HomeMy WebLinkAboutOrdinance #3002 ORDINANCE NO 3002
AN ORDINANCE APPROVING THE IDENTITY PROTECTION POLICY FOR THE CITY
OF CANTON, ILLINOIS.
WHEREAS, the State of Illinois has passed the Identity Protection Act (5 ILCS 179/1 et. seq.);
and
WHEREAS, the Act limits the municipalities ability to post or display individual social
security number, print an individual social security number on cards for the access of products and
services or on mailed materials, requiring an individual to transmit a social security number via the
internet or collect social security numbers in general; and
WHEREAS, the Act has certain exemptions that allows the municipality to collect, use, or
disclose social security numbers as required; and
WHEREAS, the staff has reviewed all City forms that ask for social security numbers and
either amended the form if it was determined unnecessary or if it was determined that the social
security number was required due to one or more of the exemptions listed in the Act; and
WHEREAS, there are no circumstances in which the City requires an individual to submit their
social security number via the internet; and
WHEREAS, in order to comply with the obligations of the Illinois Identity Protection Act, the
City Council finds and declares that it is in the best interest of the City of Canton to approve the
Identity Protection Policy attached hereto and incorporated herein as Exhibit A.
NOW, THEREFORE, BE IT ORDAINED BY THE CITY COUNCIL OF THE CITY OF
CANTON, Fulton County, lllinois, as follows:
1. That the Canton City Council hereby approves the Identity Protection Policy attached hereto
and incorporated herein as Exhibit A.
2. That the City staff will distribute the Policy and provide training for those employees who are
required to obtain, use, and maintain social security number information.
3. That this Ordinance shall be in full force and effect from and after its passage by the City
Council of the City of Canton, Fulton County, Illinois.
PASSED by the City Council of the City of Canton, Fulton County, Illinois, at a regular meeting this
6th day of November 2012, upon a roll call vote as follows:
AYES: Aldermen Pickel, Hartford, Schenck, Pasley, West, Fritz, Ellis
NAYS: None
ABSENT: Alderman Nelson
APPROVEI~:
~ 7 ~
7 ''7 ~ "7
. ~ ~ ~ '
Kevin R. ade, Mayor
AT ST: ~
~
Diana Pavley, City Cle
CITY OF CANTON IDENTITY PROTECTION POLICY
PURPOSE
The purpose of this policy is to establish steps that ensure the collection, use, disclosure and
protection of individuals' social security numbers in compliance with the Identity Protection Act,
5 ILCS 179/1 et seq. To protect against identity theft, this policy will define the ways social
security numbers can and cannot be used and will limit access to social security numbers.
RED FLAG RULES
The Fair and Accurate Credit Transactions Act of 2003 (FACT Act) required certain financial
institutions and creditors with "covered accounts" to prepare, adopt, and implement an identity
theft prevention program to identify, detect, respond to and mitigate patterns, practices or
specific activities which could indicate identity theft. The City of Canton ("City") maintains
utility accounts (water, sewer, garbage) that involve multiple payments or transactions and these
accounts are "covered accounts" within the mtaning of the FACT Act. In order to comply with
the obligations of the FACT Act, the City of Canton approved an Identity Theft Prevention
Program via Ordinance No. 1968 on April 7, 2009. As adopted, the Program only applied to
utility accounts. This identity protection policy is not intended to replace, but may supplement
the Identity Theft Prevention Program.
POLICY STATEMENT
This policy with regard to the collection, use, disclosure, and protection of individuals' social
security numbers is intended to comply with the Identity Protection Act, 5 ILCS 179/1 et.seq.
I. Prohibited Activities:
,
A. No officer or employee of the City shall do any of the following:
l. Intentionally communicate or otherwise intentionally make available to the
general public, in any manner, an individual's social security number;
2. Print an individual's social security number on any card required for the
individual to access products or services provided by the City;
3. Require an individual to transmit his or her social security number over the
Internet, unless the connection is secure or the social security number is
encrypted;
4. Print an individual's social security number on any materials that are mailed to
the individual, through the U.S. Postal Service, any private mail service, and
electronic mail ar any similar method of delivery, unless State or Federal law
requires the social security number to be on the document to be mailed.
Notwithstanding any provision in this subsection to the contrary, social security
1
numbers may be included in applications and forms sent by mail, including but
not limited to any material mailed in connection with administration of the
Unemployment Insurance Act, any material mailed in connection with any tax
administered by the Illinois Department of revenue, and documents sent as part of
an application or enrollment process or to establish, amend or terminate an
account, contract, or policy, or to confirm the accuracy of the social security
number. A social security number that may permissibly be mailed under this
subsection may not be printed, in whole or in part, on a postcard or other mailer
that does not require an envelope, or be visible on an envelope without the
envelope having been opened.
B. Except as otherwise provided in this Policy, no officer or employee of the City shall
do any of the following:
1. Collect, use, or disclose a social security number from an individual unless:
a. Required to do so under state or federal law, rules or regulations, or the
collection, use or disclosure of the social security number is otherwise
necessary for the performance of that officer's or employee's duties and
responsibilities;
b. The need and purpose for the social security number is documented before
collection of the social security number; and
c. The social security number collected is relevant to the documented need and
purpose.
