AN ACT to amend the Indiana Code concerning state offices and administration and local
violation of this chapter commits a Class D felony.
Sec. 9. A person who knowingly, intentionally, or recklessly makes a false representation to a state agency to obtain a Social Security number from the state agency commits a Class D felony.
Sec. 10. An employee of a state agency who negligently discloses a Social Security number in violation of this chapter commits a Class A infraction.
Sec. 11. (a) The attorney general may investigate any allegation that a Social Security number was disclosed in violation of this chapter.
(b) If the attorney general determines that there is evidence that a state employee committed a criminal act under section 8 or 9 of this chapter, the attorney general shall report the attorney general's findings to:
(1) the prosecuting attorney in the county where the criminal act occurred; and
(2) the state police department.
Sec. 12. If the attorney general determines that there is evidence that a state employee committed an infraction under section 10 of this chapter, the attorney general:
(1) shall report the attorney general's findings to the appointing authority (as defined in IC 4-2-6-1) of the agency that employs the employee; and
(2) may report the attorney general's findings to the local prosecuting attorney in the county where the infraction occurred.
Sec. 13. The attorney general may adopt rules under IC 4-22-2 that the attorney general considers necessary to carry out this chapter.
(2) Unauthorized acquisition of a portable electronic device on which personal information is stored if access to the device is protected by a password that has not been disclosed.
Sec. 3. (a) As used in this chapter, "personal information" means:
(1) an individual's:
(A) first name and last name; or
(B) first initial and last name; and
(2) at least one (1) of the following data elements:
(A) Social Security number.
(B) Driver's license number or identification card number.
(C) Account number, credit card number, debit card number, security code, access code, or password of an individual's financial account.
(b) The term does not include the following:
(1) The last four (4) digits of an individual's Social Security number.
(2) Publicly available information that is lawfully made available to the public from records of a federal agency or local agency.
Sec. 4. As used in this section "state agency" has the meaning set forth in IC 4-1-10-2.
Sec. 5. (a) Any state agency that owns or licenses computerized data that includes personal information shall disclose a breach of the security of the system following discovery or notification of the breach to any state resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.
(b) The disclosure of a breach of the security of the system shall be made:
(1) without unreasonable delay; and
(2) consistent with:
(A) the legitimate needs of law enforcement, as described in section 7 of this chapter; and
(B) any measures necessary to:
(i) determine the scope of the breach; and
(ii) restore the reasonable integrity of the data system.
Sec. 6. (a) This section applies to a state agency that maintains computerized data that includes personal information that the state agency does not own.
(b) If personal information was or is reasonably believed to have
been acquired by an unauthorized person, the state agency shall
notify the owner or licensee of the information of a breach of the
security of the system immediately following discovery. The agency
shall provide the notice to state residents as required under section
5 of this chapter.
Sec. 7. The notification required by this chapter:
(1) may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation; and
(2) shall be made after the law enforcement agency determines that it will not compromise the investigation.
Sec. 8. Except as provided in section 9 of this chapter, a state agency may provide the notice required under this chapter:
(1) in writing; or
(2) by electronic mail, if the individual has provided the state agency with the individual's electronic mail address.
Sec. 9. (a) This section applies if a state agency demonstrates that:
(1) the cost of providing the notice required under this chapter is at least two hundred fifty thousand dollars ($250,000);
(2) the number of persons to be notified is at least five hundred thousand (500,000); or
(3) the agency does not have sufficient contact information;
the state agency may use an alternate form of notice set forth in subsection (b).
(b) A state agency may provide the following alternate forms of notice if authorized by subsection (a):
(1) Conspicuous posting of the notice on the state agency's web site if the state agency maintains a web site.
(2) Notification to major statewide media.
Sec. 10. If a state agency is required to provide notice under this section to more than one thousand (1,000) individuals, the state agency shall notify without unreasonable delay all consumer reporting agencies (as defined in 15 U.S.C. 1681a) of the distribution and content of the notice.
technology that has the ability to:
(1) search recorded documents; and
(2) redact Social Security numbers from recorded documents.
Sec. 3. For purposes of this chapter, disclosure of the last four (4) digits of an individual's Social Security number is not a disclosure of the individual's Social Security number.
Sec. 4. A document may not be submitted to the county recorder for recording if the document contains the Social Security number of an individual, unless required by law.
Sec. 5. (a) An individual preparing a document for recording shall affirm, under the penalties for perjury, that the individual has:
(1) reviewed the entire document before submitting the document for recording for the purpose of identifying and, to the extent permitted by law, redacting all Social Security numbers; and
(2) taken reasonable care to redact each Social Security number in the document.
( b) An individual shall make the affirmation required under subsection (a) on a form prescribed by the state board of accounts.
Sec. 6. (a) A county recorder may not accept a document for recording without the completed and executed form described in section 5 of this chapter attached to the document. A form attached to a document under this subsection is considered part of the document for purposes of the fee charged under subsection (b) in accordance with IC 36-2-7-10.
(b) The county recorder shall charge a fee for recording a document under this chapter in accordance with IC 36-2-7-10.
(c) The county recorder shall deposit two dollars ($2) of the fee charged under subsection (b) in the county identification security protection fund established by section 11 of this chapter. This subsection expires July 1, 2011.
Sec. 7. The state board of accounts shall establish reasonable procedures for a county recorder to follow:
(1) when receiving and reviewing a document submitted for recording; and
(2) in order to comply with this chapter.
Sec. 8. (a) This section applies after December 31, 2007.
(b) To the extent possible, a county recorder may not disclose a recorded document for public inspection under IC 5-14-3 until the county recorder has:
(1) searched the document for a Social Security number; and
(2) to the extent possible, redacted any Social Security numbers contained in the document;
using redacting technology.
Sec. 9. A county recorder shall post a notice in the county recorder's office that states the:
(1) duties of:
(A) an individual preparing a document for recording; and
(B) the county recorder;
under this chapter; and
(2) penalties under section 12 of this chapter.
Sec. 10. A county recorder shall conduct training sessions at least two (2) times each year for the county recorder's employees on the:
(1) requirements of this chapter; and
(2) procedures to follow in order to comply with this chapter.
Sec. 11. (a) As used in this section, "fund" refers to a county identification security protection fund established under subsection (b).
(b) Each county legislative body shall establish an identification security protection fund to be administered by the county recorder. The county fiscal body shall appropriate money from the fund.
(c) A fund consists of money deposited in the fund under section 6(c) of this chapter. Money in a fund does not revert to the county general fund.
(d) A county recorder may use money in the fund only to purchase, upgrade, implement, or maintain redacting technology used in the office of the county recorder.
Sec. 12. (a) This section applies after June 30, 2008.
(b) A county recorder or an employee of a county recorder who discloses a recorded document that contains a Social Security number without having the document searched, to the extent technologically possible, using redacting technology commits a Class A infraction.
(c) County recorders shall seek federal grants, private funds, and other possible sources of money to implement the redacting technology required by IC 36-2-7.5, as added by this act.
(d) This SECTION expires July 1, 2008.