HB4259 94TH GENERAL ASSEMBLY

LRB094 15649 MKM 50856 b

94TH GENERAL ASSEMBLY
State of Illinois
2005 and 2006
HB4259

Introduced 12/16/05, by Rep. Ruth Munson

SYNOPSIS AS INTRODUCED:

15 ILCS 305/25 new
815 ILCS 505/2RR
5 ILCS 140/7	from Ch. 116, par. 207
30 ILCS 805/8.30 new

Amends the Secretary of State Act. Establishes a Unique Identification Number Task Force to explore the technical and procedural changes that are needed in order to implement a unique identification number system to replace the use of social security numbers by State and local government agencies. Amends the Consumer Fraud and Deceptive Business Practices Act. Makes it an unlawful practice for a State or local government agency to use an individual's social security number in certain ways, subject to various exceptions. Requires each State or local government agency to develop and implement a social security number privacy policy by January 1, 2007. Prohibits a State or local government agency from requesting an individual's social security number unless specifically authorized to do so under State or federal law. Provides that any person who knowingly violates the provisions regulating the use of social security numbers is guilty of a Class B misdemeanor. Makes other changes. Amends the Freedom of Information Act. Provides that information or documents containing all or any portion of an individual's social security number are exempt from disclosure under the Freedom of Information Act, except to the extent authorized under certain provisions of the Consumer Fraud and Deceptive Business Practices Act. Preempts home rule powers. Amends the State Mandates Act to require implementation without reimbursement by the State. Effective July 1, 2006.

CORRECTIONAL BUDGET AND IMPACT NOTE ACT MAY APPLY	FISCAL NOTE ACT MAY APPLY	HOME RULE NOTE ACT MAY APPLY
	STATE MANDATES ACT MAY REQUIRE REIMBURSEMENT MAY APPLY

A BILL FOR

AN ACT concerning privacy.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Secretary of State Act is amended by adding Section 25 as follows:

(15 ILCS 305/25 new)

Sec. 25. Unique Identification Number Task Force.

(a) As used in this Section:

"Local government agencies" means that term as it is defined in Section 1-8 of the Illinois State Auditing Act.

"State agencies" means that term as it is defined in Section 1-7 of the Illinois State Auditing Act.

(b) The Unique Identification Number Task Force is established within the Office of the Secretary of State. The Task Force shall consist of 5 members appointed by the Secretary of State. The members of the Task Force shall select a chairperson. Members of the Task Force shall receive no compensation but shall be reimbursed for necessary expenses incurred in the performance of their duties.

(c) The Task Force shall explore the technical and procedural changes that are necessary in order to implement a unique identification number system to replace the use of social security numbers by State and local government agencies for identification and record-keeping purposes. The Task Force shall identify other states and local governments that have implemented a unique identification number system and make recommendations and devise procedures for creating a Statewide unique identification number program.

(d) The Task Force shall submit reports to the Secretary of State, the General Assembly, and the Governor by December 31 of each year.

Section 10. The Consumer Fraud and Deceptive Business Practices Act is amended by changing and re-numbering Section 2QQ as follows:

(815 ILCS 505/2RR)

(This Section may contain text from a Public Act with a delayed effective date)

Sec. 2RR 2QQ. Use of Social Security numbers.

For the purposes of this Section:

"Local government agency" means that term as it is defined in Section 1-8 of the Illinois State Auditing Act.

"Person" means that term as it is defined in this Act and also includes any individual in the employ of a State agency or local government agency.

"State agency" means that term as it is defined in Section 1-7 of the Illinois State Auditing Act.

(a) Except as otherwise provided in this Section, no a person or State or local government agency may not do any of the following:

(1) Publicly post or publicly display in any manner more than the last 4 sequential digits of an individual's social security number. As used in this Section, "publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public.

(2) Print more than the last 4 sequential digits of an individual's social security number on any card required for the individual to access products or services provided by the person or entity; however, a person or entity that provides an insurance card must print on the card an identification number unique to the holder of the card in the format prescribed by Section 15 of the Uniform Prescription Drug Information Card Act.

(3) Require an individual to transmit more than the last 4 sequential digits of his or her social security number over the Internet, unless the connection is secure or the social security number is encrypted.

(4) Require an individual to use more than the last 4 sequential digits of his or her social security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site.

