AN ACT to amend the Indiana Code concerning state offices and administration and local
government.
violation of this chapter commits a Class D felony.
Sec. 9. A person who knowingly, intentionally, or recklessly
makes a false representation to a state agency to obtain a Social
Security number from the state agency commits a Class D felony.
Sec. 10. An employee of a state agency who negligently discloses
a Social Security number in violation of this chapter commits a
Class A infraction.
Sec. 11. (a) The attorney general may investigate any allegation
that a Social Security number was disclosed in violation of this
chapter.
(b) If the attorney general determines that there is evidence that
a state employee committed a criminal act under section 8 or 9 of
this chapter, the attorney general shall report the attorney
general's findings to:
(1) the prosecuting attorney in the county where the criminal
act occurred; and
(2) the state police department.
Sec. 12. If the attorney general determines that there is evidence
that a state employee committed an infraction under section 10 of
this chapter, the attorney general:
(1) shall report the attorney general's findings to the
appointing authority (as defined in IC 4-2-6-1) of the agency
that employs the employee; and
(2) may report the attorney general's findings to the local
prosecuting attorney in the county where the infraction
occurred.
Sec. 13. The attorney general may adopt rules under IC 4-22-2
that the attorney general considers necessary to carry out this
chapter.
unauthorized disclosure.
(2) Unauthorized acquisition of a portable electronic device on
which personal information is stored if access to the device is
protected by a password that has not been disclosed.
Sec. 3. (a) As used in this chapter, "personal information"
means:
(1) an individual's:
(A) first name and last name; or
(B) first initial and last name; and
(2) at least one (1) of the following data elements:
(A) Social Security number.
(B) Driver's license number or identification card number.
(C) Account number, credit card number, debit card
number, security code, access code, or password of an
individual's financial account.
(b) The term does not include the following:
(1) The last four (4) digits of an individual's Social Security
number.
(2) Publicly available information that is lawfully made
available to the public from records of a federal agency or
local agency.
Sec. 4. As used in this section "state agency" has the meaning set
forth in IC 4-1-10-2.
Sec. 5. (a) Any state agency that owns or licenses computerized
data that includes personal information shall disclose a breach of
the security of the system following discovery or notification of the
breach to any state resident whose unencrypted personal
information was or is reasonably believed to have been acquired by
an unauthorized person.
(b) The disclosure of a breach of the security of the system shall
be made:
(1) without unreasonable delay; and
(2) consistent with:
(A) the legitimate needs of law enforcement, as described
in section 7 of this chapter; and
(B) any measures necessary to:
(i) determine the scope of the breach; and
(ii) restore the reasonable integrity of the data system.
Sec. 6. (a) This section applies to a state agency that maintains
computerized data that includes personal information that the
state agency does not own.
(b) If personal information was or is reasonably believed to have
been acquired by an unauthorized person, the state agency shall
notify the owner or licensee of the information of a breach of the
security of the system immediately following discovery. The agency
shall provide the notice to state residents as required under section
5 of this chapter.
Sec. 7. The notification required by this chapter:
(1) may be delayed if a law enforcement agency determines
that the notification will impede a criminal investigation; and
(2) shall be made after the law enforcement agency
determines that it will not compromise the investigation.
Sec. 8. Except as provided in section 9 of this chapter, a state
agency may provide the notice required under this chapter:
(1) in writing; or
(2) by electronic mail, if the individual has provided the state
agency with the individual's electronic mail address.
Sec. 9. (a) This section applies if a state agency demonstrates
that:
(1) the cost of providing the notice required under this
chapter is at least two hundred fifty thousand dollars
($250,000);
(2) the number of persons to be notified is at least five
hundred thousand (500,000); or
(3) the agency does not have sufficient contact information;
the state agency may use an alternate form of notice set forth in
subsection (b).
(b) A state agency may provide the following alternate forms of
notice if authorized by subsection (a):
(1) Conspicuous posting of the notice on the state agency's
web site if the state agency maintains a web site.
(2) Notification to major statewide media.
Sec. 10. If a state agency is required to provide notice under this
section to more than one thousand (1,000) individuals, the state
agency shall notify without unreasonable delay all consumer
reporting agencies (as defined in 15 U.S.C. 1681a) of the
distribution and content of the notice.
technology that has the ability to:
(1) search recorded documents; and
(2) redact Social Security numbers from recorded documents.
Sec. 3. For purposes of this chapter, disclosure of the last four
(4) digits of an individual's Social Security number is not a
disclosure of the individual's Social Security number.
Sec. 4. A document may not be submitted to the county recorder
for recording if the document contains the Social Security number
of an individual, unless required by law.
Sec. 5. (a) An individual preparing a document for recording
shall affirm, under the penalties for perjury, that the individual
has:
(1) reviewed the entire document before submitting the
document for recording for the purpose of identifying and, to
the extent permitted by law, redacting all Social Security
numbers; and
(2) taken reasonable care to redact each Social Security
number in the document.
( b) An individual shall make the affirmation required under
subsection (a) on a form prescribed by the state board of accounts.
Sec. 6. (a) A county recorder may not accept a document for
recording without the completed and executed form described in
section 5 of this chapter attached to the document. A form attached
to a document under this subsection is considered part of the
document for purposes of the fee charged under subsection (b) in
accordance with IC 36-2-7-10.
(b) The county recorder shall charge a fee for recording a
document under this chapter in accordance with IC 36-2-7-10.
(c) The county recorder shall deposit two dollars ($2) of the fee
charged under subsection (b) in the county identification security
protection fund established by section 11 of this chapter. This
subsection expires July 1, 2011.
Sec. 7. The state board of accounts shall establish reasonable
procedures for a county recorder to follow:
(1) when receiving and reviewing a document submitted for
recording; and
(2) in order to comply with this chapter.
Sec. 8. (a) This section applies after December 31, 2007.
(b) To the extent possible, a county recorder may not disclose a
recorded document for public inspection under IC 5-14-3 until the
county recorder has:
(1) searched the document for a Social Security number; and
(2) to the extent possible, redacted any Social Security
numbers contained in the document;
using redacting technology.
Sec. 9. A county recorder shall post a notice in the county
recorder's office that states the:
(1) duties of:
(A) an individual preparing a document for recording; and
(B) the county recorder;
under this chapter; and
(2) penalties under section 12 of this chapter.
Sec. 10. A county recorder shall conduct training sessions at
least two (2) times each year for the county recorder's employees
on the:
(1) requirements of this chapter; and
(2) procedures to follow in order to comply with this chapter.
Sec. 11. (a) As used in this section, "fund" refers to a county
identification security protection fund established under subsection
(b).
(b) Each county legislative body shall establish an identification
security protection fund to be administered by the county recorder.
The county fiscal body shall appropriate money from the fund.
(c) A fund consists of money deposited in the fund under section
6(c) of this chapter. Money in a fund does not revert to the county
general fund.
(d) A county recorder may use money in the fund only to
purchase, upgrade, implement, or maintain redacting technology
used in the office of the county recorder.
Sec. 12. (a) This section applies after June 30, 2008.
(b) A county recorder or an employee of a county recorder who
discloses a recorded document that contains a Social Security
number without having the document searched, to the extent
technologically possible, using redacting technology commits a
Class A infraction.
technology.
(c) County recorders shall seek federal grants, private funds,
and other possible sources of money to implement the redacting
technology required by IC 36-2-7.5, as added by this act.
(d) This SECTION expires July 1, 2008.