2005-2006 Bill 4297: Identity Theft Protection Act - South Carolina Legislature Online

1 South Carolina General Assembly 2 116th Session, 2005-2006 3 4 H. 4297 5 6 STATUS INFORMATION 7 8 General Bill 9 Sponsors: Reps. Kirsh, Leach, Bailey, Altman, Vaughn, Whipper, Coates, Moody-Lawrence, Mahaffey, 10 G.R. Smith and Haley 11 Document Path: l:\council\bills\bbm\9008mm06.doc 12 13 Introduced in the House on January 10, 2006 14 Currently residing in the House Committee on Judiciary 15 16 Summary: Identity Theft Protection Act 17 18 19 HISTORY OF LEGISLATIVE ACTIONS 20 21 Date Body Action Description with journal page number 22 11/16/2005 House Prefiled 23 11/16/2005 House Referred to Committee on Judiciary 24 1/10/2006 House Introduced and read first time HJ-20 25 1/10/2006 House Referred to Committee on Judiciary HJ-21 26 1/17/2006 House Member(s) request name added as sponsor: Haley 27 28 29 VERSIONS OF THIS BILL 30 31 11/16/2005 32 1 2 3 4 5 6 7 8 9 A BILL 10 11 TO AMEND THE CODE OF LAWS OF SOUTH CAROLINA, 12 1976, SO AS TO ENACT THE “IDENTITY THEFT 13 PROTECTION ACT”, BY ADDING CHAPTER 20 TO TITLE 37 14 PROVIDING FOR PROTECTIONS IN CONNECTION WITH 15 CONSUMER CREDIT-REPORTING AGENCIES AND WITH 16 THE USE AND COMMUNICATION OF A CONSUMER’S 17 SOCIAL SECURITY NUMBER, IMPOSITION OF A 18 SECURITY FREEZE ON A CONSUMER’S CREDIT REPORT, 19 PRESCRIPTION OF MEASURES FOR DISPOSAL OF 20 PERSONAL IDENTIFYING INFORMATION AND 21 DISCLOSURE OF UNAUTHORIZED ACCESS TO PERSONAL 22 IDENTIFYING INFORMATION, AND CIVIL DAMAGES, 23 INCLUDING ATTORNEY’S FEES AND COSTS AND 24 INJUNCTIVE RELIEF; BY REDESIGNATING THE FAMILY 25 PRIVACY PROTECTION ACT OF CHAPTER 2, TITLE 30, AS 26 ARTICLE 1 AND BY ADDING ARTICLE 3 PROVIDING FOR 27 PROTECTION OF PERSONAL IDENTIFYING 28 INFORMATION PRIVACY IN CONNECTION WITH A 29 PUBLIC BODY AND ITS USE AND COMMUNICATION OF A 30 RESIDENT’S SOCIAL SECURITY NUMBER, PRESCRIPTION 31 FOR DISCLOSURE OF SOCIAL SECURITY INFORMATION 32 AND IDENTIFYING INFORMATION BY AND TO CERTAIN 33 PUBLIC BODIES, PROHIBITION OF REQUIRING THE USE 34 OF PERSONAL IDENTIFYING INFORMATION ON A 35 MORTGAGE AND IN PREPARATION OF DOCUMENTS FOR 36 PUBLIC FILING; AND PROCEDURE FOR REDACTING 37 CERTAIN PERSONAL IDENTIFYING INFORMATION FROM 38 PUBLIC RECORDS; BY ADDING SECTION 16-13-540 SO AS 39 TO PROVIDE FOR THE EXPUNCTION OF THE CRIMINAL 40 RECORD OF A NAMED INDIVIDUAL INCURRED AS A 41 RESULT OF THE UNLAWFUL USE OF HIS IDENTIFYING 42 INFORMATION; BY ADDING SECTION 16-13-550 SO AS TO

1 [4297] 1 1 PROVIDE FOR REPORTING OF THE CRIME OF FINANCIAL 2 IDENTITY FRAUD TO THE LOCAL LAW ENFORCEMENT 3 AGENCY AND REFERENCE BY THE LOCAL AGENCY TO 4 THE AGENCY WITH JURISDICTION TO INVESTIGATE 5 AND PROSECUTE; BY AMENDING SECTION 16-13-510, 6 RELATING TO THE OFFENSE OF FINANCIAL IDENTITY 7 FRAUD, SO AS TO INCLUDE THE USE OF ANOTHER’S 8 INFORMATION TO OBTAIN ANYTHING OF VALUE, 9 INCLUDING CREDIT, TO AVOID LEGAL CONSEQUENCES, 10 OR TO OBTAIN EMPLOYMENT, AND TO PROVIDE, FOR 11 EXCEPTIONS, TO FURTHER DEFINE “IDENTIFYING 12 INFORMATION”, AND TO PROVIDE FOR CRIMINAL 13 PENALTIES, INCLUDING RESTITUTION; BY AMENDING 14 SECTION 16-13-520, RELATING TO PROSECUTION OF THE 15 CRIME OF FINANCIAL IDENTITY FRAUD, SO AS TO 16 FURTHER PROVIDE FOR THE COUNTY IN WHICH THE 17 CRIME IS CONSIDERED TO HAVE BEEN COMMITTED; BY 18 ADDING SECTION 1-11-490 SO AS TO PROVIDE FOR 19 DISCLOSURE BY AN AGENCY OF THIS STATE OF 20 UNAUTHORIZED ACCESS TO THE PERSONAL 21 IDENTIFYING INFORMATION OF A RESIDENT WHOSE 22 INFORMATION THE AGENCY OWNS OR LICENSES AND 23 TO PROVIDE FOR CIVIL DAMAGES, ATTORNEY’S FEES, 24 AND INJUNCTIVE RELIEF; AND TO PROVIDE VARIOUS 25 EFFECTIVE DATES. 26 27 Be it enacted by the General Assembly of the State of South 28 Carolina: 29 30 SECTION 1. This act may be cited as the “Identity Theft 31 Protection Act”. 32 33 SECTION 2. Title 37 of the 1976 Code is amended by adding: 34 35 “CHAPTER 20 36 37 Identity Theft Protection 38 39 Section 37-20-10. For purposes of this chapter: 40 (1) ‘Consumer’ means an individual residing in the State of 41 South Carolina who undertakes a transaction for personal, family, 42 or household purposes.

