(5 ILCS 179/37)

Sec. 37. Identity-protection policy; State.

(a) Each State agency must draft and approve an identity-protection policy within 12 months after the effective date of this Act. The policy must do all of the following:

(1) Identify this Act.

(2) Require all employees of the State agency identified as having access to social security numbers in the course of performing their duties to be trained to protect the confidentiality of social security numbers. Training should include instructions on proper handling of information that contains social security numbers from the time of collection through the destruction of the information.

(3) Direct that only employees who are required to use or handle information or documents that contain social security numbers have access to such information or documents.

(4) Require that social security numbers requested from an individual be placed in a manner that makes the social security number easily redacted if required to be released as part of a public records request.

(5) Require that, when collecting a social security number or upon request by the individual, a statement of the purpose or purposes for which the agency is collecting and using the social security number be provided.

(b) Each State agency must provide a copy of its identity-protection policy to the Social Security Number Protection Task Force within 30 days after the approval of the policy.

(c) Each State agency must implement the components of its identity-protection policy that are necessary to meet the requirements of this Act within 12 months after the date the identity-protection policy is approved. This subsection (c) shall not affect the requirements of Section 10 of this Act.

(Source: P.A. 96-874, eff. 6-1-10.)