Report Title:

Identity Theft; Social Security Information

Description:

Prohibits businesses, subject to limited exceptions, from disclosing an individual's social security number to the general public, printing the SSN on an identification card or in mailings to customers, requiring the transmission of a SSN to third parties; and selling or otherwise disclosing the SSN to third parties without written consent. (SB2293 HD1)

THE SENATE

S.B. NO.

2293

TWENTY-THIRD LEGISLATURE, 2006

S.D. 2

STATE OF HAWAII

H.D. 1

 

A BILL FOR AN ACT

 

RELATING TO SOCIAL SECURITY NUMBER PROTECTION.

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

SECTION 1. This Act shall be known and may be cited as the "Social Security Number Protection Act of 2006."

SECTION 2. The legislature finds that identity theft is a serious crime, with lasting negative repercussions on the finances and life of the person whose identity was stolen. One of the tools most frequently used to steal a person's identity is the person's social security number. While it was originally introduced by the federal government to keep track of payroll taxes, its use has spread so that it has virtually become a universal identifier. Security experts recommend, to the greatest extent possible, that people protect their social security number and use it only for its intended federal purposes.

The purpose of this Act is to minimize the abuses associated with the fraudulent use of a social security number by restricting its use as an identifier.

SECTION 3. The Hawaii Revised Statutes is amended by adding a new chapter to title 26 to be appropriately designated and to read as follows:

"CHAPTER

SOCIAL SECURITY NUMBER PROTECTION

§   -1 Definitions. As used in this chapter:

"Business" means a sole proprietorship, partnership, limited partnership, corporation, limited liability company, association, or any other form of business entity. The term also includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction. The term shall not include any government or governmental subdivision or agency.

"Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.

"State" means any department, office, or agency of the State and does not include its political subdivisions.

§   -2 Social security number protection. (a) Except as otherwise provided in subsection (b), a business and the State may not:

(1) Intentionally communicate or otherwise make available to the general public an individual's entire social security number;

(2) Intentionally print or imbed an individual's entire social security number on any card required for the individual to access products or services provided by the person or entity;

(3) Require an individual to transmit the individual's entire social security number over the Internet, unless the connection is secure or the social security number is encrypted;

(4) Require an individual to use the individual's entire social security number to access an Internet website, unless a password or unique personal identification number or other authentication device is also required to access the Internet website;

(5) Print an individual's entire social security number on any materials that are mailed to the individual; and

(6) Sell, lease, loan, trade, rent, or otherwise intentionally disclose an individual's social security number to a third party without written consent to the disclosure from the individual, when the party making the disclosure knows or in the exercise of reasonable diligence would have reason to believe that the third party lacks a legitimate purpose for obtaining the individual's social security number.

(b) Subsection (a) shall not apply to:

(1) The inclusion of a social security number in documents that are mailed and:

(A) Are specifically requested by the individual identified by the social security number;

(B) Required by state or federal law to be on the document to be mailed;

(C) Required as part of an application or enrollment process;

(D) Used to establish, amend, or terminate an account, contract, or policy; or

(E) Used to confirm the accuracy of the social security number.

A social security number that is permitted to be mailed under this paragraph may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened;

(2) The opening of an account or the provision of or payment for a product or service authorized by an individual;

(3) The collection, use, or release of a social security number to investigate or prevent fraud; conduct background checks; conduct social or scientific research; collect a debt; obtain a credit report from or furnish data to a consumer reporting agency pursuant to the Fair Credit Reporting Act, 15 U.S.C. Sections 1681 to 1681v, as amended; undertake a permissible purpose enumerated under the federal Gramm Leach Bliley Act, 15 U.S.C. Sections 6801 to 6809, as amended; locate an individual who is missing or due a benefit, such as a pension, insurance, or unclaimed property benefit; or locate a lost relative;

(4) An action pursuant to a court order, warrant, subpoena, or otherwise required by law;

(5) Social security numbers that are provided to a federal, state, or local government entity, including a law enforcement agency or court, or their agents or assigns;

(6) The collection, use, or release of a social security number as required by state or federal law;

(7) The sharing of the social security number by business affiliates;

(8) The use of a social security number for internal verification or administrative purposes;

(9) A social security number that has been redacted; and

(10) Documents or records that are recorded or required to be open to the public pursuant to the constitution or laws of the State or court rule or order, and nothing in this section shall limit access to those documents or records.

(c) A business covered by this section and the State shall make reasonable efforts to cooperate, through systems testing and other means, to ensure that the requirements of this chapter are complied with.

(d) Any business that violates or attempts to violate any provision of this chapter shall be deemed to have engaged in an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of section 480-2."

SECTION 3. This Act shall take effect on July 1, 2096.