1 [4297] 2 1 (2) ‘Consumer credit-reporting agency’ means a person that, 2 for monetary fees or dues, or on a cooperative nonprofit basis, 3 regularly engages in whole or in part in the practice of assembling 4 or evaluating consumer credit information or other information 5 about consumers for the purpose of furnishing consumer reports to 6 third parties. 7 (3) ‘Consumer report’ or ‘credit report’ means any written, 8 oral, electronic, or other communication of information by a 9 consumer credit-reporting agency regarding a consumer’s 10 creditworthiness, credit standing, credit capacity, character, debts, 11 general reputation, personal characteristics, or mode of living that 12 is used or expected to be used or collected in whole or in part for 13 the purpose of establishing a consumer’s eligibility for any of the 14 following: 15 (a) credit to be used primarily for personal, family, or 16 household purposes; 17 (b) employment purposes means the use of a consumer 18 report for the purpose of evaluating a consumer for employment, 19 promotion, reassignment, or retention as an employee; 20 (c) any other purpose authorized pursuant to 15 U.S.C. 21 Section 168lb. 22 ‘Consumer report’ or ‘credit report’ does not include a report 23 containing information as to a transaction between the consumer 24 and the person making the report; an authorization or approval by 25 the issuer of a credit card or similar device, directly or indirectly, 26 of a specific extension of credit; or a report in which a person 27 conveys an adverse decision in response to a request from a third 28 party to make a specific extension of credit, directly or indirectly, 29 to the consumer, if the third party advises the consumer of the 30 name and address of the person to whom the request was made and 31 the person makes the required disclosures to the consumer 32 pursuant to the provisions of the federal ‘Fair Credit Reporting 33 Act’. 34 (4) ‘Credit card’ has the same meaning as in Section 103 of the 35 Truth in Lending Act, 15 U.S.C. Section 160 and includes a lender 36 credit card, as defined in Section 37-1-301(16) and a seller credit 37 card, as defined in Section 37-1-301(26). 38 (5) ‘Creditworthiness’ means an entry in a consumer’s credit 39 file that affects the ability of a consumer to obtain and retain 40 credit, employment, business or professional licenses, investment 41 opportunities, or insurance. Entries affecting creditworthiness 42 include, but are not limited to, payment information, defaults,

1 [4297] 3 1 judgments, liens, bankruptcies, collections, records of arrest and 2 indictments, and multiple credit inquiries. 3 (6) ‘Debit card’ means a card or device issued by a financial 4 institution to a consumer for use in initiating an electronic fund 5 transfer from the account holding assets of the consumer at that 6 financial institution, for the purpose of transferring money between 7 accounts or obtaining money, property, labor, or services. 8 (7) ‘Disposal’ means the: 9 (a) discarding or abandonment of records containing 10 personal identifying information; or 11 (b) sale, donation, discarding, or transfer of any medium, 12 including computer equipment or computer media, containing 13 records of personal identifying information, other nonpaper media 14 upon which records of personal identifying information are stored, 15 or other equipment for nonpaper storage of information. 16 (8) ‘Person’ means an individual, sole proprietorship, 17 partnership, corporation, trust, estate, cooperative, association, 18 government or governmental subdivision or agency, or other 19 entity. 20 (9) ‘Personal identifying information’ means an individual’s 21 first name or first initial and last name in combination with 22 identifying information as defined in Section 16-13-510(C). 23 ‘Personal identifying information’ does not include publicly 24 available directories containing information an individual has 25 voluntarily consented to have publicly disseminated or listed, 26 including name, address, and telephone number. 27 (10) ‘Proper identification’ means information generally 28 considered sufficient to identify a person. If a person is unable 29 reasonably to identify himself or herself with the information 30 described in item (9), a consumer reporting agency may require 31 additional information concerning the consumer’s employment and 32 personal or family history in order to verify the consumer’s 33 identity. 34 (11) ‘Records’ means material on which written, drawn, spoken, 35 visual, or electromagnetic information is recorded or preserved, 36 regardless of physical form or characteristics. 37 (12) ‘Security breach’ means an incident of unauthorized access 38 to, and acquisition of, records or data containing personal 39 identifying information that compromises the security, 40 confidentiality, or integrity of personal identifying information 41 maintained by a person. Good faith acquisition of personal 42 identifying information by an employee or agent of the person for 43 a legitimate purpose is not a security breach, if the personal

1 [4297] 4 1 identifying information is not used for a purpose other than a 2 lawful purpose of the person and is not subject to further 3 unauthorized disclosure. 4 (13) ‘Security freeze’ means a notice placed in a consumer 5 credit report, at the request of the consumer and subject to certain 6 exceptions, that prohibits the consumer credit-reporting agency 7 from releasing a credit report containing all or any part of the 8 consumer’s credit report or any information derived from it 9 without the express authorization of the consumer. 10 11 Section 37-20-20. (A) Except as provided in subsection (B) of 12 this section, a person may not: 13 (1) intentionally communicate or otherwise make available 14 to the general public a consumer’s social security number or a 15 portion of it containing six digits or more; 16 (2) intentionally print or imbed a consumer’s social security 17 number or any portion of it containing six digits or more on any 18 card required for the consumer to access products or services 19 provided by the person; 20 (3) require a consumer to transmit his social security number 21 or a portion of it containing six digits or more over the Internet, 22 unless the connection is secure or the social security number is 23 encrypted; 24 (4) require a consumer to use his social security number or a 25 portion of it containing six digits or more to access an Internet web 26 site, unless a password or unique personal identification number or 27 other authentication device is also required to access the Internet 28 web site; 29 (5) print a consumer’s social security number or a portion of 30 it containing six digits or more on materials that are mailed to the 31 individual, unless state or federal law requires the social security 32 number to be on the document to be mailed; 33 (6) sell, lease, loan, trade, rent, or otherwise intentionally 34 disclose a consumer’s social security number or a portion of it 35 containing six digits or more to a third party without written 36 consent to the disclosure from the consumer, unless the third party 37 seeking disclosure of the social security number does so for a 38 legitimate business purpose. A legitimate business purpose of the 39 third party includes locating an individual to provide a benefit to 40 that individual, such as a pension, insurance, or unclaimed 41 property benefit, or to find an individual who is missing or a lost 42 relative, or to serve civil process. A legitimate purpose of the third

