business days before removing the freeze on the consumer's credit report.

(H)    If a third party requests access to a consumer credit report on which a security freeze is in effect and this request is in connection with an application for credit or other use and the consumer does not allow the consumer's credit report to be accessed for that specific period of time, the third party may treat the application as incomplete.

(I)    If a consumer requests a security freeze pursuant to this section, the consumer credit-reporting agency shall disclose to the consumer the process for placing and temporarily lifting a security freeze and the process for allowing access to information from the consumer's credit report for a specific period of time while the security freeze is in place.

(J)    A security freeze must remain in place until the consumer requests that the security freeze be removed. A consumer credit-reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides:

(1)    proper identification;

(2)    the unique personal identification number or password provided by the consumer credit-reporting agency pursuant to subsection (C) of this section.

(K)    A consumer credit-reporting agency shall require proper identification of the person making a request to place or remove a security freeze.

(L)    If a security freeze is in place, a consumer credit-reporting agency may not change any of the following official information in a credit report without sending a written confirmation of the change to the consumer within thirty days of the change being posted to the consumer's file: name, date of birth, social security number, and address. Written confirmation is not required for technical modifications of a consumer's official information, including name and street abbreviations, complete spellings, or transposition of numbers or letters. In the case of an address change, the written confirmation must be sent to both the new address and the former address.

(M)    The provisions of this section do not apply to the use of a consumer credit report by a:

(1)    person, or the person's subsidiary, affiliate, agent, subcontractor, or assignee with which the consumer has, or before assignment had, an account, contract, or debtor-creditor relationship for the purposes of reviewing the account or collecting the financial obligation owing for the account, contract, or debt;

(2)    subsidiary, affiliate, agent, assignee, or prospective assignee of a person to whom access has been granted pursuant to subsection (D) of this section for purposes of facilitating the extension of credit or other permissible use;

(3)    person acting pursuant to a court order, warrant, or subpoena;

(4)    state or local agency, or its agents or assigns, which administers a program for establishing and enforcing child support obligations;

(5)    state or local agency, or its agents or assigns, acting to investigate fraud, including Medicaid fraud, or acting to investigate or collect delinquent taxes or assessments, including interest and penalties, unpaid court orders or to fulfill any of its other statutory responsibilities;

(6)    federal, state, or local governmental entity, including law enforcement agency or court, their agent or assigns;

(7)    person for the purposes of prescreening as defined by the federal Fair Credit Reporting Act;

(8)    person for the sole purpose of providing for a credit file monitoring subscription service to which the consumer has subscribed;

(9)    consumer reporting agency for the purpose of providing a consumer with a copy of the consumer's credit report upon the consumer's request;

(10)    depository financial institution for checking, savings, and investment accounts.

(N)    The following persons are not required to place in a credit report a security freeze pursuant to this section; except that any person exempt pursuant to the provisions of item (3) of this subsection is subject to a security freeze placed on a credit report by another consumer credit-reporting agency from which it obtains information:

(1)    a check services or fraud prevention services company, which reports on incidents of fraud or issues authorizations for the purpose of approving or processing negotiable instruments, electronic fund transfers, or similar methods of payments;

(2)    a deposit account information service company, which issues reports regarding account closures due to fraud, substantial overdrafts, ATM abuse, or other similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing a consumer request for a deposit account at the inquiring bank or financial institution;

(3)    a consumer reporting agency that:

(a)    acts only to resell credit information by assembling and merging information contained in a database of one or more credit-reporting agencies; and

(b)    does not maintain a permanent database of credit information from which new credit reports are produced.

(O)    A consumer credit-reporting agency may not charge a fee to a victim of identity theft who has submitted a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of the victim's personal identifying information by another person.