(5) Print more than the last 4 sequential digits of an individual's social security number on any materials that are mailed to the individual, unless State or federal law requires more than the last 4 sequential digits of the social security number to be on the document to be mailed. Notwithstanding any provision in this Section to the contrary, social security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process or to establish, amend, or terminate an account, contract, or policy or to confirm the accuracy of the social security number. A social security number that may permissibly be mailed under this Section may not be printed, in whole or in part, on a postcard or other mailer that does not require an envelope or be visible on an envelope or visible without the envelope having been opened.

(b) A person or State or local government agency that used, before July 1, 2005, an individual's social security number in a manner inconsistent with subsection (a) may continue using that individual's social security number in the same manner on or after July 1, 2005 if all of the following conditions are met:

(1) The use of the social security number is continuous. If the use is stopped for any reason, subsection (a) shall apply.

(2) The individual is provided an annual disclosure that informs the individual that he or she has the right to stop the use of his or her social security number in a manner prohibited by subsection (a).

A written request by an individual to stop the use of his or her social security number in a manner prohibited by subsection (a) shall be implemented within 30 days of the receipt of the request. There shall be no fee or charge for implementing the request. No A person or State or local government agency shall not deny services to an individual because the individual makes such a written request.

(c) This Section does not apply to the collection, use, or release of a social security number as required by State or federal law or the use of a social security number for internal verification or administrative purposes. This Section does not apply to the collection, use, or release of a social security number by the State, a subdivision of the State, or an individual in the employ of the State or a subdivision of the State in connection with his or her official duties.

(d) This Section does not apply to documents that are recorded or required to be open to the public under State or federal law, applicable case law, Supreme Court Rule, or the Constitution of the State of Illinois.

(e) If a federal law takes effect requiring the United States Department of Health and Human Services to establish a national unique patient health identifier program, any person who complies with the federal law shall be deemed to be in compliance with this Section.

(f) No A person or State or local government agency may not encode or embed more than the last 4 sequential digits of a social security number in or on a card or document, including, but not limited to, using a bar code, chip, magnetic strip, or other technology, in place of removing the social security number as required by this Section.

(f-5) Each State agency and local government agency must establish a social security number privacy policy and must implement that policy on or before January 1, 2007. The privacy policy must do all of the following:

(1) Require all employees of the State or local government agency to be trained to protect the confidentiality of social security numbers and to understand the requirements of this Section.

(2) Prohibit the unlawful disclosure of social security numbers.

(3) Limit the number of employees who have access to information or documents that contain social security numbers.

(4) Describe how to properly dispose of information and documents that contain social security numbers.

(5) Establish penalties for violation of the privacy policy.

Each State agency must file a written copy of its privacy policy with the Clerk of the House of Representatives and the Secretary of the Senate. Each local government agency must file a written copy of its privacy policy with the governing board of the unit of local government. Each State or local government agency must also provide a written copy of the policy to each of its employees, and must also make its privacy policy available to any member of the public, upon request. If a State or local government agency amends its privacy policy, then that agency must file a written copy of the amended policy with the appropriate entity and must also provide each of its employee with a new written copy of the amended policy.

(f-10) A State or local government agency may not request an individual's social security number unless authorized to do so under State or federal law. Any request by a public entity for an individual's social security number must include a citation to the State or federal law authorizing the State or local government agency to request the social security number.

(g) Any person who violates this Section commits an unlawful practice within the meaning of this Act. In addition, any person who knowingly violates this Act is guilty of a Class B misdemeanor.

(h) A home rule unit may not regulate the use of social security numbers in a manner that is inconsistent with this Section. This Section is a limitation under subsection (i) of Section 6 of Article VII of the Illinois Constitution on the concurrent exercise by home rule units of powers and functions exercised by the State.

(Source: P.A. 93-739, eff. 7-1-06; revised 11-10-04.)

Section 15. The Freedom of Information Act is amended by changing Section 7 as follows:

(5 ILCS 140/7) (from Ch. 116, par. 207)

Sec. 7. Exemptions.

(1) The following shall be exempt from inspection and copying:

(a) Information specifically prohibited from disclosure by federal or State law or rules and regulations adopted under federal or State law.

