2-6-502. Protection of social security numbers -- compliance. (1) Each state agency that maintains the social security number of an individual shall develop procedures to protect the social security number while enabling the state agency to use the social security number as necessary for the performance of its duties under federal or state law.
     (2) The procedures must include measures to:
     (a) eliminate the unnecessary use of social security numbers;
     (b) identify the person or state agency authorized to have access to a social security number;
     (c) restrict access to social security numbers by unauthorized persons or state agencies;
     (d) identify circumstances when redaction of social security numbers is appropriate;
     (e) dispose of documents that contain social security numbers in a manner consistent with other record retention requirements applicable to the state agency;
     (f) eliminate the unnecessary storage of social security numbers on portable devices; and
     (g) protect data containing social security numbers if that data is on a portable device.
     (3) Except as provided in 2-6-503, each state agency in existence on October 1, 2009, shall complete the requirements of this section by September 1, 2012. A state agency that is created after October 1, 2009, shall complete the requirements of this section within 1 year of its creation.

     History: En. Sec. 2, Ch. 163, L. 2009.