(P)    At any time that a consumer is required to receive a summary of rights required pursuant to Section 609 of the federal Fair Credit Reporting Act, the following notice must be included: 'South Carolina Consumers Have the Right to Obtain a Security Freeze. You have a right to place a security freeze on your credit report pursuant to South Carolina law. The security freeze prohibits a consumer credit-reporting agency from releasing information in your credit report without your express authorization. A security freeze must be requested in writing by certified mail. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gains access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of a later request or application you make regarding new loans, credit, mortgage, insurance, rental housing, employment, investment, license, cellular phone, utilities, digital signature, Internet credit card transactions, or other services, including an extension of credit at point of sale. You can remove a freeze or authorize temporary access for a specific period of time by contacting the consumer reporting agency and providing all of the following:

(1)    your personal identification number or password provided to you by the agency;

(2)    proper identification to verify your identity; and

(3)    proper information regarding the period of time you want your report available to users of the credit report. The consumer credit-reporting agency may not charge any amount to a victim of identify theft who has submitted a copy of a valid investigative or incident report or complaint with a law enforcement agency about the unlawful use of the victim's identifying information by another person. You have a right to bring a civil action against a consumer credit-reporting agency who violates your rights pursuant to the credit reporting laws.'

(Q)(1)    A consumer credit-reporting agency that wilfully violates a provision of this section is liable for three times the amount of actual damages or one thousand dollars for each incident, whichever is greater, as well as reasonable attorney's fees and costs.

(2)    A consumer credit-reporting agency that negligently violates this section is liable for the greater of actual damages or one thousand dollars for each incident, as well as reasonable attorney's fees and costs.

(3)    In addition to the damages assessed pursuant to items (1) and (2), if the injury is to the consumer's creditworthiness, credit standing, credit capacity, character, general reputation, employment options, or eligibility for insurance, and results from the failure to place and enforce the security freeze and the failure is not corrected by the consumer credit-reporting agency within ten days after the entry of a judgment for damages, the assessed damages must be increased to one thousand dollars each day until the security freeze is imposed.

Section 37-20-40.    (A)    A person conducting business in this State and owning, licensing, maintaining, or otherwise possessing personal identifying information of a consumer resident of this State, in any form, must take all reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal.

(B)    The reasonable measures must include:

(1)    implementing and monitoring compliance with policies and procedures that require:

(a)    burning, pulverizing, or shredding of papers containing personal identifying information so that information cannot be practicably read or reconstructed; and

(b)    destruction or erasure of electronic media and other nonpaper media containing personal identifying information so that the information cannot practicably be read or reconstructed; and

(2)    describing procedures relating to the adequate destruction or proper disposal of personal records as official policy in the writings of the business entity.

(C)    A person, after due diligence, may enter into a written contract with, and must monitor compliance by, another party engaged in the business of record destruction to destroy personal identifying information in a manner consistent with this section. Due diligence ordinarily includes one or more of the following:

(1)    reviewing an independent audit of the disposal business's operations or its compliance with this statute or its equivalent;

(2)    obtaining information about the disposal business from several references or other reliable sources and requiring that the disposal business be certified by a recognized trade association or similar third party with a reputation for high standards of quality review;

(3)    reviewing and evaluating the disposal business's information security policies or procedures or taking other appropriate measures to determine the competency and integrity of the disposal business.

(D)    A disposal business that conducts business in this State or disposes of personal identifying information of residents of this State must take all reasonable measures to dispose of records containing personal identifying information by implementing and monitoring compliance with policies and procedures that protect against unauthorized access to or use of personal identifying information during or after the collection and transportation and disposing of the information.

(E)    This section does not apply to:

(1)    a bank or financial institution that is subject to and in compliance with the privacy and security provision of the Gramm-Leach-Bliley Act;

(2)    a health insurer that is subject to and in compliance with the standards for privacy of individually identifiable health information and the security standards for the protection of electronic health information of the Health Insurance Portability and Accountability Act of 1996;

(3)    a consumer credit reporting agency that is subject to and in compliance with the federal Fair Credit Reporting Act.

(F)    A violation of this section is a violation of Section 37-20-60.

Section 37-20-50.    (A)    A person conducting business in this State owning, licensing, maintaining, or otherwise possessing personal identifying information of consumer residents of this State, in any form, must provide notice to the affected resident of a security breach following discovery or notification of the breach. The disclosure notification must be made without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (B) of this section, or with measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system.

(B)    The notice required by this section may be delayed if a law enforcement agency determines in writing that notification may impede a criminal investigation or jeopardize national or homeland security. The notice required by this section must be provided immediately after the law enforcement agency determines that notice will no longer impede the investigation or jeopardize national or homeland security.