(b) Information that, if disclosed, would constitute a clearly unwarranted invasion of personal privacy, unless the disclosure is consented to in writing by the individual subjects of the information. The disclosure of information that bears on the public duties of public employees and officials shall not be considered an invasion of personal privacy. Information exempted under this subsection (b) shall include but is not limited to:

(i) files and personal information maintained with respect to clients, patients, residents, students or other individuals receiving social, medical, educational, vocational, financial, supervisory or custodial care or services directly or indirectly from federal agencies or public bodies;

(ii) personnel files and personal information maintained with respect to employees, appointees or elected officials of any public body or applicants for those positions;

(iii) files and personal information maintained with respect to any applicant, registrant or licensee by any public body cooperating with or engaged in professional or occupational registration, licensure or discipline;

(iv) information required of any taxpayer in connection with the assessment or collection of any tax unless disclosure is otherwise required by State statute;

(v) information revealing the identity of persons who file complaints with or provide information to administrative, investigative, law enforcement or penal agencies; provided, however, that identification of witnesses to traffic accidents, traffic accident reports, and rescue reports may be provided by agencies of local government, except in a case for which a criminal investigation is ongoing, without constituting a clearly unwarranted per se invasion of personal privacy under this subsection; and

(vi) the names, addresses, or other personal information of participants and registrants in park district, forest preserve district, and conservation district programs.

(c) Records compiled by any public body for administrative enforcement proceedings and any law enforcement or correctional agency for law enforcement purposes or for internal matters of a public body, but only to the extent that disclosure would:

(i) interfere with pending or actually and reasonably contemplated law enforcement proceedings conducted by any law enforcement or correctional agency;

(ii) interfere with pending administrative enforcement proceedings conducted by any public body;

(iii) deprive a person of a fair trial or an impartial hearing;

(iv) unavoidably disclose the identity of a confidential source or confidential information furnished only by the confidential source;

(v) disclose unique or specialized investigative techniques other than those generally used and known or disclose internal documents of correctional agencies related to detection, observation or investigation of incidents of crime or misconduct;

(vi) constitute an invasion of personal privacy under subsection (b) of this Section;

(vii) endanger the life or physical safety of law enforcement personnel or any other person; or

(viii) obstruct an ongoing criminal investigation.

(d) Criminal history record information maintained by State or local criminal justice agencies, except the following which shall be open for public inspection and copying:

(i) chronologically maintained arrest information, such as traditional arrest logs or blotters;

(ii) the name of a person in the custody of a law enforcement agency and the charges for which that person is being held;

(iii) court records that are public;

(iv) records that are otherwise available under State or local law; or

(v) records in which the requesting party is the individual identified, except as provided under part (vii) of paragraph (c) of subsection (1) of this Section.

"Criminal history record information" means data identifiable to an individual and consisting of descriptions or notations of arrests, detentions, indictments, informations, pre-trial proceedings, trials, or other formal events in the criminal justice system or descriptions or notations of criminal charges (including criminal violations of local municipal ordinances) and the nature of any disposition arising therefrom, including sentencing, court or correctional supervision, rehabilitation and release. The term does not apply to statistical records and reports in which individuals are not identified and from which their identities are not ascertainable, or to information that is for criminal investigative or intelligence purposes.

(e) Records that relate to or affect the security of correctional institutions and detention facilities.

(f) Preliminary drafts, notes, recommendations, memoranda and other records in which opinions are expressed, or policies or actions are formulated, except that a specific record or relevant portion of a record shall not be exempt when the record is publicly cited and identified by the head of the public body. The exemption provided in this paragraph (f) extends to all those records of officers and agencies of the General Assembly that pertain to the preparation of legislative documents.

(g) Trade secrets and commercial or financial information obtained from a person or business where the trade secrets or information are proprietary, privileged or confidential, or where disclosure of the trade secrets or information may cause competitive harm, including:

(i) All information determined to be confidential under Section 4002 of the Technology Advancement and Development Act.

(ii) All trade secrets and commercial or financial information obtained by a public body, including a public pension fund, from a private equity fund or a privately held company within the investment portfolio of a private equity fund as a result of either investing or evaluating a potential investment of public funds in a private equity fund. The exemption contained in this item does not apply to the aggregate financial performance information of a private equity fund, nor to the identity of the fund's managers or general partners. The exemption contained in this item does not apply to the identity of a privately held company within the investment portfolio of a private equity fund, unless the disclosure of the identity of a privately held company may cause competitive harm.