1 [4297] 5 1 party does not include the bulk purchase or rental of social security 2 numbers or use in marketing. 3 (B) This section does not apply: 4 (1) if a social security number is included in an application 5 or in documents related to an enrollment process, or to establish an 6 account, contract, or policy, or to confirm the accuracy of the 7 social security number for the purpose of obtaining a credit report 8 pursuant to the federal Fair Credit Reporting Act. A social 9 security number that is permitted to be mailed pursuant to this 10 section may not be printed, in whole or in part, on a postcard or 11 other mailer not requiring an envelope or may not be visible on or 12 through the envelope; 13 (2) to the collection, use, or release of a social security 14 number for internal verification or administrative purposes; 15 (3) to the opening of an account or the provision of or 16 payment for a product or service authorized by a consumer; 17 (4) to the collection, use, or release of a social security 18 number to investigate or prevent fraud, conduct background 19 checks, conduct social or scientific research, collect a debt, or 20 obtain a credit report from or furnish data to a consumer reporting 21 agency, pursuant to the federal Fair Credit Reporting Act; 22 (5) to a person acting pursuant to a court order, warrant, 23 subpoena, or other legal process; 24 (6) to a person providing the social security number to a 25 federal, state, or local government entity, including a law 26 enforcement agency or court, or their agents or assigns. 27 (C) A violation of this section is a violation of Section 28 37-20-60. 29 30 Section 37-20-30. (A) A consumer who has reason to believe 31 he is the victim of financial identify fraud, as evidenced by a copy 32 of a valid police report, investigative report, or complaint made 33 pursuant to Section 16-13-510, may place a security freeze on his 34 credit report by making a request in writing by certified mail to a 35 consumer credit-reporting agency. A security freeze prohibits the 36 consumer credit-reporting agency from releasing the consumer’s 37 credit report or information from it without the express 38 authorization of the consumer. If a security freeze is in place, a 39 consumer credit-reporting agency may not release the consumer’s 40 credit report or information to a third party without prior express 41 authorization from the consumer. This subsection does not prevent 42 a consumer credit-reporting agency from advising a third party that

1 [4297] 6 1 a security freeze is in effect with respect to the consumer’s credit 2 report. 3 (B) A consumer credit-reporting agency shall place a security 4 freeze on a consumer’s credit report no later than five business 5 days after receiving a written request from the consumer. 6 (C) The consumer credit-reporting agency shall send a written 7 confirmation of the security freeze to the consumer within ten 8 business days of placing the freeze and, at the same time, provide 9 the consumer with a unique personal identification number or 10 password, other than the consumer’s social security number, to be 11 used by the consumer when providing authorization for the release 12 of the consumer’s credit report for a specific period of time. 13 (D) If the consumer wishes to allow the consumer’s credit 14 report to be accessed for a specific period of time while a freeze is 15 in place, the consumer shall communicate to the consumer 16 credit-reporting agency: 17 (1) proper identification; 18 (2) the unique personal identification number or password 19 provided by the consumer credit-reporting agency pursuant to 20 subsection (C) of this section; 21 (3) the request that the freeze be lifted temporarily and 22 proper information regarding the time period for which the report 23 must be available to users of the credit report or to only a properly 24 identified user. 25 (E) A consumer credit-reporting agency may develop 26 procedures involving the use of telephone, facsimile machine, the 27 Internet, or another electronic medium to receive and process a 28 request from a consumer to temporarily lift a freeze on a credit 29 report pursuant to this section. 30 (F) A consumer credit-reporting agency that receives a request 31 from a consumer to lift temporarily a freeze on a credit report 32 pursuant to this section shall comply with the request no later than 33 three business days after receiving the request. 34 (G) A consumer credit-reporting agency shall remove or lift 35 temporarily a freeze placed on a consumer’s credit report only: 36 (1) upon the consumer’s request, pursuant to this section; 37 (2) if the consumer’s credit report was frozen due to a 38 material misrepresentation of fact by the consumer. If a consumer 39 credit-reporting agency intends to remove a freeze upon a 40 consumer’s credit report pursuant to this item, the consumer 41 credit-reporting agency shall notify the consumer in writing five 42 business days before removing the freeze on the consumer’s credit 43 report.

1 [4297] 7 1 (H) If a third party requests access to a consumer credit report 2 on which a security freeze is in effect and this request is in 3 connection with an application for credit or other use and the 4 consumer does not allow the consumer’s credit report to be 5 accessed for that specific period of time, the third party may treat 6 the application as incomplete. 7 (I) If a consumer requests a security freeze pursuant to this 8 section, the consumer credit-reporting agency shall disclose to the 9 consumer the process for placing and temporarily lifting a security 10 freeze and the process for allowing access to information from the 11 consumer’s credit report for a specific period of time while the 12 security freeze is in place. 13 (J) A security freeze must remain in place until the consumer 14 requests that the security freeze be removed. A consumer 15 credit-reporting agency shall remove a security freeze within three 16 business days of receiving a request for removal from the 17 consumer, who provides: 18 (1) proper identification; 19 (2) the unique personal identification number or password 20 provided by the consumer credit-reporting agency pursuant to 21 subsection (C) of this section. 22 (K) A consumer credit-reporting agency shall require proper 23 identification of the person making a request to place or remove a 24 security freeze. 25 (L) If a security freeze is in place, a consumer credit-reporting 26 agency may not change any of the following official information in 27 a credit report without sending a written confirmation of the 28 change to the consumer within thirty days of the change being 29 posted to the consumer’s file: name, date of birth, social security 30 number, and address. Written confirmation is not required for 31 technical modifications of a consumer’s official information, 32 including name and street abbreviations, complete spellings, or 33 transposition of numbers or letters. In the case of an address 34 change, the written confirmation must be sent to both the new 35 address and the former address. 36 (M) The provisions of this section do not apply to the use of a 37 consumer credit report by a: 38 (1) person, or the person’s subsidiary, affiliate, agent, 39 subcontractor, or assignee with which the consumer has, or before 40 assignment had, an account, contract, or debtor-creditor 41 relationship for the purposes of reviewing the account or collecting 42 the financial obligation owing for the account, contract, or debt;

