Report Title:

Identity theft; social security information

Description:

Requires businesses, subject to limited exceptions, from disclosing an individual's social security number to the general public; printing the SSN on an identification card or in mailings to customers; and requiring the transmission of a SSN to third parties without the individual's written consent unless the third party needs the information for a legitimate purpose.

HOUSE OF REPRESENTATIVES

H.B. NO.

2330

TWENTY-THIRD LEGISLATURE, 2006

 

STATE OF HAWAII

 


 

A BILL FOR AN ACT

 

RELATING TO SOCIAL SECURITY NUMBER PROTECTION.

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

SECTION 1. This Act shall be known and may be cited as the "Social Security Number Protection Act of 2006."

SECTION 2. The Hawaii Revised Statutes is amended by adding to title 26 a new chapter to be appropriately designated and to read as follows:

"CHAPTER

SOCIAL SECURITY NUMBER PROTECTION

§   -1 Purpose. Identity theft is a serious crime, with lasting negative repercussions on the finances and life of the person whose identity was stolen. One of the tools most frequently used to steal a person's identity is the person's social security number. While it was originally introduced by the federal government to keep track of payroll taxes, its use has spread so that it has virtually become a universal identifier. Security experts recommend, to the greatest extent possible, that people protect their social security number and use it only for its intended federal purposes. The purpose of this chapter is to minimize the abuses associated with the fraudulent use of a social security number by restricting its use as an identifier.

§   -2 Definitions. As used in this chapter:

"Business" means a sole proprietorship, partnership, limited partnership, corporation, limited liability company, association, or any other form of business entity. The term also includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction. The term shall not include any government or governmental subdivision or agency.

"Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.

§   -3 Social security number protection. (a) Except as otherwise provided in subsection (b), a business may not do any of the following:

(1) Intentionally communicate or otherwise make available to the general public an individual's entire social security number;

(2) Intentionally print or imbed an individual's entire social security number on any card required for the individual to access products or services provided by the person or entity;

(3) Require an individual to transmit the individual's entire social security number over the Internet, unless the connection is secure or the social security number is encrypted;

(4) Require an individual to use the individual's entire social security number to access an Internet website, unless a password or unique personal identification number or other authentication device is also required to access the Internet website;

(5) Print an individual's entire social security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed; and

(6) Sell, lease, loan, trade, rent, or otherwise intentionally disclose an individual's social security number to a third party without written consent to the disclosure from the individual, when the party making the disclosure knows or in the exercise of reasonable diligence would have reason to believe that the third party lacks a legitimate purpose for obtaining the individual's social security number.

(b) Subsection (a) shall not apply in the following instances:

(1) To the inclusion of a social security number in an application or in documents related to an enrollment process, or to establish, amend, or terminate an account, contract, or policy; or to confirm the accuracy of the social security number for the purpose of obtaining a credit report pursuant to 15 U.S.C. section 1681(b). A social security number that is permitted to be mailed under this section may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened;

(2) To the opening of an account or the provision of or payment for a product or service authorized by an individual;

(3) To the collection, use, or release of a social security number to investigate or prevent fraud; conduct background checks; conduct social or scientific research; collect a debt; obtain a credit report from or furnish data to a consumer reporting agency pursuant to the Fair Credit Reporting Act, 15 U.S.C. sections 1681 to 1681v, as amended; undertake a permissible purpose enumerated under the federal Gramm Leach Bliley Act, 15 U.S.C. sections 6801 to 6809, as amended; or locate an individual who is missing or due a benefit, such as a pension, insurance, or unclaimed property benefit; or locate a lost relative;

(4) To a business acting pursuant to a court order, warrant, subpoena, or when otherwise required by law;

(5) To a business providing the social security number to a federal, state, or local government entity including a law enforcement agency or court, or their agents or assigns; and

(6) To a social security number that has been redacted.

(c) A business covered by this section shall make reasonable efforts to cooperate, through systems testing and other means, to ensure that the requirements of this chapter are complied with.

(d) Any person who violates or attempts to violate any provision of this chapter shall be deemed to have engaged in an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of section 480-2."

SECTION 3. This Act shall take effect upon its approval.

INTRODUCED BY:

_____________________________

By Request