(C)    The notice must be clear and conspicuous. The notice must include a description of the following:

(1)    the incident in general terms;

(2)    the type of consumer resident's personal identifying information that was subject to the unauthorized access and acquisition;

(3)    the acts of the person to protect the personal identifying information from further unauthorized access;

(4)    a telephone number that the consumer resident may call for further information and assistance;

(5)    advice that directs the consumer resident to remain vigilant over the next twelve to twenty-four months by reviewing account statements and monitoring free credit reports.

(D)    For purposes of this section, notice to affected consumer residents may be provided by one of the following methods:

(1)    written notice;

(2)    electronic notice, for those consumer residents for whom it has a valid e-mail address and who have agreed to receive communications electronically, if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing set forth in Section 7001 of Title 15 of the United State Code and Chapter 6 of Title 26 of the 1976 Code;

(3)    substitute notice, if the person demonstrates that the cost of providing notice would exceed two hundred fifty thousand dollars or that the affected class of subject consumer residents to be notified exceeds five hundred thousand, or if the person does not have sufficient contact information for only those affected consumer residents without sufficient contact information, or if the person is unable to identify particular affected consumer residents, for only those unidentifiable affected consumer residents. Substitute notice must consist of all the following:

(a)    e-mail notice when the person has an electronic mail address for the subject consumer residents;

(b)    conspicuous posting of the notice on the person's web site page, if one is maintained;

(c)    notification to major statewide media.

(E)    If a person provides notice to more than one thousand consumers residents at one time pursuant to this section, the person shall notify, without unreasonable delay, the South Carolina Department of Consumer Affairs and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis as defined in 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notice.

(F)    A financial institution that is subject to and in compliance with the Federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice, issued on March 7, 2005, by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision, and any revisions, additions, or substitutions relating to that interagency guidance, is considered to be in compliance with this section.

(G)    A violation of this section is a violation of Section 37-20-60.

Section 37-20-60.    Except as provided in Section 37-20-30(Q), a consumer whose property or person is injured by reason of an act made unlawful by this chapter may sue for civil damages in an amount of up to five thousand dollars, but no less than five hundred dollars for each incident, or three times the amount of actual damages, whichever amount is greater. A consumer seeking damages as set forth in this section also may institute a civil action to enjoin and restrain future acts that would constitute a violation of this chapter. The court, in an action brought pursuant to this chapter, may award reasonable attorney's fees and costs to the prevailing party.

Section 37-20-70.    The provisions of this chapter are cumulative, and an action taken pursuant to this chapter is not an election to take that action to the exclusion of other action authorized by law."

SECTION    3.    A.    Chapter 2 of Title 30 of the 1976 Code is redesignated as "Article 1, Family Privacy Protection Act".

B.    Chapter 2 of Title 30 of the 1976 Code is amended by adding:

"Article 3

Personal Identifying Information Privacy Protection

Section 30-2-300.    The General Assembly finds:

(1)    The social security number can be used as a tool to perpetuate fraud against an individual and to acquire sensitive personal, financial, medical, and familial information, the release of which could cause great financial or personal harm to the individual. While the social security number was intended to be used solely for the administration of the federal Social Security System, over time this unique numeric identifier has been used extensively for identity verification purposes and other legitimate consensual purposes.

(2)    Although there are legitimate reasons for State and local government entities to collect social security numbers and other personal identifying information from individuals, government should collect the information only for legitimate purposes or when required by law.

(3)    When State and local government entities possess social security numbers or other personal identifying information, the governments should minimize the instances this information is disseminated either internally within government or externally with the general public.

Section 30-2-310.    Except as provided in Sections 30-2-320 and 30-2-330 of this article, a public body, as defined in Section 30-1-10(B) may not:

(1)    collect a social security number or any portion of it containing six digits or more from an individual unless authorized by law to do so or unless the collection of the social security number is otherwise imperative for the performance of that body's duties and responsibilities as prescribed by law. Social security numbers collected by a public body must be relevant to the purpose for which collected and must not be collected until and unless the need for social security numbers has been clearly documented;

(2)    fail, when collecting a social security number or portion of it containing six digits or more from an individual, to segregate that number on a separate page from the rest of the record, or as otherwise appropriate, so that the social security number may be easily redacted pursuant to a public records request;