1 [4297] 8 1 (2) subsidiary, affiliate, agent, assignee, or prospective 2 assignee of a person to whom access has been granted pursuant to 3 subsection (D) of this section for purposes of facilitating the 4 extension of credit or other permissible use; 5 (3) person acting pursuant to a court order, warrant, or 6 subpoena; 7 (4) state or local agency, or its agents or assigns, which 8 administers a program for establishing and enforcing child support 9 obligations; 10 (5) state or local agency, or its agents or assigns, acting to 11 investigate fraud, including Medicaid fraud, or acting to 12 investigate or collect delinquent taxes or assessments, including 13 interest and penalties, unpaid court orders or to fulfill any of its 14 other statutory responsibilities; 15 (6) federal, state, or local governmental entity, including law 16 enforcement agency or court, their agent or assigns; 17 (7) person for the purposes of prescreening as defined by the 18 federal Fair Credit Reporting Act; 19 (8) person for the sole purpose of providing for a credit file 20 monitoring subscription service to which the consumer has 21 subscribed; 22 (9) consumer reporting agency for the purpose of providing 23 a consumer with a copy of the consumer’s credit report upon the 24 consumer’s request; 25 (10) depository financial institution for checking, savings, and 26 investment accounts. 27 (N) The following persons are not required to place in a credit 28 report a security freeze pursuant to this section; except that any 29 person exempt pursuant to the provisions of item (3) of this 30 subsection is subject to a security freeze placed on a credit report 31 by another consumer credit-reporting agency from which it obtains 32 information: 33 (1) a check services or fraud prevention services company, 34 which reports on incidents of fraud or issues authorizations for the 35 purpose of approving or processing negotiable instruments, 36 electronic fund transfers, or similar methods of payments; 37 (2) a deposit account information service company, which 38 issues reports regarding account closures due to fraud, substantial 39 overdrafts, ATM abuse, or other similar negative information 40 regarding a consumer to inquiring banks or other financial 41 institutions for use only in reviewing a consumer request for a 42 deposit account at the inquiring bank or financial institution; 43 (3) a consumer reporting agency that:

1 [4297] 9 1 (a) acts only to resell credit information by assembling 2 and merging information contained in a database of one or more 3 credit-reporting agencies; and 4 (b) does not maintain a permanent database of credit 5 information from which new credit reports are produced. 6 (O) A consumer credit-reporting agency may not charge a fee 7 to a victim of identity theft who has submitted a copy of a valid 8 investigative or incident report or complaint with a law 9 enforcement agency about the unlawful use of the victim’s 10 personal identifying information by another person. 11 (P) At any time that a consumer is required to receive a 12 summary of rights required pursuant to Section 609 of the federal 13 Fair Credit Reporting Act, the following notice must be included: 14 ‘South Carolina Consumers Have the Right to Obtain a Security 15 Freeze. You have a right to place a security freeze on your credit 16 report pursuant to South Carolina law. The security freeze 17 prohibits a consumer credit-reporting agency from releasing 18 information in your credit report without your express 19 authorization. A security freeze must be requested in writing by 20 certified mail. The security freeze is designed to prevent credit, 21 loans, and services from being approved in your name without 22 your consent. However, you should be aware that using a security 23 freeze to take control over who gains access to the personal and 24 financial information in your credit report may delay, interfere 25 with, or prohibit the timely approval of a later request or 26 application you make regarding new loans, credit, mortgage, 27 insurance, rental housing, employment, investment, license, 28 cellular phone, utilities, digital signature, Internet credit card 29 transactions, or other services, including an extension of credit at 30 point of sale. You can remove a freeze or authorize temporary 31 access for a specific period of time by contacting the consumer 32 reporting agency and providing all of the following: 33 (1) your personal identification number or password 34 provided to you by the agency; 35 (2) proper identification to verify your identity; and 36 (3) proper information regarding the period of time you want 37 your report available to users of the credit report. The consumer 38 credit-reporting agency may not charge any amount to a victim of 39 identify theft who has submitted a copy of a valid investigative or 40 incident report or complaint with a law enforcement agency about 41 the unlawful use of the victim’s identifying information by another 42 person. You have a right to bring a civil action against a consumer

1 [4297] 10 1 credit-reporting agency who violates your rights pursuant to the 2 credit reporting laws.’ 3 (Q)(1) A consumer credit-reporting agency that wilfully violates 4 a provision of this section is liable for three times the amount of 5 actual damages or one thousand dollars for each incident, 6 whichever is greater, as well as reasonable attorney’s fees and 7 costs. 8 (2) A consumer credit-reporting agency that negligently 9 violates this section is liable for the greater of actual damages or 10 one thousand dollars for each incident, as well as reasonable 11 attorney’s fees and costs. 12 (3) In addition to the damages assessed pursuant to items (1) 13 and (2), if the injury is to the consumer’s creditworthiness, credit 14 standing, credit capacity, character, general reputation, 15 employment options, or eligibility for insurance, and results from 16 the failure to place and enforce the security freeze and the failure is 17 not corrected by the consumer credit-reporting agency within ten 18 days after the entry of a judgment for damages, the assessed 19 damages must be increased to one thousand dollars each day until 20 the security freeze is imposed. 21 22 Section 37-20-40. (A) A person conducting business in this 23 State and owning, licensing, maintaining, or otherwise possessing 24 personal identifying information of a consumer resident of this 25 State, in any form, must take all reasonable measures to protect 26 against unauthorized access to or use of the information in 27 connection with or after its disposal. 28 (B) The reasonable measures must include: 29 (1) implementing and monitoring compliance with policies 30 and procedures that require: 31 (a) burning, pulverizing, or shredding of papers 32 containing personal identifying information so that information 33 cannot be practicably read or reconstructed; and 34 (b) destruction or erasure of electronic media and other 35 nonpaper media containing personal identifying information so 36 that the information cannot practicably be read or reconstructed; 37 and 38 (2) describing procedures relating to the adequate 39 destruction or proper disposal of personal records as official policy 40 in the writings of the business entity. 41 (C) A person, after due diligence, may enter into a written 42 contract with, and must monitor compliance by, another party 43 engaged in the business of record destruction to destroy personal