Nothing contained in this paragraph (g) shall be construed to prevent a person or business from consenting to disclosure.

(h) Proposals and bids for any contract, grant, or agreement, including information which if it were disclosed would frustrate procurement or give an advantage to any person proposing to enter into a contractor agreement with the body, until an award or final selection is made. Information prepared by or for the body in preparation of a bid solicitation shall be exempt until an award or final selection is made.

(i) Valuable formulae, computer geographic systems, designs, drawings and research data obtained or produced by any public body when disclosure could reasonably be expected to produce private gain or public loss. The exemption for "computer geographic systems" provided in this paragraph (i) does not extend to requests made by news media as defined in Section 2 of this Act when the requested information is not otherwise exempt and the only purpose of the request is to access and disseminate information regarding the health, safety, welfare, or legal rights of the general public.

(j) Test questions, scoring keys and other examination data used to administer an academic examination or determined the qualifications of an applicant for a license or employment.

(k) Architects' plans, engineers' technical submissions, and other construction related technical documents for projects not constructed or developed in whole or in part with public funds and the same for projects constructed or developed with public funds, but only to the extent that disclosure would compromise security, including but not limited to water treatment facilities, airport facilities, sport stadiums, convention centers, and all government owned, operated, or occupied buildings.

(l) Library circulation and order records identifying library users with specific materials.

(m) Minutes of meetings of public bodies closed to the public as provided in the Open Meetings Act until the public body makes the minutes available to the public under Section 2.06 of the Open Meetings Act.

(n) Communications between a public body and an attorney or auditor representing the public body that would not be subject to discovery in litigation, and materials prepared or compiled by or for a public body in anticipation of a criminal, civil or administrative proceeding upon the request of an attorney advising the public body, and materials prepared or compiled with respect to internal audits of public bodies.

(o) Information received by a primary or secondary school, college or university under its procedures for the evaluation of faculty members by their academic peers.

(p) Administrative or technical information associated with automated data processing operations, including but not limited to software, operating protocols, computer program abstracts, file layouts, source listings, object modules, load modules, user guides, documentation pertaining to all logical and physical design of computerized systems, employee manuals, and any other information that, if disclosed, would jeopardize the security of the system or its data or the security of materials exempt under this Section.

(q) Documents or materials relating to collective negotiating matters between public bodies and their employees or representatives, except that any final contract or agreement shall be subject to inspection and copying.

(r) Drafts, notes, recommendations and memoranda pertaining to the financing and marketing transactions of the public body. The records of ownership, registration, transfer, and exchange of municipal debt obligations, and of persons to whom payment with respect to these obligations is made.

(s) The records, documents and information relating to real estate purchase negotiations until those negotiations have been completed or otherwise terminated. With regard to a parcel involved in a pending or actually and reasonably contemplated eminent domain proceeding under Article VII of the Code of Civil Procedure, records, documents and information relating to that parcel shall be exempt except as may be allowed under discovery rules adopted by the Illinois Supreme Court. The records, documents and information relating to a real estate sale shall be exempt until a sale is consummated.

(t) Any and all proprietary information and records related to the operation of an intergovernmental risk management association or self-insurance pool or jointly self-administered health and accident cooperative or pool.

(u) Information concerning a university's adjudication of student or employee grievance or disciplinary cases, to the extent that disclosure would reveal the identity of the student or employee and information concerning any public body's adjudication of student or employee grievances or disciplinary cases, except for the final outcome of the cases.

(v) Course materials or research materials used by faculty members.

(w) Information related solely to the internal personnel rules and practices of a public body.

(x) Information contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of a public body responsible for the regulation or supervision of financial institutions or insurance companies, unless disclosure is otherwise required by State law.

(y) Information the disclosure of which is restricted under Section 5-108 of the Public Utilities Act.

(z) Manuals or instruction to staff that relate to establishment or collection of liability for any State tax or that relate to investigations by a public body to determine violation of any criminal law.

(aa) Applications, related documents, and medical records received by the Experimental Organ Transplantation Procedures Board and any and all documents or other records prepared by the Experimental Organ Transplantation Procedures Board or its staff relating to applications it has received.