(3)    fail, when collecting a social security number or any portion of it containing six digits or more from an individual, to provide, at the time of or before the actual collection of the social security number by that public body, upon request of the individual, a statement of the purpose or purposes for which the social security number is being collected and used;

(4)    use the social security number or a portion of it containing six digits or more for any purpose other than the purpose stated;

(5)    intentionally communicate or otherwise make available to the general public an individual's social security number or a portion of it containing six digits or more or other personal identifying information. 'Personal identifying information', as used in this section, has the same meaning as 'identifying information' in Section 16-13-510, except that it does not include electronic identification names, including electronic mail addresses, or parent's legal surname before marriage;

(6)    intentionally print or imbed an individual's social security number or a portion of it containing six digits or more on any card required for the individual to access government services;

(7)    require an individual to transmit the individual's social security number or a portion of it containing six digits or more over the Internet, unless the connection is secure or the social security number is encrypted;

(8)    require an individual to use the individual's social security number or a portion of it containing six digits or more to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site;

(9)    print an individual's social security number or a portion of it containing six digits or more on materials that are mailed to the individual, unless state or federal law requires the social security number be on the mailed document.

Section 30-2-320.    Social security numbers and identifying information may be disclosed:

(1)    to another governmental entity or its agents, employees, or contractors, if disclosure is necessary for the receiving entity to perform its duties and responsibilities. The receiving governmental entity and its agents, employees, and contractors shall maintain the confidential and exempt status of those numbers;

(2)    pursuant to a court order, warrant, or subpoena;

(3)    for public health purposes;

(4)    on certified copies of vital records issued by the Director of the Department of Health and Environmental Control as the State Registrar, pursuant to Section 44-63-30 and authorized officials pursuant to Section 44-63-40. The State Registrar may disclose personal identifying information other than social security number on an uncertified vital record;

(5)    on a recorded document in the official records of the county;

(6)    on a document filed in the official records of the courts.

Section 30-2-330    (A)    A person preparing or filing a document to be recorded or filed in the official records by the register of deeds or the clerk of court of a county may not include an individual's social security, driver's license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code, or passwords in that document, unless otherwise expressly required by law or court order or rule adopted by the State Registrar on records of vital events. A loan closing instruction that requires the inclusion of an individual's social security number on a document to be recorded is void. A person who violates this subsection is guilty of a misdemeanor, punishable by a fine not to exceed five hundred dollars for each violation.

(B)    Notwithstanding Section 30-1-30, or another provision of law, an individual or his attorney-in-fact or legal guardian may request that a register of deeds or clerk of court remove, from an image or copy of an official record placed on a publicly available Internet web site or a publicly available Internet web site used by a register of deeds or court to display public records by the register of deeds or clerk of court, the individual's social security, driver's license, state identification, passport, checking account, savings account, credit card, debit card number, or personal identification (PIN) code or passwords contained in that official record. The request must be made in writing, legibly signed by the requester, and delivered by mail, facsimile, or electronic transmission, or delivered in person to the register of deeds or clerk of court. The request must specify the identification page number that contains the social security, driver's license, state identification, passport, checking account, savings account, credit card, debit card numbers, or personal identification (PIN) code or passwords to be redacted. The register of deeds or clerk of court has no duty to inquire beyond the written request to verify the identity of an individual requesting redaction. A fee must not be charged for the redaction pursuant to the request.

(C)    A register of deeds or clerk of court immediately and conspicuously shall post signs throughout his offices for public viewing and a notice on any Internet web site or remote electronic site made available by the register of deeds or clerk of court and used for the ordering or display of official records or images or copies of official records a notice, stating, in substantially similar form, the following:

'A person preparing or filing a document for recordation or filing in the official records may not include a social security, driver's license, state identification, passport, checking account, savings account, credit card, debit card number, or personal identification (PIN) code, or passwords in the document, unless expressly required by law. An individual has a right to request a register of deeds or clerk of court to remove, from an image or copy of an official record placed on a publicly available Internet web site or on a publicly available Internet web site used by a register of deeds or clerk of court to display public records, any social security, drivers license, state identification, passport, checking account, savings account, credit card, debit card number, or personal identification (PIN) code, or passwords contained in an official record. The request must be made in writing and delivered by mail, facsimile, or electronic transmission or in person, to the register of deeds or clerk of court. The request must specify the identification page number that contains the social security, driver's license, state identification, passport, checking account, savings account, credit card, debit card number, or personal identification (PIN) code, or passwords to be redacted. There is no fee for the redaction pursuant to request.'