1 [4297] 11 1 identifying information in a manner consistent with this section. 2 Due diligence ordinarily includes one or more of the following: 3 (1) reviewing an independent audit of the disposal business’s 4 operations or its compliance with this statute or its equivalent; 5 (2) obtaining information about the disposal business from 6 several references or other reliable sources and requiring that the 7 disposal business be certified by a recognized trade association or 8 similar third party with a reputation for high standards of quality 9 review; 10 (3) reviewing and evaluating the disposal business’s 11 information security policies or procedures or taking other 12 appropriate measures to determine the competency and integrity of 13 the disposal business. 14 (D) A disposal business that conducts business in this State or 15 disposes of personal identifying information of residents of this 16 State must take all reasonable measures to dispose of records 17 containing personal identifying information by implementing and 18 monitoring compliance with policies and procedures that protect 19 against unauthorized access to or use of personal identifying 20 information during or after the collection and transportation and 21 disposing of the information. 22 (E) This section does not apply to: 23 (1) a bank or financial institution that is subject to and in 24 compliance with the privacy and security provision of the 25 Gramm-Leach-Bliley Act; 26 (2) a health insurer that is subject to and in compliance with 27 the standards for privacy of individually identifiable health 28 information and the security standards for the protection of 29 electronic health information of the Health Insurance Portability 30 and Accountability Act of 1996; 31 (3) a consumer credit reporting agency that is subject to and 32 in compliance with the federal Fair Credit Reporting Act. 33 (F) A violation of this section is a violation of Section 34 37-20-60. 35 36 Section 37-20-50. (A) A person conducting business in this 37 State owning, licensing, maintaining, or otherwise possessing 38 personal identifying information of consumer residents of this 39 State, in any form, must provide notice to the affected resident of a 40 security breach following discovery or notification of the breach. 41 The disclosure notification must be made without unreasonable 42 delay, consistent with the legitimate needs of law enforcement, as 43 provided in subsection (B) of this section, or with measures

1 [4297] 12 1 necessary to determine the scope of the breach and restore the 2 reasonable integrity, security, and confidentiality of the data 3 system. 4 (B) The notice required by this section may be delayed if a law 5 enforcement agency determines in writing that notification may 6 impede a criminal investigation or jeopardize national or homeland 7 security. The notice required by this section must be provided 8 immediately after the law enforcement agency determines that 9 notice will no longer impede the investigation or jeopardize 10 national or homeland security. 11 (C) The notice must be clear and conspicuous. The notice must 12 include a description of the following: 13 (1) the incident in general terms; 14 (2) the type of consumer resident’s personal identifying 15 information that was subject to the unauthorized access and 16 acquisition; 17 (3) the acts of the person to protect the personal identifying 18 information from further unauthorized access; 19 (4) a telephone number that the consumer resident may call 20 for further information and assistance; 21 (5) advice that directs the consumer resident to remain 22 vigilant over the next twelve to twenty-four months by reviewing 23 account statements and monitoring free credit reports. 24 (D) For purposes of this section, notice to affected consumer 25 residents may be provided by one of the following methods: 26 (1) written notice; 27 (2) electronic notice, for those consumer residents for whom 28 it has a valid e-mail address and who have agreed to receive 29 communications electronically, if the notice provided is consistent 30 with the provisions regarding electronic records and signatures for 31 notices legally required to be in writing set forth in Section 7001 of 32 Title 15 of the United State Code and Chapter 6 of Title 26 of the 33 1976 Code; 34 (3) substitute notice, if the person demonstrates that the cost 35 of providing notice would exceed two hundred fifty thousand 36 dollars or that the affected class of subject consumer residents to 37 be notified exceeds five hundred thousand, or if the person does 38 not have sufficient contact information for only those affected 39 consumer residents without sufficient contact information, or if the 40 person is unable to identify particular affected consumer residents, 41 for only those unidentifiable affected consumer residents. 42 Substitute notice must consist of all the following:

1 [4297] 13 1 (a) e-mail notice when the person has an electronic mail 2 address for the subject consumer residents; 3 (b) conspicuous posting of the notice on the person’s web 4 site page, if one is maintained; 5 (c) notification to major statewide media. 6 (E) If a person provides notice to more than one thousand 7 consumers residents at one time pursuant to this section, the person 8 shall notify, without unreasonable delay, the South Carolina 9 Department of Consumer Affairs and all consumer reporting 10 agencies that compile and maintain files on consumers on a 11 nationwide basis as defined in 15 U.S.C. Section 1681a(p), of the 12 timing, distribution, and content of the notice. 13 (F) A financial institution that is subject to and in compliance 14 with the Federal Interagency Guidance Response Programs for 15 Unauthorized Access to Consumer Information and Customer 16 Notice, issued on March 7, 2005, by the Board of Governors of the 17 Federal Reserve System, the Federal Deposit Insurance 18 Corporation, the Office of the Comptroller of the Currency, and 19 the Office of Thrift Supervision, and any revisions, additions, or 20 substitutions relating to that interagency guidance, is considered to 21 be in compliance with this section. 22 (G) A violation of this section is a violation of Section 23 37-20-60. 24 25 Section 37-20-60. Except as provided in Section 37-20-30(Q), 26 a consumer whose property or person is injured by reason of an act 27 made unlawful by this chapter may sue for civil damages in an 28 amount of up to five thousand dollars, but no less than five 29 hundred dollars for each incident, or three times the amount of 30 actual damages, whichever amount is greater. A consumer seeking 31 damages as set forth in this section also may institute a civil action 32 to enjoin and restrain future acts that would constitute a violation 33 of this chapter. The court, in an action brought pursuant to this 34 chapter, may award reasonable attorney’s fees and costs to the 35 prevailing party. 36 37 Section 37-20-70. The provisions of this chapter are 38 cumulative, and an action taken pursuant to this chapter is not an 39 election to take that action to the exclusion of other action 40 authorized by law.” 41 42 SECTION 3. A.Chapter 2 of Title 30 of the 1976 Code is 43 redesignated as “Article 1, Family Privacy Protection Act”.

