First Regular Session 114th General Assembly (2005)


PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana Constitution) is being amended, the text of the existing provision will appear in this style type, additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional provision adopted), the text of the new provision will appear in this style type. Also, the word NEW will appear in that style type in the introductory clause of each SECTION that adds a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts between statutes enacted by the 2004 Regular Session of the General Assembly.


    SENATE ENROLLED ACT No. 503




     AN ACT to amend the Indiana Code concerning state offices and administration and local government.

Be it enacted by the General Assembly of the State of Indiana:

SOURCE: IC 4-1-10; (05)SE0503.1.1. -->     SECTION 1. IC 4-1-10 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2005]:
     Chapter 10. Release of Social Security Number
    Sec. 1. This chapter applies after June 30, 2006.
    Sec. 2. As used in this chapter, "state agency" means an authority, a board, a branch, a commission, a committee, a department, a division, or another instrumentality of the executive, including the administrative, department of state government. Except as provided in subdivision (4), the term does not include the judicial or legislative department of state government. The term includes the following:
        (1) A state elected official's office.
        (2) A state educational institution (as defined in IC 20-12-0.5-1).
        (3) A body corporate and politic of the state created by state statute.
        (4) The Indiana lobby registration commission established by IC 2-7-1.6-1.
    Sec. 3. (a) For purposes of this section, disclosure of the last four (4) digits of an individual's Social Security number is not a disclosure of the individual's Social Security number.
    (b) Except as provided in section 4 or 5 of this chapter, a state agency may not disclose an individual's Social Security number.
    Sec. 4. Unless prohibited by state law, federal law, or court order, the following apply:
        (1) A state agency may disclose the Social Security number of an individual to a state, local, or federal agency.
        (2) A state law enforcement agency may, for purposes of furthering an investigation, disclose the Social Security number of an individual to any individual, state, local, or federal agency, or other legal entity.
    Sec. 5. A state agency may disclose the Social Security number of an individual if any of the following apply:
        (1) The disclosure of the Social Security number is expressly required by state law, federal law, or a court order.
        (2) The individual expressly consents in writing to the disclosure of the individual's Social Security number
.
         (3) The disclosure of the Social Security number is:
            (A) made to comply with:
                (i) the USA Patriot Act of 2001 (P.L. 107-56); or
                (ii) Presidential Executive Order 13224; or
            (B) to a commercial entity for the permissible uses set forth in the:
                (i) Drivers Privacy Protection Act (18 U.S.C. 2721 et seq.);
                (ii) Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); or
                (iii) Financial Modernization Act of 1999 (15 U.S.C. 6801 et seq.).
        (4) The disclosure of the Social Security number is for the purpose of administration of a state agency employee's or the state agency employee's dependent's health benefits.
    Sec. 6. A state agency complies with section 3 of this chapter if the agency:
        (1) removes; or
        (2) completely and permanently obscures;
a Social Security number on a public record before disclosing the public record.
    Sec. 7. If a state agency releases a Social Security number in violation of this chapter, the agency shall provide notice to the person whose Social Security number was disclosed in the manner set forth in IC 4-1-11.
    Sec. 8. An employee of a state agency who knowingly, intentionally, or recklessly discloses a Social Security number in

violation of this chapter commits a Class D felony.
    Sec. 9. A person who knowingly, intentionally, or recklessly makes a false representation to a state agency to obtain a Social Security number from the state agency commits a Class D felony.
    Sec. 10. An employee of a state agency who negligently discloses a Social Security number in violation of this chapter commits a Class A infraction.
    Sec. 11. (a) The attorney general may investigate any allegation that a Social Security number was disclosed in violation of this chapter.
    (b) If the attorney general determines that there is evidence that a state employee committed a criminal act under section 8 or 9 of this chapter, the attorney general shall report the attorney general's findings to:
        (1) the prosecuting attorney in the county where the criminal act occurred; and
        (2) the state police department.
    Sec. 12. If the attorney general determines that there is evidence that a state employee committed an infraction under section 10 of this chapter, the attorney general:
        (1) shall report the attorney general's findings to the appointing authority (as defined in IC 4-2-6-1) of the agency that employs the employee; and
        (2) may report the attorney general's findings to the local prosecuting attorney in the county where the infraction occurred.
    Sec. 13. The attorney general may adopt rules under IC 4-22-2 that the attorney general considers necessary to carry out this chapter.