Section 30-2-340.    Any affected individual may petition the court for an order directing compliance with this section. Liability may not accrue to a register of deeds or clerk of court or to his agents for claims or damages that arise from a social security number or other identifying information on the public record."

SECTION    4.    A.    Article 2, Chapter 13, Title 16 of the 1976 Code is amended by adding:

"Section 16-13-540.    (A)    If a person is named in a charge for an infraction or a crime, either a misdemeanor or a felony, as a result of another person using the identifying information of the named person the charge against the named person is dismissed, a finding of not guilty is entered, or the conviction is set aside, the named person may apply by petition or written motion to the court where the charge was last pending on a form approved by the Office of Court Administration and supplied by the clerk of court for an order to expunge from all official records entries relating to the person's apprehension, charge, or trial. The court, after notice to the county solicitor, shall hold a hearing on the motion or petition and, upon finding that the person's identity was used without permission and the charges were dismissed or the person was found not guilty, the court shall order the expunction.

Section 16-13-550.    (A)    A person who learns or reasonably suspects that he is the victim of financial identity fraud may contact the local law enforcement agency that has jurisdiction over the person's actual residence. If jurisdiction lies elsewhere for investigation and prosecution of a crime of financial identity fraud, the local law enforcement agency may take the complaint, issue an incident report, provide the complainant with a copy of the report, and refer the report to a law enforcement agency in that different jurisdiction.

(B)    This section does not interfere with the discretion of a local law enforcement agency to allocate resources for investigations of crimes. A complaint filed or report issued pursuant to this section is not required to be counted as an open case for purposes of compiling open case statistics."

B.    Sections 16-13-510 and 16-13-520 of the 1976 Code, both as added by Act 305 of 2000, are amended to read:

"Section 16-13-510.    (A)    It is unlawful for a person to commit the offense of financial identity fraud.

(B)    A person is guilty of financial identity fraud when he, without the authorization or permission of another person and with the intent of unlawfully appropriating the financial resources of that person to his own use or the use of a third party:

(1)    obtains or records identifying information which would assist in accessing the financial records of the other person; or

(2)    accesses or attempts to access the financial resources of the other person through the use of identifying information as defined in subsection (C);

(3)    knowingly obtains, possesses, or uses identifying information of another person, living or dead, with the intent to fraudulently represent that he is the other person for the purpose of:

(a)    making financial or credit transactions in the other person's name;

(b)    obtaining anything of value, benefit, or advantage;

(c)    avoiding legal consequences; or

(d)    obtaining employment.

(C)    'Identifying information' as used in this article includes the following:

(1)    social security numbers;

(2)    driver's license, state identification card, or passport numbers;

(3)    checking account numbers;

(4)    savings account numbers;

(5)    credit card numbers;

(6)    debit card numbers;

(7)    personal identification numbers (PIN);

(8)    electronic identification numbers, electronic mail, Internet accounts or Internet identification;

(9)    digital signatures; or

(10)    other numbers or information which may be used to access a person's financial resources;

(11)    biometric data;

(12)    fingerprints;

(13)    passwords;

(14)    parent's legal surname before marriage.

(D)    It is not a violation of this article for a person lawfully to:

(1)    obtain credit information in the course of a bona fide consumer or commercial transaction;

(2)    exercise, in good faith, a security interest or a right of offset by a creditor or financial institution;

(3)    comply, in good faith, with any warrant, court order, levy, garnishment, attachment, or other judicial or administrative order, decree, or directive, when the person is required to do so.

(D)(E)    A person who violates the provisions of this section article is guilty of a felony and, upon conviction, must be fined in the discretion of the court or imprisoned not more than ten years, or both. The court may order restitution to the victim pursuant to the provisions of Section 17-25-322.