1 [4297] 14 1 2 B.Chapter 2 of Title 30 of the 1976 Code is amended by adding: 3 4 “Article 3 5 6 Personal Identifying Information Privacy Protection 7 8 Section 30-2-300. The General Assembly finds: 9 (1) The social security number can be used as a tool to 10 perpetuate fraud against an individual and to acquire sensitive 11 personal, financial, medical, and familial information, the release 12 of which could cause great financial or personal harm to the 13 individual. While the social security number was intended to be 14 used solely for the administration of the federal Social Security 15 System, over time this unique numeric identifier has been used 16 extensively for identity verification purposes and other legitimate 17 consensual purposes. 18 (2) Although there are legitimate reasons for State and local 19 government entities to collect social security numbers and other 20 personal identifying information from individuals, government 21 should collect the information only for legitimate purposes or 22 when required by law. 23 (3) When State and local government entities possess social 24 security numbers or other personal identifying information, the 25 governments should minimize the instances this information is 26 disseminated either internally within government or externally 27 with the general public. 28 29 Section 30-2-310. Except as provided in Sections 30-2-320 and 30 30-2-330 of this article, a public body, as defined in Section 31 30-1-10(B) may not: 32 (1) collect a social security number or any portion of it 33 containing six digits or more from an individual unless authorized 34 by law to do so or unless the collection of the social security 35 number is otherwise imperative for the performance of that body’s 36 duties and responsibilities as prescribed by law. Social security 37 numbers collected by a public body must be relevant to the 38 purpose for which collected and must not be collected until and 39 unless the need for social security numbers has been clearly 40 documented; 41 (2) fail, when collecting a social security number or portion 42 of it containing six digits or more from an individual, to segregate 43 that number on a separate page from the rest of the record, or as

1 [4297] 15 1 otherwise appropriate, so that the social security number may be 2 easily redacted pursuant to a public records request; 3 (3) fail, when collecting a social security number or any 4 portion of it containing six digits or more from an individual, to 5 provide, at the time of or before the actual collection of the social 6 security number by that public body, upon request of the 7 individual, a statement of the purpose or purposes for which the 8 social security number is being collected and used; 9 (4) use the social security number or a portion of it 10 containing six digits or more for any purpose other than the 11 purpose stated; 12 (5) intentionally communicate or otherwise make available 13 to the general public an individual’s social security number or a 14 portion of it containing six digits or more or other personal 15 identifying information. ‘Personal identifying information’, as 16 used in this section, has the same meaning as ‘identifying 17 information’ in Section 16-13-510, except that it does not include 18 electronic identification names, including electronic mail 19 addresses, or parent’s legal surname before marriage; 20 (6) intentionally print or imbed an individual’s social 21 security number or a portion of it containing six digits or more on 22 any card required for the individual to access government services; 23 (7) require an individual to transmit the individual’s social 24 security number or a portion of it containing six digits or more 25 over the Internet, unless the connection is secure or the social 26 security number is encrypted; 27 (8) require an individual to use the individual’s social 28 security number or a portion of it containing six digits or more to 29 access an Internet web site, unless a password or unique personal 30 identification number or other authentication device is also 31 required to access the Internet web site; 32 (9) print an individual’s social security number or a portion 33 of it containing six digits or more on materials that are mailed to 34 the individual, unless state or federal law requires the social 35 security number be on the mailed document. 36 37 Section 30-2-320. Social security numbers and identifying 38 information may be disclosed: 39 (1) to another governmental entity or its agents, employees, 40 or contractors, if disclosure is necessary for the receiving entity to 41 perform its duties and responsibilities. The receiving 42 governmental entity and its agents, employees, and contractors

1 [4297] 16 1 shall maintain the confidential and exempt status of those 2 numbers; 3 (2) pursuant to a court order, warrant, or subpoena; 4 (3) for public health purposes; 5 (4) on certified copies of vital records issued by the Director 6 of the Department of Health and Environmental Control as the 7 State Registrar, pursuant to Section 44-63-30 and authorized 8 officials pursuant to Section 44-63-40. The State Registrar may 9 disclose personal identifying information other than social security 10 number on an uncertified vital record; 11 (5) on a recorded document in the official records of the 12 county; 13 (6) on a document filed in the official records of the courts. 14 15 Section 30-2-330 (A) A person preparing or filing a document 16 to be recorded or filed in the official records by the register of 17 deeds or the clerk of court of a county may not include an 18 individual’s social security, driver’s license, state identification, 19 passport, checking account, savings account, credit card, or debit 20 card number, or personal identification (PIN) code, or passwords 21 in that document, unless otherwise expressly required by law or 22 court order or rule adopted by the State Registrar on records of 23 vital events. A loan closing instruction that requires the inclusion 24 of an individual’s social security number on a document to be 25 recorded is void. A person who violates this subsection is guilty of 26 a misdemeanor, punishable by a fine not to exceed five hundred 27 dollars for each violation. 28 (B) Notwithstanding Section 30-1-30, or another provision of 29 law, an individual or his attorney-in-fact or legal guardian may 30 request that a register of deeds or clerk of court remove, from an 31 image or copy of an official record placed on a publicly available 32 Internet web site or a publicly available Internet web site used by a 33 register of deeds or court to display public records by the register 34 of deeds or clerk of court, the individual’s social security, driver’s 35 license, state identification, passport, checking account, savings 36 account, credit card, debit card number, or personal identification 37 (PIN) code or passwords contained in that official record. The 38 request must be made in writing, legibly signed by the requester, 39 and delivered by mail, facsimile, or electronic transmission, or 40 delivered in person to the register of deeds or clerk of court. The 41 request must specify the identification page number that contains 42 the social security, driver’s license, state identification, passport, 43 checking account, savings account, credit card, debit card

