093_SB0553enr

 
SB553 Enrolled                       LRB093 10793 MKM 11219 b

 1        AN ACT concerning computer technology.

 2        Be  it  enacted  by  the People of the State of Illinois,
 3    represented in the General Assembly:

 4        Section 1.  Short title.  This Act may be  cited  as  the
 5    Data Security on State Computers Act.

 6        Section 5.  Findings. The General Assembly finds that:
 7        (a)  The  Massachusetts  Institute  of  Technology,  in a
 8    recent study, discovered that many companies and  individuals
 9    are  regularly  selling or donating computer hard drives with
10    sensitive information still on  them,  such  as  credit  card
11    numbers, bank and medical records, and personal e-mail.
12        (b)  Illinois   currently  has  no  law  addressing  data
13    security  and  removal  of  data  from  surplus   State-owned
14    computers  that  are to be (i) disposed of by sale, donation,
15    or transfer or (ii) relinquished  to  a  successor  executive
16    administration.
17        (c)  In  order  to  ensure  the  protection  of sensitive
18    information relating to the State and  its  citizens,  it  is
19    necessary  to  implement  policies  to (i) overwrite all hard
20    drives of  surplus  State-owned  electronic  data  processing
21    equipment  that  are  to be sold, donated, or transferred and
22    (ii)  preserve  the  data  on  State-owned  electronic   data
23    processing   equipment  that  is  to  be  relinquished  to  a
24    successor executive  administration  for  the  continuity  of
25    government functions.

26        Section  10.  Purpose.  The purpose of this Act is to (i)
27    require the Department of Central Management Services or  any
28    other  authorized  agency that disposes of surplus electronic
29    data processing equipment by sale, donation, or  transfer  to
30    implement  a  policy  mandating  that  computer  hardware  be
 
SB553 Enrolled             -2-       LRB093 10793 MKM 11219 b
 1    cleared  of  all  data  and software before disposal by sale,
 2    donation, or transfer and  (ii)  require  the  head  of  each
 3    Agency   to   establish  a  system  for  the  protection  and
 4    preservation of State data  on  State-owned  electronic  data
 5    processing   equipment   necessary   for  the  continuity  of
 6    government functions upon relinquishment of the equipment  to
 7    a successor executive administration.

 8        Section 15.  Definitions. As used in this Act:
 9        "Agency"  means all parts, boards, and commissions of the
10    executive branch of  State  government,  including,  but  not
11    limited   to,  State  colleges  and  universities  and  their
12    governing boards and all departments established by the Civil
13    Administrative Code of Illinois.
14        "Disposal by sale, donation, or transfer"  includes,  but
15    is not limited to, the sale, donation, or transfer of surplus
16    electronic  data  processing  equipment  to  other  agencies,
17    schools, individuals, and not-for-profit agencies.
18        "Electronic  data  processing equipment" includes, but is
19    not limited to, computer (CPU) mainframes, and  any  form  of
20    magnetic storage media.
21        "Authorized  agency"  means  an  agency authorized by the
22    Department of Central Management Services to sell or transfer
23    electronic data processing equipment under Sections 5010.1210
24    and 5010.1220 of Title  44  of  the  Illinois  Administrative
25    Code.
26        "Department"  means  the Department of Central Management
27    Services.
28        "Overwrite" means the replacement  of  previously  stored
29    information  with  a  pre-determined  pattern  of meaningless
30    information.

31        Section 20.  Establishment and implementation.  The  Data
32    Security  on  State  Computers  Act is established to protect
 
SB553 Enrolled             -3-       LRB093 10793 MKM 11219 b
 1    sensitive  data  stored  on   State-owned   electronic   data
 2    processing equipment to be (i) disposed of by sale, donation,
 3    or  transfer  or  (ii)  relinquished to a successor executive
 4    administration.  This  Act  shall  be  administered  by   the
 5    Department  or  an  authorized  agency.  The Department or an
 6    authorized agency shall implement a policy  to  mandate  that
 7    all   hard  drives  of  surplus  electronic  data  processing
 8    equipment be cleared of all data and  software  before  being
 9    prepared  for  sale, donation, or transfer by (i) overwriting
10    the previously stored data on a drive or a disk at  least  10
11    times  and  (ii)  certifying  in writing that the overwriting
12    process  has  been  completed  by  providing  the   following
13    information:  (1)  the serial number of the computer or other
14    surplus electronic data processing equipment; (2) the name of
15    the overwriting software used; and (3) the  name,  date,  and
16    signature  of  the person performing the overwriting process.
17    The head of each State agency shall establish  a  system  for
18    the  protection and preservation of State data on State-owned
19    electronic  data  processing  equipment  necessary  for   the
20    continuity of government functions upon it being relinquished
21    to a successor executive administration.