Section 16-13-520.    In a criminal proceeding brought pursuant to this article, the crime is considered to have been committed in a the county in which a where the victim resides, where the perpetrator resides, where any part of the financial identity fraud took place, or in any other county instrumental to the completion of the offense, regardless of whether the defendant was ever actually present in that county."

SECTION    5.    Article 1, Chapter 1 of Title 11 of the 1976 Code is amended by adding:

"Section 1-11-490.    (A)    An agency of this State owning or licensing computerized data that includes personal identifying information shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of this State whose unencrypted personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (C), or with measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

(B)    An agency maintaining computerized data that includes personal identifying information that the agency does not own shall notify the owner or licensee of the information of a breach of the security of the data immediately following discovery, if the personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person.

(C)    The notification required by this section may be delayed if a law enforcement agency determines that the notification impedes a criminal investigation. The notification required by this section must be made after the law enforcement agency determines that it no longer compromises the investigation.

(D)    For purposes of this section:

(1)    'Agency' means any agency, department, board, commission, committee, or institution of higher learning of the State or a political subdivision of it.

(2)    'Breach of the security of the system' means unauthorized access to, and acquisition of, computerized data that compromises the security, confidentiality, or integrity of personal identifying information maintained by the agency. Good faith acquisition of personal identifying information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system if the personal identifying information is not used or subject to further unauthorized disclosure.

(3)    'Personal identifying information' has the same meaning as 'identifying information' in Section 16-13-510(C).

(E)    The notice required by this section may be provided by:

(1)    written notice;

(2)    electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code and Chapter 6 of Title 26 of the 1976 Code;

(3)    substitute notice, if the agency demonstrates that the cost of providing notice exceeds two hundred fifty thousand dollars or that the affected class of subject residents to be notified exceeds five hundred thousand or the agency has insufficient contact information. Substitute notice consists of:

(a)    e-mail notice when the agency has an e-mail address for the subject residents;

(b)    conspicuous posting of the notice on the agency's web site page, if the agency maintains one;

(c)    notification to major statewide media.

(F)    Notwithstanding subsection (E), an agency that maintains its own notification procedures as part of an information security policy for the treatment of personal identifying information and is otherwise consistent with the timing requirements of this section is considered to be in compliance with the notification requirements of this section if it notifies subject residents in accordance with its policies in the event of a breach of security of the system.

(G)    A resident of this State who is injured by a violation of this section, in addition to and cumulative of all other rights and remedies available at law, may:

(1)    institute a civil action to recover damages;

(2)    seek an injunction to enforce compliance;

(3)    recover attorney's fee and court costs, if successful."

SECTION    6.    The repeal or amendment by this act of any law, whether temporary or permanent or civil or criminal, does not affect pending actions, rights, duties, or liabilities founded thereon, or alter, discharge, release or extinguish any penalty, forfeiture, or liability incurred under the repealed or amended law, unless the repealed or amended provision shall so expressly provide. After the effective date of this act, all laws repealed or amended by this act must be taken and treated as remaining in full force and effect for the purpose of sustaining any pending or vested right, civil action, special proceeding, criminal prosecution, or appeal existing as of the effective date of this act, and for the enforcement of rights, duties, penalties, forfeitures, and liabilities as they stood under the repealed or amended laws.

SECTION    7.    If any section, subsection, paragraph, subparagraph, sentence, clause, phrase, or word of this act is for any reason held to be unconstitutional or invalid, such holding shall not affect the constitutionality or validity of the remaining portions of this act, the General Assembly hereby declaring that it would have passed this act, and each and every section, subsection, paragraph, subparagraph, sentence, clause, phrase, and word thereof, irrespective of the fact that any one or more other sections, subsections, paragraphs, subparagraphs, sentences, clauses, phrases, or words hereof may be declared to be unconstitutional, invalid, or otherwise ineffective.

SECTION    8.    This act is effective July 1, 2006, except that Section 37-20-20(A)(2), (3), (4), and (5), as enacted in Section 2 of this act, becomes effective January 1, 2006. Section 30-2-300(B)(6), (7), (8), and (9), as enacted in Section 3.B. of this act, becomes effective July 1, 2007. Section 4 of this act applies to offenses committed, and to causes of action arising, on or after July 1, 2006.

----XX----

This web page was last updated on Tuesday, June 23, 2009 at 2:35 P.M.