(bb) Insurance or self insurance (including any intergovernmental risk management association or self insurance pool) claims, loss or risk management information, records, data, advice or communications.

(cc) Information and records held by the Department of Public Health and its authorized representatives relating to known or suspected cases of sexually transmissible disease or any information the disclosure of which is restricted under the Illinois Sexually Transmissible Disease Control Act.

(dd) Information the disclosure of which is exempted under Section 30 of the Radon Industry Licensing Act.

(ee) Firm performance evaluations under Section 55 of the Architectural, Engineering, and Land Surveying Qualifications Based Selection Act.

(ff) Security portions of system safety program plans, investigation reports, surveys, schedules, lists, data, or information compiled, collected, or prepared by or for the Regional Transportation Authority under Section 2.11 of the Regional Transportation Authority Act or the St. Clair County Transit District under the Bi-State Transit Safety Act.

(gg) Information the disclosure of which is restricted and exempted under Section 50 of the Illinois Prepaid Tuition Act.

(hh) Information the disclosure of which is exempted under the State Officials and Employees Ethics Act.

(ii) Beginning July 1, 1999, information that would disclose or might lead to the disclosure of secret or confidential information, codes, algorithms, programs, or private keys intended to be used to create electronic or digital signatures under the Electronic Commerce Security Act.

(jj) Information contained in a local emergency energy plan submitted to a municipality in accordance with a local emergency energy plan ordinance that is adopted under Section 11-21.5-5 of the Illinois Municipal Code.

(kk) Information and data concerning the distribution of surcharge moneys collected and remitted by wireless carriers under the Wireless Emergency Telephone Safety Act.

(ll) Vulnerability assessments, security measures, and response policies or plans that are designed to identify, prevent, or respond to potential attacks upon a community's population or systems, facilities, or installations, the destruction or contamination of which would constitute a clear and present danger to the health or safety of the community, but only to the extent that disclosure could reasonably be expected to jeopardize the effectiveness of the measures or the safety of the personnel who implement them or the public. Information exempt under this item may include such things as details pertaining to the mobilization or deployment of personnel or equipment, to the operation of communication systems or protocols, or to tactical operations.

(mm) Maps and other records regarding the location or security of a utility's generation, transmission, distribution, storage, gathering, treatment, or switching facilities.

(nn) Law enforcement officer identification information or driver identification information compiled by a law enforcement agency or the Department of Transportation under Section 11-212 of the Illinois Vehicle Code.

(oo) Records and information provided to a residential health care facility resident sexual assault and death review team or the Residential Health Care Facility Resident Sexual Assault and Death Review Teams Executive Council under the Residential Health Care Facility Resident Sexual Assault and Death Review Team Act.

(pp) Information provided to the predatory lending database created pursuant to Article 3 of the Residential Real Property Disclosure Act, except to the extent authorized under that Article.

(qq) (pp) Defense budgets and petitions for certification of compensation and expenses for court appointed trial counsel as provided under Sections 10 and 15 of the Capital Crimes Litigation Act. This subsection (qq) (pp) shall apply until the conclusion of the trial and appeal of the case, even if the prosecution chooses not to pursue the death penalty prior to trial or sentencing.

(rr) Information or documents containing all or any portion of an individual's social security number, except to the extent authorized under Section 2RR of the Consumer Fraud and Deceptive Business Practices Act.

(2) This Section does not authorize withholding of information or limit the availability of records to the public, except as stated in this Section or otherwise provided in this Act.

(Source: P.A. 93-43, eff. 7-1-03; 93-209, eff. 7-18-03; 93-237, eff. 7-22-03; 93-325, eff. 7-23-03, 93-422, eff. 8-5-03; 93-577, eff. 8-21-03; 93-617, eff. 12-9-03; 94-280, eff. 1-1-06; 94-508, eff. 1-1-06; 94-664, eff. 1-1-06; revised 8-29-05.)

Section 90. The State Mandates Act is amended by adding Section 8.30 as follows:

(30 ILCS 805/8.30 new)

Sec. 8.30. Exempt mandate. Notwithstanding Sections 6 and 8 of this Act, no reimbursement by the State is required for the implementation of any mandate created by this amendatory Act of the 94th General Assembly.

Section 99. Effective date. This Act takes effect July 1, 2006.