2. Require an individual to use his or her social security number to access an Internet
website.
3. Use the social security number of an individual for any purpose other than the
purpose for which it was collected.
C. The prohibitions in subsection B, above, do not apply in the following circumstances:
1. The disclosure of social security numbers to agents, employees, contractors, or
subcontractars of the City, or disclosure to another governmental entity or its
agents, employees, contractors, or subcontractors, if disclosure is necessary in
order for the City to perform its duties and responsibilities; and, if disclosing to a
contractor or subcontractor, prior to such disclosure, the officer or employee of
the City must first receive from the contractor or subcontractor a copy of the
contractor's or subcontractor's policy that sets forth how the requirements
imposed under this policy of the City, to protect an individual's social security
number, will be achieved.
2
2. The disclosure of social security numbers pursuant to a court order, warrant, or
subpoena.
3. The collection, use, or disclosure of social security numbers in order to ensure the
safety of:
a. City employees;
b. Persons committed to correctional facilities, local jails, and other law
enforcement facilities or retention centers;
c. Wards of the State; and
d. All persons working in or visiting a City facility.
4. The collection, use, or disclosure of social security numbers for internal
verification or administrative purposes.
5. The collection or use of social security numbers to investigate or prevent fraud, to
conduct background checks, to collect a debt, to obtain a credit report from a
consumer reporting agency under the Federal Fair Credit Reporting Act, to
undertake any permissible purpose that is enumerated under the Federal Gramm
Leach Bliley Act (Financial Services Modernization Act of 1999), or to locate a
missing person, a lost relative, or a person who is due a benefit, such as a pension
benefit or an unclaimed property benefit.
D. Any previously adopted standards of the City, for the collection, use, or disclosure of
social security numbers, that are stricter than the standards under this Policy with
respect to the protection of those social security numbers, shall, in the event of any
conflict with the provisions of this Policy, control.
II. Public Inspection and Copying of Documents:
Notwithstanding any other provision of this Policy to the contrary, all officers and
employees of the City must comply with the provisions of any other State law with
respect to allowing the public inspection and copying of information or documents
containing all or any portion of any individual's social security number. All officers
and employees of the City must redact social security numbers from the information
or documents before allowing the public inspection or copying of the information or
documents, as such information is exempt from disclosure under the Freedom of
Information Act, pursuant to 5 ILCS 140/7(1)(b) as "private information", as defined
by 5 ILCS 140.2(c)(5).
3
III. Applicability:
A. This Policy does not apply to the collection, use, or disclosure of a social security
number as required by State or Federal law, rule, or regulation.
B. This Policy does not apply to documents that are required to be open to the public
under any State or Federal law, rule, or regulation, applicable case law, Supreme
Court Rule, or the Constitution of the State of Illinois.
IV. Compliance with Federal Law:
If a Federal law takes effect requiring any Federal agency to establish a national
unique patient health identifier program, the City's compliance with said program
shall not be deemed a violation of this Policy or the Act.
V. Embedded Social Security Numbers:
No officer or employee of the City may encode or embed a social security number in
or on a card or document, including but not limited to using a bar code, chip,
magnetic strip, RFID technology or other technology, in place of removing the social
security number as required by this Policy.
VI. Identity Protection Requirements:
A. All officers and employees of the City, identified as having access to social
security numbers in the course of performing their duties, shall receive training in
regard to protecting the confidentiality of social security numbers. Said training
shall include instructions on the proper handling of information that contains
social security numbers from the time of collection through the destruction of the
information.
B. Only officers and employees of the City who are required to use or handle
information or documents that contain social security numbers shall have access
to such information or documents.
C. Social security numbers requested form an individual shall be provided in a
manner that makes the social security number easily redacted if required to be
released as part of a public records request.
D. When collecting a social security number, or upon request by the individual
providing the social security number, a statement of the purpose or purposes for
which the city is collecting and using the social security number shall be
provided.
E. A written copy of this Policy and any amendments thereto, shall be filed with the
City Clerk immediately upon approval of this Policy or any amendments thereto.
4
F. The City Attorney shall make sure that all officers and employees of the City are
aware of the existence of this Policy, and shall make a copy of this Policy
available to each officer and employee. If the City amends this Policy, then the
City Attorney shall advise all officers and employees of the City of this existence
of the amended Policy, shall make a copy of the amended Policy available to each
officer and employee of the City, and shall file a copy of the amended Policy with
the City Clerk.
G. The City shall make this Policy available to any member of the public, upon
request.
VII. Violation:
Any person who intentionally violates the prohibitions in Section 10 of the Act
(which are set forth in Sections LA. and I.B. of this Policy) shall, pursuant to the Act,
be guilty of a Class B misdemeanor.
VIII. This Policy does not supersede any more restrictive law, rule, or regulation regarding
the collection, use, or disclosure of social security numbers.
5