SOURCE: IC 4-1-11; (05)SE0503.1.2. -->     SECTION 2. IC 4-1-11 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2005]:
     Chapter 11. Notice of Security Breach
    Sec. 1. This chapter applies after June 30, 2006.
    Sec. 2. (a) As used in this chapter, "breach of the security of the system" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a state or local agency.
    (b) The term does not include the following:
        (1) Good faith acquisition of personal information by an agency or employee of the agency for purposes of the agency, if the personal information is not used or subject to further

unauthorized disclosure.
        (2) Unauthorized acquisition of a portable electronic device on which personal information is stored if access to the device is protected by a password that has not been disclosed.
    Sec. 3. (a) As used in this chapter, "personal information" means:
        (1) an individual's:
            (A) first name and last name; or
            (B) first initial and last name; and
        (2) at least one (1) of the following data elements:
            (A) Social Security number.
            (B) Driver's license number or identification card number.
            (C) Account number, credit card number, debit card number, security code, access code, or password of an individual's financial account.
    (b) The term does not include the following:
        (1) The last four (4) digits of an individual's Social Security number.
        (2) Publicly available information that is lawfully made available to the public from records of a federal agency or local agency.
    Sec. 4. As used in this section "state agency" has the meaning set forth in IC 4-1-10-2.
    Sec. 5. (a) Any state agency that owns or licenses computerized data that includes personal information shall disclose a breach of the security of the system following discovery or notification of the breach to any state resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.
    (b) The disclosure of a breach of the security of the system shall be made:
        (1) without unreasonable delay; and
        (2) consistent with:
            (A) the legitimate needs of law enforcement, as described in section 7 of this chapter; and
            (B) any measures necessary to:
                (i) determine the scope of the breach; and
                (ii) restore the reasonable integrity of the data system.
    Sec. 6. (a) This section applies to a state agency that maintains computerized data that includes personal information that the state agency does not own.
    (b) If personal information was or is reasonably believed to have

been acquired by an unauthorized person, the state agency shall notify the owner or licensee of the information of a breach of the security of the system immediately following discovery. The agency shall provide the notice to state residents as required under section 5 of this chapter.
    Sec. 7. The notification required by this chapter:
        (1) may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation; and
        (2) shall be made after the law enforcement agency determines that it will not compromise the investigation.
    Sec. 8. Except as provided in section 9 of this chapter, a state agency may provide the notice required under this chapter:
        (1) in writing; or
        (2) by electronic mail, if the individual has provided the state agency with the individual's electronic mail address.
    Sec. 9. (a) This section applies if a state agency demonstrates that:
        (1) the cost of providing the notice required under this chapter is at least two hundred fifty thousand dollars ($250,000);
        (2) the number of persons to be notified is at least five hundred thousand (500,000); or
        (3) the agency does not have sufficient contact information;
the state agency may use an alternate form of notice set forth in subsection (b).
    (b) A state agency may provide the following alternate forms of notice if authorized by subsection (a):
        (1) Conspicuous posting of the notice on the state agency's web site if the state agency maintains a web site.
        (2) Notification to major statewide media.
    Sec. 10. If a state agency is required to provide notice under this section to more than one thousand (1,000) individuals, the state agency shall notify without unreasonable delay all consumer reporting agencies (as defined in 15 U.S.C. 1681a) of the distribution and content of the notice.

