093_SB0553enr SB553 Enrolled LRB093 10793 MKM 11219 b 1 AN ACT concerning computer technology. 2 Be it enacted by the People of the State of Illinois, 3 represented in the General Assembly: 4 Section 1. Short title. This Act may be cited as the 5 Data Security on State Computers Act. 6 Section 5. Findings. The General Assembly finds that: 7 (a) The Massachusetts Institute of Technology, in a 8 recent study, discovered that many companies and individuals 9 are regularly selling or donating computer hard drives with 10 sensitive information still on them, such as credit card 11 numbers, bank and medical records, and personal e-mail. 12 (b) Illinois currently has no law addressing data 13 security and removal of data from surplus State-owned 14 computers that are to be (i) disposed of by sale, donation, 15 or transfer or (ii) relinquished to a successor executive 16 administration. 17 (c) In order to ensure the protection of sensitive 18 information relating to the State and its citizens, it is 19 necessary to implement policies to (i) overwrite all hard 20 drives of surplus State-owned electronic data processing 21 equipment that are to be sold, donated, or transferred and 22 (ii) preserve the data on State-owned electronic data 23 processing equipment that is to be relinquished to a 24 successor executive administration for the continuity of 25 government functions. 26 Section 10. Purpose. The purpose of this Act is to (i) 27 require the Department of Central Management Services or any 28 other authorized agency that disposes of surplus electronic 29 data processing equipment by sale, donation, or transfer to 30 implement a policy mandating that computer hardware be SB553 Enrolled -2- LRB093 10793 MKM 11219 b 1 cleared of all data and software before disposal by sale, 2 donation, or transfer and (ii) require the head of each 3 Agency to establish a system for the protection and 4 preservation of State data on State-owned electronic data 5 processing equipment necessary for the continuity of 6 government functions upon relinquishment of the equipment to 7 a successor executive administration. 8 Section 15. Definitions. As used in this Act: 9 "Agency" means all parts, boards, and commissions of the 10 executive branch of State government, including, but not 11 limited to, State colleges and universities and their 12 governing boards and all departments established by the Civil 13 Administrative Code of Illinois. 14 "Disposal by sale, donation, or transfer" includes, but 15 is not limited to, the sale, donation, or transfer of surplus 16 electronic data processing equipment to other agencies, 17 schools, individuals, and not-for-profit agencies. 18 "Electronic data processing equipment" includes, but is 19 not limited to, computer (CPU) mainframes, and any form of 20 magnetic storage media. 21 "Authorized agency" means an agency authorized by the 22 Department of Central Management Services to sell or transfer 23 electronic data processing equipment under Sections 5010.1210 24 and 5010.1220 of Title 44 of the Illinois Administrative 25 Code. 26 "Department" means the Department of Central Management 27 Services. 28 "Overwrite" means the replacement of previously stored 29 information with a pre-determined pattern of meaningless 30 information. 31 Section 20. Establishment and implementation. The Data 32 Security on State Computers Act is established to protect SB553 Enrolled -3- LRB093 10793 MKM 11219 b 1 sensitive data stored on State-owned electronic data 2 processing equipment to be (i) disposed of by sale, donation, 3 or transfer or (ii) relinquished to a successor executive 4 administration. This Act shall be administered by the 5 Department or an authorized agency. The Department or an 6 authorized agency shall implement a policy to mandate that 7 all hard drives of surplus electronic data processing 8 equipment be cleared of all data and software before being 9 prepared for sale, donation, or transfer by (i) overwriting 10 the previously stored data on a drive or a disk at least 10 11 times and (ii) certifying in writing that the overwriting 12 process has been completed by providing the following 13 information: (1) the serial number of the computer or other 14 surplus electronic data processing equipment; (2) the name of 15 the overwriting software used; and (3) the name, date, and 16 signature of the person performing the overwriting process. 17 The head of each State agency shall establish a system for 18 the protection and preservation of State data on State-owned 19 electronic data processing equipment necessary for the 20 continuity of government functions upon it being relinquished 21 to a successor executive administration. 22 Section 50. The Public Utilities Act is amended by 23 changing Section 13-301.3 as follows: 24 (220 ILCS 5/13-301.3) 25 (Section scheduled to be repealed on July 1, 2005) 26 Sec. 13-301.3. Digital Divide Elimination Infrastructure 27 Program. 28 (a) The Digital Divide Elimination Infrastructure Fund 29 is created as a special fund in the State treasury. All 30 moneys in the Fund shall be used, subject to appropriation, 31 by the Commission to fund the construction of facilities 32 specified in Commission rules adopted under this Section. The SB553 Enrolled -4- LRB093 10793 MKM 11219 b 1 Commission may accept private and public funds, including 2 federal funds, for deposit into the Fund. Earnings 3 attributable to moneys in the Fund shall be deposited into 4 the Fund. 5 (b) The Commission shall adopt rules under which it will 6 make grants out of funds appropriated from the Digital Divide 7 Elimination Infrastructure Fund to eligible entities as 8 specified in the rules for the construction of high-speed 9 data transmission facilities in eligible areas of the State. 10 For purposes of determining whether an area is an eligible 11 area, the Commission shall consider, among other things, 12 whether (i) in such area, advanced telecommunications 13 services, as defined in subsection (c) of Section 13-517 of 14 this Act, are under-provided to residential or small business 15 end users, either directly or indirectly through an Internet 16 Service Provider, (ii) such area has a low population 17 density, and (iii) such area has not yet developed a 18 competitive market for advanced services. In addition, if an 19 entity seeking a grant of funds from the Digital Divide 20 Elimination Infrastructure Fund is anfor which theincumbent 21 local exchange carrier having the duty to serve such area, 22 and the obligation to provide advanced services to such area 23 pursuant to Section 13-517 of this Act, the entity shall 24 demonstrate that it has sought and obtained an exemption from 25 such obligation pursuant to subsection (b) of Section 13-517. 26 Any entity seeking a grant of funds from the Digital Divide 27 Elimination Infrastructure Fund shall demonstrate to the 28 Commission that the grant shall be used for the construction 29 of high-speed data transmission facilities in an eligible 30 area and demonstrate that it satisfies all other 31 requirements of the Commission's rules. The Commission shall 32 determine the information that it deems necessary to award 33 grants pursuant to this Section.based upon a Commission34finding that provision of such advanced services to customersSB553 Enrolled -5- LRB093 10793 MKM 11219 b 1in such area is either unduly economically burdensome or will2impose a significant adverse economic impact on users of3telecommunications services generally.4 (c) The rules of the Commission shall provide for the 5 competitive selection of recipients of grant funds available 6 from the Digital Divide Elimination Infrastructure Fund 7 pursuant to the Illinois Procurement Code. Grants shall be 8 awarded to bidders chosen on the basis of the criteria 9 established in such rules. 10 (d) All entities awarded grant moneys under this Section 11 shall maintain all records required by Commission rule for 12 the period of time specified in the rules. Such records shall 13 be subject to audit by the Commission, by any auditor 14 appointed by the State, or by any State officer authorized to 15 conduct audits. 16 (Source: P.A. 92-22, eff. 6-30-01.) 17 Section 99. Effective date. This Act takes effect upon 18 becoming law.