22        Section  50.   The  Public  Utilities  Act  is amended by
23    changing Section 13-301.3 as follows:

24        (220 ILCS 5/13-301.3)
25        (Section scheduled to be repealed on July 1, 2005)
26        Sec. 13-301.3. Digital Divide Elimination  Infrastructure
27    Program.
28        (a)  The  Digital  Divide Elimination Infrastructure Fund
29    is created as a special  fund  in  the  State  treasury.  All
30    moneys  in  the Fund shall be used, subject to appropriation,
31    by the Commission to  fund  the  construction  of  facilities
32    specified in Commission rules adopted under this Section. The
 
SB553 Enrolled             -4-       LRB093 10793 MKM 11219 b
 1    Commission  may  accept  private  and public funds, including
 2    federal  funds,  for  deposit   into   the   Fund.   Earnings
 3    attributable  to  moneys  in the Fund shall be deposited into
 4    the Fund.
 5        (b)  The Commission shall adopt rules under which it will
 6    make grants out of funds appropriated from the Digital Divide
 7    Elimination  Infrastructure  Fund  to  eligible  entities  as
 8    specified in the rules for  the  construction  of  high-speed
 9    data  transmission facilities in eligible areas of the State.
10    For purposes of determining whether an area  is  an  eligible
11    area,  the  Commission  shall  consider,  among other things,
12    whether  (i)  in  such  area,   advanced   telecommunications
13    services,  as  defined in subsection (c) of Section 13-517 of
14    this Act, are under-provided to residential or small business
15    end users, either directly or indirectly through an  Internet
16    Service  Provider,  (ii)  such  area  has  a  low  population
17    density,  and  (iii)  such  area  has  not  yet  developed  a
18    competitive market for advanced services.  In addition, if an
19    entity  seeking  a  grant  of  funds  from the Digital Divide
20    Elimination Infrastructure Fund is an for which the incumbent
21    local exchange carrier having the duty to  serve  such  area,
22    and  the obligation to provide advanced services to such area
23    pursuant to Section 13-517 of  this  Act,  the  entity  shall
24    demonstrate that it has sought and obtained an exemption from
25    such obligation pursuant to subsection (b) of Section 13-517.
26    Any  entity  seeking a grant of funds from the Digital Divide
27    Elimination Infrastructure  Fund  shall  demonstrate  to  the
28    Commission  that the grant shall be used for the construction
29    of high-speed data transmission  facilities  in  an  eligible
30    area   and   demonstrate   that   it   satisfies   all  other
31    requirements of the Commission's rules.  The Commission shall
32    determine the information that it deems  necessary  to  award
33    grants  pursuant  to  this  Section.  based upon a Commission
34    finding that provision of such advanced services to customers
 
SB553 Enrolled             -5-       LRB093 10793 MKM 11219 b
 1    in such area is either unduly economically burdensome or will
 2    impose a significant adverse  economic  impact  on  users  of
 3    telecommunications services generally.
 4        (c)  The  rules  of  the Commission shall provide for the
 5    competitive selection of recipients of grant funds  available
 6    from  the  Digital  Divide  Elimination  Infrastructure  Fund
 7    pursuant  to  the  Illinois Procurement Code. Grants shall be
 8    awarded to bidders  chosen  on  the  basis  of  the  criteria
 9    established in such rules.
10        (d)  All entities awarded grant moneys under this Section
11    shall  maintain  all  records required by Commission rule for
12    the period of time specified in the rules. Such records shall
13    be subject  to  audit  by  the  Commission,  by  any  auditor
14    appointed by the State, or by any State officer authorized to
15    conduct audits.
16    (Source: P.A. 92-22, eff. 6-30-01.)

17        Section  99.  Effective  date. This Act takes effect upon
18    becoming law.