Office of Compliance
CITY OF CHICAGO
May 25, 2011
Susana Mendoza City Clerk
121 North LaSalle Street, Room 107 Chicago, Illinois 60602
Dear City Clerk Mendoza:
The attached policy is being forwarded to you pursuant to the Illinois Identity Protection Act 5 ILCS 179/1 et seq. ("the Act"). The Act requires that local government agencies draft and approve an Identity Protection policy and further states that "[e]ach local government agency must file a writtencopy of its privacy [sic] policy with the governing board of the unit of local government within 30 days after approval of the policy."
Sincerely,
Mary Elliot! Acting Managing Deputy Office of Compliance
I -< o
^^
CD CTi
Policy #. |
Title |
Creator |
Date Created |
Last Revision Date |
Reviewers |
2011-1 |
Identity Protection Policy |
Office of Compliance |
May 10, 2011 |
|
OCX, DOL |
City of Chicago Identity Protection Policy
1) Purpose
The City of Chicago (the "City") adopts this Identity Protection Policy pursuant to the Identity Protection Act, 5 ILCS 179/1 etseq. The Identity Protection Act (the "Act") requires each local and State government agency in Illinois to draft, approve, and implement an Identity Protection Policy to ensure the confidentiality and integrity of Social Security numbers ("SSNs") that agencies collect, maintain, and use.
The purpose of this Policy is to set forth the procedures and restrictions that must be observed by all City employees regarding the use and availability of SSNs belonging to City employees and the public. This Policy is effective immediately.
2) Access to Social Security Numbers
a) Limited access: Only those City employees who are required to use or handle information or documents that contain SSNs in the course of performing their duties will have access to such information or documents.
b) Training: All City employees who have access to SSNs will receive training on the proper handling of information that contains SSNs.
3) Displaying or Printing SSNs
The City shall not:
- a) Publicly post or publicly display in any manner an individual's Social Security number. "Publicly post' or "publicly display" means to intentionally communicate or otherwise intentionally make available to the general public.
b) Print an individual's Social Security number on any card required for an individual to access products or services provided by the City.
c) Require an individual to transmit a Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted.
d) Print an individual's Social Security number on any materials that are mailed to the individual through the U.S. Postal Service, any private mail service, electronic mail, or any similar method of delivery, unless State or federal law requires the Social Security number to be on the document to be mailed.
SSNs may be included in applications and forms sent by mail, including but not limited to, any material mailed in connection with the administration of the Unemployment Insurance Act, any material mailed in connection with any tax administered by the Department of Revenue, and documents sent as part of an application or enrollment process or to establish, amend, or terminate an
account, contract, or policy or to confirm the accuracy of the Social Security number.
A Social Security number that is permissibly mailed must not be printed, in whole or in part, on a postcard or other mailer that does not require an envelope, or be visible on an envelope without the envelope having been opened.
4) Collection, Use or Disclosure of SSNs
The City shall not:
a) Collect, use, or disclose SSNs from individuals unless:
i) required to do so under State or federal law, rules, or regulations, or the collection, use, or disclosure of the Social Security number is otherwise necessary for the performance of the City's duties and responsibilities;
ii) the need and purpose for the Social Security number is documented before collection of the Social Security number; and
iii) the Social Security number collected is relevant to the documented need and purpose. ,
b) Require an individual to use his or her Social Security number to access an Internet website.
c) Use the Social Security number for any purpose other than the purpose for which it was collected.
d) Exceptions: The prohibitions in Sections 4a) - 4 c) of this Policy do not apply in the following circumstances:
i) The disclosure of SSNs to agents, employees, contractors, or subcontractors, of a governmental entity or disclosure by a governmental entity to another governmental entity or its agents, employees, contractors, or subcontractors, provided that:
■ disclosure is necessary in order for the entity to perform its duties and responsibilities; and
■ if disclosing to a contractor or subcontractor, prior to such disclosure, the governmental entity first receives from the contractor or subcontractor a copy of the contractor's or subcontractor's policy that sets forth how the requirements imposed under this Act on a governmental entity to protect an individual's Social Security number will be achieved.
