Personal Identifying Information Privacy Protection: public bodies' limits on collecting and using social security numbers, and disposal of records and storage media

A public body may not collect a social security number, or any portion of it containing six digits or more, from an individual unless authorized by law to do so or unless collecting it is otherwise imperative for the performance of the body's duties and responsibilities as prescribed by law.

A public body must segregate a collected social security number on a separate page from the rest of the record, or as otherwise appropriate, so that the number may be easily redacted pursuant to a public records request. On request of the individual, a public body must provide at or before collection a statement of the purposes for which the social security number is being collected and used, and may not use the number for any purpose other than the purpose stated.

A public body may not intentionally communicate or otherwise make available to the general public an individual's social security number, or a portion of it containing six digits or more, or other personal identifying information, and may not intentionally print or imbed the number on any card required for the individual to access government services.

A public body may not require an individual to transmit a social security number over the Internet unless the connection is secure or the number is encrypted, may not require its use to access an Internet web site unless a password, unique personal identification number or other authentication device is also required, and may not print it on materials mailed to the individual unless state or federal law requires the number to be on the mailed document.

An entity that collects and uses social security numbers or other personal identifying information as part of the maintenance and reporting of employment records or the administration or provision of employee benefits programs is exempt from the prohibitions in section 30-2-310(A).

Before a public body may transfer or dispose of information technology hardware or storage media it owns or leases, all personal and confidential information must be removed and the hardware and storage media must be sanitized in accordance with standards and policies adopted by the Department of Administration, Division of the State Chief Information Officer.

The director or appropriate information technology manager of the public body must verify that all personal and confidential information is removed and the hardware and storage media are sanitized before the transfer or disposal occurs. When a public body disposes of a record that contains personal identifying information of an individual, the body must modify that information by shredding, erasing or other means to make it unreadable or undecipherable.

A public body is considered to comply with its duty to make personal identifying information unreadable or undecipherable on disposal of a record if it contracts with a person engaged in the business of disposing of records for the modification of that information on its behalf.

Public body includes any department of the State, any state board, commission, agency and authority, and any public or governmental body or political subdivision of the State, including counties, municipalities, townships, school districts and special purpose districts, and any organization, corporation or agency supported in whole or in part by public funds or expending public funds.

Section 30-2-320 lists the cases in which social security numbers and identifying information may be disclosed, the first being disclosure to another governmental entity or its agents, employees or contractors if disclosure is necessary for the receiving entity to perform its duties and responsibilities.