Identity Protection Policy (Policy 88)

PURPOSE

As mindful stewards of the data of the University community, and in compliance with the Illinois Identity Protection Act (5 ILCS 179), Governors State University (GovState) establishes this policy to protect the social security numbers of individuals.

DEFINITIONS

"Publicly post" or "publicly display": To intentionally communicate or otherwise intentionally make available to the general public.

1. The University or anyone acting on behalf of the University are prohibited from the following except where specifically allowed by 5 ILCS 179.
   1. Publicly posting or displaying any individual’s social security number. 
   2. Printing social security numbers on access cards or identification cards. 
   3. Requiring an individual to transmit an unencrypted social security number over the Internet, or transmit their social security number over an unencrypted connection. 
   4. Sending a social security number via postal mail or electronic mail or other similar method of delivery. 
   5. Collecting, using, or disclosing a social security number unless 
      1. required to do so under State or federal law, rules, or regulations, or the collection, use, or disclosure of the social security number is otherwise necessary for the performance of that agency's duties and responsibilities, 
      2. the need and purpose for the social security number is documented before collection of the social security number, AND 
      3. the social security number collected is relevant to the documented need and purpose. 
   6. Requiring an individual to provide their social security number in order to access a web site.
   7. Using a collected social security number for any other purpose than the one for which it was collected.
2. GovState may collect, use, or disclose social security numbers under the following circumstances or situations:
   1. The disclosure of social security numbers to agents, employees, contractors, or subcontractors of a governmental entity or disclosure by a governmental entity to another governmental entity or its agents, employees, contractors, or subcontractors if (1) disclosure is necessary in order for the entity to perform its duties and responsibilities and if (2) disclosing to a contractor or subcontractor, prior to such disclosure, the governmental entity must first receive from the contractor or subcontractor a copy of the contractor’s or subcontractor’s policy that sets forth how the requirements imposed under the Illinois Identity Protection Act on a governmental entity to protect an individual’s social security number will be achieved. 
   2. The disclosure of social security numbers pursuant to a court order, warrant, or subpoena. 
   3. The collection, use, or disclosure of social security numbers in order to ensure the safety of: 
      1. State and local government employees; 
      2. Persons committed to correction facilities, local jails, and other law-enforcement facilities or retention centers; 
      3. Wards of the State; and 
      4. All persons working in or visiting a State or local government agency facility. 
   4. The collection, use, or disclosure of social security numbers for internal verification or administrative purposes. 
   5. The disclosure of social security numbers by Governors State University to any entity for the collection of delinquent child support or of any State debt or to a governmental agency to assist with an investigation or the prevention of fraud. 
   6. The collection or use of social security numbers to investigate or prevent fraud, to conduct background checks, to collect a debt, to obtain a credit report from a consumer reporting agency under the federal Fair Credit Reporting Act, to undertake any permissible purpose that is enumerated under the federal Gramm-Leach-Bliley Act, or to locate a missing person, a lost relative, or a person who is due a benefit, such as a pension benefit or an unclaimed property benefit.
   7. Social security numbers that are requested by GovState from an individual must be placed on records/documents or stored in a manner that makes the social security number easily redacted if required to be released as part of a public records request. If there is a request to inspect or copy records under the Illinois Freedom of Information Act or any other federal or state law, the University must redact social security numbers from the information or documents before allowing inspection or copying. 
   8. When collecting a social security number, or when requested by an individual, the University must provide a statement describing the purpose for which the social security number is being collected. 
   9. Only those GovState employees requiring access to social security numbers as part of their job duties shall be granted access to social security numbers. 
   10. Any GovState employee that requires access to social security numbers will be trained to protect the confidentiality of social security numbers.