SOURCE: IC 36-2-7.5; (05)SE0503.1.3. -->     SECTION 3. IC 36-2-7.5 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2005]:
     Chapter 7.5. Recording Documents Containing Social Security Numbers
    Sec. 1. This chapter applies after December 31, 2005.
    Sec. 2. As used in this chapter, "redacting technology" refers to

technology that has the ability to:
        (1) search recorded documents; and
        (2) redact Social Security numbers from recorded documents.
    Sec. 3. For purposes of this chapter, disclosure of the last four (4) digits of an individual's Social Security number is not a disclosure of the individual's Social Security number.
    Sec. 4. A document may not be submitted to the county recorder for recording if the document contains the Social Security number of an individual, unless required by law.
    Sec. 5. (a) An individual preparing a document for recording shall affirm, under the penalties for perjury, that the individual has:
        (1) reviewed the entire document before submitting the document for recording for the purpose of identifying and, to the extent permitted by law, redacting all Social Security numbers; and
        (2) taken reasonable care to redact each Social Security number in the document.

    ( b) An individual shall make the affirmation required under subsection (a) on a form prescribed by the state board of accounts.
    Sec. 6. (a) A county recorder may not accept a document for recording without the completed and executed form described in section 5 of this chapter attached to the document. A form attached to a document under this subsection is considered part of the document for purposes of the fee charged under subsection (b) in accordance with IC 36-2-7-10.
    (b) The county recorder shall charge a fee for recording a document under this chapter in accordance with IC 36-2-7-10.
    (c) The county recorder shall deposit two dollars ($2) of the fee charged under subsection (b) in the county identification security protection fund established by section 11 of this chapter. This subsection expires July 1, 2011.
    Sec. 7. The state board of accounts shall establish reasonable procedures for a county recorder to follow:
        (1) when receiving and reviewing a document submitted for recording; and
        (2) in order to comply with this chapter.
    Sec. 8. (a) This section applies after December 31, 2007.
    (b) To the extent possible, a county recorder may not disclose a recorded document for public inspection under IC 5-14-3 until the county recorder has:
        (1) searched the document for a Social Security number; and


        (2) to the extent possible, redacted any Social Security numbers contained in the document;
using redacting technology.
    Sec. 9. A county recorder shall post a notice in the county recorder's office that states the:
        (1) duties of:
            (A) an individual preparing a document for recording; and
            (B) the county recorder;
        under this chapter; and
        (2) penalties under section 12 of this chapter.
    Sec. 10. A county recorder shall conduct training sessions at least two (2) times each year for the county recorder's employees on the:
        (1) requirements of this chapter; and
        (2) procedures to follow in order to comply with this chapter.
    Sec. 11. (a) As used in this section, "fund" refers to a county identification security protection fund established under subsection (b).
    (b) Each county legislative body shall establish an identification security protection fund to be administered by the county recorder. The county fiscal body shall appropriate money from the fund.
    (c) A fund consists of money deposited in the fund under section 6(c) of this chapter. Money in a fund does not revert to the county general fund.
    (d) A county recorder may use money in the fund only to purchase, upgrade, implement, or maintain redacting technology used in the office of the county recorder.
    Sec. 12. (a) This section applies after June 30, 2008.
    (b) A county recorder or an employee of a county recorder who discloses a recorded document that contains a Social Security number without having the document searched, to the extent technologically possible, using redacting technology commits a Class A infraction.

SOURCE: ; (05)SE0503.1.4. -->     SECTION 4. [EFFECTIVE UPON PASSAGE] (a) The governor may select at least three (3) and not more than six (6) counties for a pilot project beginning July 1, 2005. The governor shall appoint the county recorder to represent each pilot county selected.
    (b) The county recorders appointed to the pilot project shall develop procedures and test technology and equipment to fulfill the purposes of IC 36-2-7.5, as added by this act. The state board of accounts shall work with the county recorders appointed under this SECTION in the development of the procedures and testing of

technology.
    (c) County recorders shall seek federal grants, private funds, and other possible sources of money to implement the redacting technology required by IC 36-2-7.5, as added by this act.
    (d) This SECTION expires July 1, 2008.

SOURCE: ; (05)SE0503.1.5. -->     SECTION 5. An emergency is declared for this act.


SEA 503 _ Concur

Figure

Graphic file number 0 named seal1001.pcx with height 58 p and width 72 p Left aligned