(A) Purpose.
(1) The city adopts this identity protection policy pursuant to the Identity Protection Act, 5 ILCS 179/1. The Act requires each local government agency in Illinois to draft, approve, and implement an identity protection policy to ensure the confidentiality and integrity of the social security numbers that agencies collect, maintain, and use.
(2) The purpose of this policy is to set forth the procedures and restrictions that must be observed by all officials and employees of the city regarding the use of social security numbers belonging to city employees and the public.
(B) Access to social security numbers.
(1) Limited access. Only those officials and employees who are required to use or handle information or documents that contain social security numbers in the course of performing their duties will have access to such information or documents.
(2) Training. All city officials and employees who have access to social security numbers will receive instruction on the proper handling of information that contains social security numbers.
(C) Displaying or printing social security numbers. The city shall not:
(1) Publicly post or publicly display in any manner an individual's social security number. PUBLICLY POST or PUBLICLY DISPLAY means to intentionally communicate or otherwise intentionally make available to the general public;
(2) Print an individual's social security number on any card required for an individual to access products or services provided by the city;
(3) Require an individual to transmit a social security number over the internet, unless the connection is secure or the social security number is encrypted; and/or
(4) Print an individual's social security number on any materials that are mailed through the U.S. Postal Service, any private mail service, electronic mail, or any similar method of delivery, unless state of federal law requires the social security number to be on the document to be mailed, such as in forms sent by mail in connection with the Unemployment Insurance Act, the Department of Revenue, the Social Security Administration, or the Illinois State Disbursement Unit.
(D) Collection, use, or disclosure of social security numbers.
(1) The city shall not:
(a) Collect, use, or disclose social security numbers from individuals unless:
1. Required to do so under state or federal law, rules, or regulations; or the collection, use, or disclosure of the social security number is otherwise necessary for the performance of the city's duties and responsibilities;
2. The need and purpose for the social security number is documented before its collection; and
3. The social security number collected is relevant to the documented need and purpose;
(b) Require an individual to use his or her social security number to access an internet website; or
(c) Use the social security number for any purpose other than the purpose for which it was collected.
(2) Exceptions. The disclosure of social security numbers to agents, employees, contractors, or subcontractors of a governmental entity, or disclosure by a governmental entity to another governmental entity or its agents, employees, contractors, or subcontractors, provided that:
(a) Disclosure is necessary to perform its duties;
(b) Disclosure of the social security number is pursuant to a court order, warrant, or subpoena;
(c) Collection, use, or disclosure of social security numbers in order to ensure the safety of state and local governmental employees, persons committed to correctional facilities, local jails, and other law enforcement facilities or retention centers and wards of the state;
(d) The collection, use, or disclosure of social security numbers for internal verification or administrative purposes;
(e) The disclosure of social security numbers to any entity for the collection of delinquent child support or of any state debt or investigation of fraud; and/or
(f) To investigate or prevent fraud, to conduct background checks, collect debt, obtain a credit report, or to assist in locating a missing person, lost relative, or a person who is due a state or federal benefit.
(E) Requirement to redact social security numbers.
(1) The city shall comply with the provisions of any other state law with respect to allowing the public inspection and copying of information or documents containing all or any portion of an individual's social security number. The city shall redact social security numbers from all information or documents before allowing the public inspection or copying of the information or documents.
(2) When collecting social security numbers, the city shall request each social security number in a manner that makes the social security number easily redacted if required to be released as part of a public records request.
(F) Training and oversight. All staff and third party service providers performing any activity in connection with one or more covered accounts are to be provided appropriate training and receive effective oversight to ensure that the activity is conducted in accordance with policies and procedures designed to detect, prevent, and mitigate the risk of identity theft.
(G) Department responsibilities and compliance. The city must ensure that the procedures and restrictions stated in this policy are explained to all employees. Penalties for a violation of this policy include disciplinary action up to and including termination and/or criminal prosecution as provided in the Identity Protection Act, 5 ILCS 179/45.
(Ord. 04-18, passed 2-13-2018)