1 [4297] 17 1 numbers, or personal identification (PIN) code or passwords to be 2 redacted. The register of deeds or clerk of court has no duty to 3 inquire beyond the written request to verify the identity of an 4 individual requesting redaction. A fee must not be charged for the 5 redaction pursuant to the request. 6 (C) A register of deeds or clerk of court immediately and 7 conspicuously shall post signs throughout his offices for public 8 viewing and a notice on any Internet web site or remote electronic 9 site made available by the register of deeds or clerk of court and 10 used for the ordering or display of official records or images or 11 copies of official records a notice, stating, in substantially similar 12 form, the following: 13 ‘A person preparing or filing a document for recordation or 14 filing in the official records may not include a social security, 15 driver’s license, state identification, passport, checking account, 16 savings account, credit card, debit card number, or personal 17 identification (PIN) code, or passwords in the document, unless 18 expressly required by law. An individual has a right to request a 19 register of deeds or clerk of court to remove, from an image or 20 copy of an official record placed on a publicly available Internet 21 web site or on a publicly available Internet web site used by a 22 register of deeds or clerk of court to display public records, any 23 social security, drivers license, state identification, passport, 24 checking account, savings account, credit card, debit card number, 25 or personal identification (PIN) code, or passwords contained in an 26 official record. The request must be made in writing and delivered 27 by mail, facsimile, or electronic transmission or in person, to the 28 register of deeds or clerk of court. The request must specify the 29 identification page number that contains the social security, 30 driver’s license, state identification, passport, checking account, 31 savings account, credit card, debit card number, or personal 32 identification (PIN) code, or passwords to be redacted. There is no 33 fee for the redaction pursuant to request.’ 34 35 Section 30-2-340. Any affected individual may petition the 36 court for an order directing compliance with this section. Liability 37 may not accrue to a register of deeds or clerk of court or to his 38 agents for claims or damages that arise from a social security 39 number or other identifying information on the public record.” 40 41 SECTION 4. A.Article 2, Chapter 13, Title 16 of the 1976 Code 42 is amended by adding: 43

1 [4297] 18 1 “Section 16-13-540. (A) If a person is named in a charge for 2 an infraction or a crime, either a misdemeanor or a felony, as a 3 result of another person using the identifying information of the 4 named person the charge against the named person is dismissed, a 5 finding of not guilty is entered, or the conviction is set aside, the 6 named person may apply by petition or written motion to the court 7 where the charge was last pending on a form approved by the 8 Office of Court Administration and supplied by the clerk of court 9 for an order to expunge from all official records entries relating to 10 the person’s apprehension, charge, or trial. The court, after notice 11 to the county solicitor, shall hold a hearing on the motion or 12 petition and, upon finding that the person’s identity was used 13 without permission and the charges were dismissed or the person 14 was found not guilty, the court shall order the expunction. 15 16 Section 16-13-550. (A) A person who learns or reasonably 17 suspects that he is the victim of financial identity fraud may 18 contact the local law enforcement agency that has jurisdiction over 19 the person’s actual residence. If jurisdiction lies elsewhere for 20 investigation and prosecution of a crime of financial identity fraud, 21 the local law enforcement agency may take the complaint, issue an 22 incident report, provide the complainant with a copy of the report, 23 and refer the report to a law enforcement agency in that different 24 jurisdiction. 25 (B) This section does not interfere with the discretion of a local 26 law enforcement agency to allocate resources for investigations of 27 crimes. A complaint filed or report issued pursuant to this section 28 is not required to be counted as an open case for purposes of 29 compiling open case statistics.” 30 31 B.Sections 16-13-510 and 16-13-520 of the 1976 Code, both as 32 added by Act 305 of 2000, are amended to read: 33 34 “Section 16-13-510. (A) It is unlawful for a person to commit 35 the offense of financial identity fraud. 36 (B) A person is guilty of financial identity fraud when he, 37 without the authorization or permission of another person and with 38 the intent of unlawfully appropriating the financial resources of 39 that person to his own use or the use of a third party: 40 (1) obtains or records identifying information which would 41 assist in accessing the financial records of the other person; or

1 [4297] 19 1 (2) accesses or attempts to access the financial resources of 2 the other person through the use of identifying information as 3 defined in subsection (C); 4 (3) knowingly obtains, possesses, or uses identifying 5 information of another person, living or dead, with the intent to 6 fraudulently represent that he is the other person for the purpose 7 of: 8 (a) making financial or credit transactions in the other 9 person’s name; 10 (b) obtaining anything of value, benefit, or advantage; 11 (c) avoiding legal consequences; or 12 (d) obtaining employment. 13 (C) ‘Identifying information’ as used in this article includes the 14 following: 15 (1) social security numbers; 16 (2) driver’s license, state identification card, or passport 17 numbers; 18 (3) checking account numbers; 19 (4) savings account numbers; 20 (5) credit card numbers; 21 (6) debit card numbers; 22 (7) personal identification numbers (PIN); 23 (8) electronic identification numbers, electronic mail, 24 Internet accounts or Internet identification; 25 (9) digital signatures; or 26 (10) other numbers or information which may be used to 27 access a person’s financial resources; 28 (11) biometric data; 29 (12) fingerprints; 30 (13) passwords; 31 (14) parent’s legal surname before marriage. 32 (D) It is not a violation of this article for a person lawfully to: 33 (1) obtain credit information in the course of a bona fide 34 consumer or commercial transaction; 35 (2) exercise, in good faith, a security interest or a right of 36 offset by a creditor or financial institution; 37 (3) comply, in good faith, with any warrant, court order, 38 levy, garnishment, attachment, or other judicial or administrative 39 order, decree, or directive, when the person is required to do so. 40 (D) (E) A person who violates the provisions of this section 41 article is guilty of a felony and, upon conviction, must be fined in 42 the discretion of the court or imprisoned not more than ten years,

