TITLE 10 OFFICE OF ATTORNEY GENERAL FOR THE STATE
Final Rule
LSA Document #05-319(F)
DIGEST
Adds
10 IAC 5 to provide definitions, mitigating factors, and notice requirements regarding the release of Social Security numbers by state agencies. Effective 30 days after filing with the Secretary of State.
SECTION 1.
10 IAC 5 IS ADDED TO READ AS FOLLOWS:
ARTICLE 5. RELEASE OF SOCIAL SECURITY NUMBERS BY STATE AGENCIES
Rule 1. Authority and Applicability
Authority:
IC 4-1-10-13
Sec. 1. This article is adopted under the authority granted to the attorney general by the release of Social Security number act (IC 4-1-10-13).
(Office of Attorney General for the State; 10 IAC 5-1-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
Authority:
IC 4-1-10-13
(Office of Attorney General for the State; 10 IAC 5-1-2; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
Authority:
IC 4-1-10-13
Sec. 3. The effective date of this article is July 1, 2006.
(Office of Attorney General for the State; 10 IAC 5-1-3; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
Rule 2. Definitions
10 IAC 5-2-1 "Express consent" defined
Authority:
IC 4-1-10-13
Sec. 1. "Express consent" means a specific grant of authority made by an individual allowing a state agency to disclose that individual's Social Security number. The grant of authority shall:
(1) not be given:
(A) pursuant to or as a condition of a state agency's services that would otherwise be available to the individual; or
(B) by any person other than the individual to whom the Social Security number has been assigned by the Social Security Administration; and
(2) be:
(A) given in writing;
(B) signed by the individual; and
(C) dated in a legible form as determined by the state agency.
(Office of Attorney General for the State; 10 IAC 5-2-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
10 IAC 5-2-2 "State law enforcement agency" defined
Authority:
IC 4-1-10-13
Sec. 2. "State law enforcement agency" includes the following entities or persons:
(1) The state police department.
(2) The office of attorney general for the state.
(3) The office of the inspector general.
(4) Prosecutors and their deputies.
(5) Other state agencies or entities that conduct investigations relating to the enforcement of state law.
(Office of Attorney General for the State; 10 IAC 5-2-2; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
Rule 3. Attorney General's Discretion
Authority:
IC 4-1-10-13
Sec. 1. The attorney general may, in his or her discretion, determine that the release of Social Security numbers was a negligent act and not a knowing, intentional, or reckless act if a state agency or employee establishes that the following provisions, singly or in combination, have been met:
(1) The release of the Social Security numbers is immediately stopped.
(2) Any individuals whose Social Security numbers are disclosed are immediately notified in a timely manner.
(3) The release of the Social Security numbers was as follows:
(A) Unintended.
(B) De minimis and nonsystematic.
(4) The handling of the Social Security numbers was conducted pursuant to a contractual relationship, and the contract contained a clause requiring the state agency and the contractor to comply with the following:
(A) The release of Social Security number provisions set forth in IC 4-1-10.
(B) The notice of security breach provisions set forth in IC 4-1-11.
(5) The state agency had established reasonable policies and procedures designed to prevent the unauthorized disclosure of individual Social Security numbers.
(6) Corrective measures are initiated to prevent future disclosures under similar circumstances.
(7) Other relevant circumstances as determined by the attorney general.
(Office of Attorney General for the State; 10 IAC 5-3-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
Rule 4. Notice Requirements
10 IAC 5-4-1 Notification to the attorney general
Authority:
IC 4-1-10-13
Sec. 1. When a state agency becomes aware of a release of Social Security or other personal identifying information, the state agency or employee shall, within two (2) business days of the disclosure, notify the office of attorney general for the state in writing of the following:
(1) The nature of any release of Social Security or other personal identifying information.
(2) The steps taken by the agency or employee to do the following:
(A) Stop the current release.
(B) Notify the individuals affected.
(C) Prevent future releases.
(Office of Attorney General for the State; 10 IAC 5-4-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA)
Notice of Intent: December 1, 2005; 29 IR 833
Proposed Rule: January 1, 2006; 29 IR 1248
Hearing Held: March 31, 2006
Approved by Attorney General: May 18, 2006
Approved by Governor: June 16, 2006
Filed with Secretary of State: June 16, 2006, 2:50 p.m.
Documents Incorporated by Reference: None Received by Publisher
Small Business Regulatory Coordinator: Jason Thompson, Deputy Attorney General, Office of the Indiana Attorney General, Indiana Government Center-South, 302 West Washington Street, 5th Floor, Indianapolis, IN 46204, (317) 233-2413, jthompson@atg.state.in.us
Posted: 07/12/2006 by Legislative Services Agency
DIN: 20060712-IR-010050319FRA
Composed: Apr 29,2024 8:14:34PM EDT
A
PDF version of this document.
