Report Title:
Identity Theft; Social Security Information
Description:
Requires businesses and government agencies, subject to limited exceptions, from disclosing an individual's social security number to the general public; printing the SSN on an identification card or in mailings to customers; and requiring the transmission of a SSN to third parties without the individual's written consent unless the third party needs the information for a legitimate purpose. (SD2)
|
THE SENATE |
S.B. NO. |
2293 |
|
TWENTY-THIRD LEGISLATURE, 2006 |
S.D. 2 |
|
|
STATE OF HAWAII |
||
|
|
A BILL FOR AN ACT
RELATING TO SOCIAL SECURITY NUMBER PROTECTION.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
SECTION 1. The Hawaii Revised Statutes is amended by adding to title 26 a new chapter to be appropriately designated and to read as follows:
"CHAPTER
SOCIAL SECURITY NUMBER PROTECTION
§ -1 Purpose. Identity theft is a serious crime, with lasting negative repercussions on the finances and life of the person whose identity was stolen. One of the tools most frequently used to steal a person's identity is the person's social security number. While it was originally introduced by the federal government to keep track of payroll taxes, its use has spread so that it has virtually become a universal identifier. Security experts recommend, to the greatest extent possible, that people protect their social security number and use it only for its intended federal purposes. The purpose of this chapter is to minimize the abuses associated with the fraudulent use of a social security number by restricting its use as an identifier.
§ -2 Definitions. As used in this chapter:
"Business" means a sole proprietorship, partnership, limited partnership, corporation, limited liability company, association, or any other form of business entity. The term also includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.
"Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county.
"Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.
§ -3 Social security number protection. (a) Except as otherwise provided in subsection (b), a business or government agency may not do any of the following:
(1) Intentionally communicate or otherwise make available to the general public an individual's entire social security number;
(2) Intentionally print or imbed an individual's entire social security number on any card required for the individual to access products or services provided by the person or entity;
(3) Require an individual to transmit the individual's entire social security number over the Internet, unless the connection is secure or the social security number is encrypted;
(4) Require an individual to use the individual's entire social security number to access an Internet website, unless a password or unique personal identification number or other authentication device is also required to access the Internet website;
(5) Print an individual's entire social security number on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed, the materials are employer-to-employee communications, or where specifically requested by the individual; and
(6) Sell, lease, loan, trade, rent, or otherwise intentionally disclose an individual's social security number to a third party without written consent to the disclosure from the individual, when the party making the disclosure knows or in the exercise of reasonable diligence would have reason to believe that the third party lacks a legitimate purpose for obtaining the individual's social security number.
(b) Subsection (a) shall not apply in the following instances:
(1) To the inclusion of a social security number in an application or in documents related to an enrollment process, or to establish, amend, or terminate an account, contract, or policy; or to confirm the accuracy of the social security number for the purpose of obtaining a credit report pursuant to 15 U.S.C. section 1681(b). A social security number that is permitted to be mailed under this section may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened;
(2) To the opening of an account or the provision of or payment for a product or service authorized by an individual;
(3) To the collection, use, or release of a social security number to investigate or prevent fraud; conduct background checks; conduct social or scientific research; collect a debt; obtain a credit report from or furnish data to a consumer reporting agency pursuant to the Fair Credit Reporting Act, 15 U.S.C. sections 1681 to 1681v, as amended; undertake a permissible purpose enumerated under the federal Gramm Leach Bliley Act, 15 U.S.C. sections 6801 to 6809, as amended; or locate an individual who is missing or due a benefit, such as a pension, insurance, or unclaimed property benefit; or locate a lost relative;
(4) To a business or government agency acting pursuant to a court order, warrant, subpoena, or when otherwise required by law;
(5) To a business or government agency providing the social security number to a federal, state, or local government entity including a law enforcement agency or court, or their agents or assigns;
(6) To a social security number that has been redacted; and
(7) To the collection, use, or release of a social security number in the course of administering a claim, benefit, or procedure relating to an individual's employment, including an individual's termination from employment, retirement from employment, injuries suffered during the course of employment, and other related claims, benefits, or procedures.
(c) A business or government agency covered by this section shall make reasonable efforts to cooperate, through systems testing and other means, to ensure that the requirements of this chapter are complied with.
(d) Any business that violates any provision of this chapter shall be deemed to have engaged in an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of section 480-2. The attorney general or the director of the office of consumer protection may bring an action based upon unfair or deceptive acts or practices declared unlawful by this section. No such action may be brought against a government agency.
(e) In addition to any penalty provided for in subsection (d), any business that violates any provision of this chapter is liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation, or damages not less than $500, whichever is greater. The court, in any action brought under this section, may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency."
SECTION 2. This Act shall take effect on July 1, 2050.