1 [4297] 20 1 or both. The court may order restitution to the victim pursuant to 2 the provisions of Section 17-25-322. 3 4 Section 16-13-520. In a criminal proceeding brought pursuant to 5 this article, the crime is considered to have been committed in a 6 the county in which a where the victim resides, where the 7 perpetrator resides, where any part of the financial identity fraud 8 took place, or in any other county instrumental to the completion 9 of the offense, regardless of whether the defendant was ever 10 actually present in that county.” 11 12 SECTION 5. Article 1, Chapter 1 of Title 11 of the 1976 Code is 13 amended by adding: 14 15 “Section 1-11-490. (A) An agency of this State owning or 16 licensing computerized data that includes personal identifying 17 information shall disclose a breach of the security of the system 18 following discovery or notification of the breach in the security of 19 the data to a resident of this State whose unencrypted personal 20 identifying information was, or is reasonably believed to have 21 been, acquired by an unauthorized person. The disclosure must be 22 made in the most expedient time possible and without 23 unreasonable delay, consistent with the legitimate needs of law 24 enforcement, as provided in subsection (C), or with measures 25 necessary to determine the scope of the breach and restore the 26 reasonable integrity of the data system. 27 (B) An agency maintaining computerized data that includes 28 personal identifying information that the agency does not own 29 shall notify the owner or licensee of the information of a breach of 30 the security of the data immediately following discovery, if the 31 personal identifying information was, or is reasonably believed to 32 have been, acquired by an unauthorized person. 33 (C) The notification required by this section may be delayed if 34 a law enforcement agency determines that the notification impedes 35 a criminal investigation. The notification required by this section 36 must be made after the law enforcement agency determines that it 37 no longer compromises the investigation. 38 (D) For purposes of this section: 39 (1) ‘Agency’ means any agency, department, board, 40 commission, committee, or institution of higher learning of the 41 State or a political subdivision of it. 42 (2) ‘Breach of the security of the system’ means 43 unauthorized access to, and acquisition of, computerized data that

1 [4297] 21 1 compromises the security, confidentiality, or integrity of personal 2 identifying information maintained by the agency. Good faith 3 acquisition of personal identifying information by an employee or 4 agent of the agency for the purposes of the agency is not a breach 5 of the security of the system if the personal identifying information 6 is not used or subject to further unauthorized disclosure. 7 (3) ‘Personal identifying information’ has the same meaning 8 as ‘identifying information’ in Section 16-13-510(C). 9 (E) The notice required by this section may be provided by: 10 (1) written notice; 11 (2) electronic notice, if the notice provided is consistent with 12 the provisions regarding electronic records and signatures set forth 13 in Section 7001 of Title 15 of the United States Code and Chapter 14 6 of Title 26 of the 1976 Code; 15 (3) substitute notice, if the agency demonstrates that the cost 16 of providing notice exceeds two hundred fifty thousand dollars or 17 that the affected class of subject residents to be notified exceeds 18 five hundred thousand or the agency has insufficient contact 19 information. Substitute notice consists of: 20 (a) e-mail notice when the agency has an e-mail address 21 for the subject residents; 22 (b) conspicuous posting of the notice on the agency’s web 23 site page, if the agency maintains one; 24 (c) notification to major statewide media. 25 (F) Notwithstanding subsection (E), an agency that maintains 26 its own notification procedures as part of an information security 27 policy for the treatment of personal identifying information and is 28 otherwise consistent with the timing requirements of this section is 29 considered to be in compliance with the notification requirements 30 of this section if it notifies subject residents in accordance with its 31 policies in the event of a breach of security of the system. 32 (G) A resident of this State who is injured by a violation of this 33 section, in addition to and cumulative of all other rights and 34 remedies available at law, may: 35 (1) institute a civil action to recover damages; 36 (2) seek an injunction to enforce compliance; 37 (3) recover attorney’s fee and court costs, if successful.” 38 39 SECTION 6. The repeal or amendment by this act of any law, 40 whether temporary or permanent or civil or criminal, does not 41 affect pending actions, rights, duties, or liabilities founded thereon, 42 or alter, discharge, release or extinguish any penalty, forfeiture, or 43 liability incurred under the repealed or amended law, unless the

1 [4297] 22 1 repealed or amended provision shall so expressly provide. After 2 the effective date of this act, all laws repealed or amended by this 3 act must be taken and treated as remaining in full force and effect 4 for the purpose of sustaining any pending or vested right, civil 5 action, special proceeding, criminal prosecution, or appeal existing 6 as of the effective date of this act, and for the enforcement of 7 rights, duties, penalties, forfeitures, and liabilities as they stood 8 under the repealed or amended laws. 9 10 SECTION 7. If any section, subsection, paragraph, subparagraph, 11 sentence, clause, phrase, or word of this act is for any reason held 12 to be unconstitutional or invalid, such holding shall not affect the 13 constitutionality or validity of the remaining portions of this act, 14 the General Assembly hereby declaring that it would have passed 15 this act, and each and every section, subsection, paragraph, 16 subparagraph, sentence, clause, phrase, and word thereof, 17 irrespective of the fact that any one or more other sections, 18 subsections, paragraphs, subparagraphs, sentences, clauses, 19 phrases, or words hereof may be declared to be unconstitutional, 20 invalid, or otherwise ineffective. 21 22 SECTION 8. This act is effective July 1, 2006, except that 23 Section 37-20-20(A)(2), (3), (4), and (5), as enacted in Section 2 of 24 this act, becomes effective January 1, 2006. Section 30-2-300(B) 25 (6), (7), (8), and (9), as enacted in Section 3.B. of this act, becomes 26 effective July 1, 2007. Section 4 of this act applies to offenses 27 committed, and to causes of action arising, on or after July 1, 2006. 28 ----XX---- 29

1 [4297] 23