ii) The disclosure of SSNs pursuant to a court order, warrant, or subpoena.
iii) The collection, use, or disclosure of Social Security numbers in order to ensure the safety of: State and local government employees; persons committed to correctional facilities, local jails, and other law-enforcement facilities or retention centers; wards of the State; and all persons working in or visiting a State or local government agency facility.
iv) The collection, use, or disclosure of SSNs for internal verification or administrative purposes.
v) The disclosure of Social Security numbers by a State agency to any entity for the collection of delinquent child support or of any State debt or to a governmental agency to assist with an investigation or the prevention of fraud.
vi) The collection or use of Social Security numbers to investigate or prevent fraud, to conduct background checks, to collect a debt, to obtain a credit report from a consumer reporting agency under the federal Fair Credit
2
Reporting Act, to undertake any permissible purpose that is enumerated under the federal Gramm Leach Bliley Act, or to locate a missing person, a lost relative, or a person who is due a benefit, such as a pension benefit or an unclaimed property benefit.
5) Statement of Purpose for Collection of SSNs
Whenever an individual is asked to provide a Social Security number to the City, the City shall provide that individual with a statement of the purpose or purposes for which the City is collecting and using the Social Security number. The City shall also provide the statement of purpose upon request. A sample Statement of Purpose is attached to this Policy.
6) Requirement to Redact Social Security Numbers
a) Public inspection and copying of information: The City shall comply with the provisions of any other State law with respect to allowing the public inspection and copying of information or documents containing all or any portion of an individual's Social Security number. The City shall redact SSNs from the information or documents before allowing the public.inspection or copying of the information or documents.
b) Manner of collecting SSNs: When collecting Social Security numbers, the City shall request each SSN in a manner that makes the SSN easily redacted if required to be released as part of a public records request.
"Redact" means to alter or truncate data so that no more than five sequential digits of a Social Security number are accessible as part of personal information.
7) Department Responsibilities
Each department head must ensure that the procedures and restrictions stated in this Policy are followed by department employees, and that the requirements of Act as described in this Policy, are met.
8) Monitoring
All departments are subject to auditing of any city policy with or without prior notice. As stated in Chapter 2-26 of the Chicago Municipal Code, it'is the duty of every officer, employee, department, and agency of the city to cooperate with the Office of Compliance, and every department must make its premises, equipment, personnel, books, records and papers readily available.
3
What Does The City Of Chicago Do With Your Social Security Number?
CITY OF CHICAGO Statement of Purpose for Collection of Social Security Numbers
Identity Protection Policy
The Identity Protection Act, 5 ILCS 179/1 etseq., requires each local and State government agency to draft, approve, and implement an Identity Protection Policy and to provide a statement of the purpose or purposes for which the agency is collecting and using an individual's Social Security number (SSN). The City of Chicago is providing you with this statement of purpose because you have been asked to provide your SSN or because you requested a copy of this statement.
Why do we collect your Social Security number?_
You are being asked for your SSN for one or more of the following reasons:
■ Identity verification
■ Fraud prevention
■ Background checks
■ Child support collection
■ Billing, payment or debt collection
■ Employment-related administrative purposes
■ Pursuant to a court order, warrant or subpoena
■ License application
■ To comply with State or federal law, rules or regulations
What do we do with your Social Security number?_
■ We will only use your SSN for the purpose for which it was collected.
■ We will not:
o Sell, lease, loan, trade, or rent your SSN to a third party for any purpose; o Publicly post or publicly display your SSN;
o Print your SSN on any card required for you to access City services;
o Require you to transmit your SSN over the Internet, unless the connection
is secure or your SSN is encrypted; or o Print your SSN on any materials that are mailed to you, unless State or
Federal law requires that number to be on documents mailed to you, or
unless we are confirming the accuracy of your SSN.
Questions or Complaints about this Statement of Purpose
Write to: City of Chicago Office of Compliance
333 S. State Street Chicago, IL 60604