[Ord. No. 18-3, 1-16-2018]
Monroe County (hereinafter referred to in this policy as the “County”) adopts this Identity Protection Policy pursuant to the Identity Protection Act, 5 ILCS 179/1 et seq. The Identity Protection Act requires each local and State government agency to draft, approve, and implement an Identity Protection Policy to ensure the confidentiality and integrity of Social Security Numbers that agencies collect, maintain, and use. It is important to safeguard Social Security Numbers (SSN’s) against unauthorized access because SSN’s can be used to facilitate identity theft. One way to better protect SSN’s is to limit the widespread dissemination of those Numbers. The Identity Protection Act was passed in part to require Local and State government agencies to assess their personal information collection practices and make necessary changes to those practices to ensue confidentiality. The judicial branch and Clerk of the Court is not subject to the provisions of this policy, pursuant to 5 ILCS 179/40.
[Ord. No. 18-3, 1-16-2018]
Whenever an individual is asked to provide the County with a SSN, the County shall provide that individual with a statement of the purpose for which the County is collecting and using the Social Security Number. The County shall also provide the Statement of Purpose upon request. That Statement of Purpose document may be in substantially such form as attached to this Policy or hereafter modified by the County.
The County shall not:
(A) 
Publicly post or publicly displaying in any manner an individual’s Social Security Number. “Publicly post” or “publicly display” means to intentionally communicate or otherwise intentionally make available to the general public.
(B) 
Print an individual’s Social Security Number on any card required for the individual to access products or services provided by the person or entity.
(C) 
Require an individual to transmit a Social Security Number over the Internet, unless the connection is secure or the Social Security Number is encrypted.
(D) 
Print an individual’s Social Security Number on any materials that are mailed to the individual, through the U.S. Postal Service, any private mail service, electronic mail, or any similar method of delivery, unless State or federal law requires the Social Security Number to be on the document to be mailed. SSN’s may be included in applications and forms sent by mail, including, but not limited to, any material mailed in connection with the administration of the Unemployment Insurance Act, any material mailed in connection with any tax administered by the Department of Revenue, and documents sent as part of an application or enrollment process or to establish, amend or terminate an account, contract, or policy or to confirm the accuracy of the Social Security Number. A Social Security Number that is permissibly mailed will not be printed, in whole or in part, on a postcard or other mailer that does not require an envelope or be visible on an envelope without the envelope having been opened.
(E) 
In addition, the County shall not:
(1) 
Collect, use, or disclose a Social Security Number from an individual, unless:
(a) 
Required to do so under State or federal law, rules, or regulations, or the collection, use, or disclosure of the Social Security Number is otherwise necessary for the performance of the County’s duties and responsibilities;
(b) 
The need and purpose for the Social Security Number is documented before collection of the Social Security Number; and
(c) 
The Social Security Number collected is relevant to the documented need and purpose.
(2) 
Require an individual to use his or her Social Security Number to access an Internet website.
(3) 
Use the Social Security Number for any purpose other than the purpose for which it was collected.
The foregoing prohibitions do not apply where specifically exempted by laws including but, by way of limitation, those exemptions provided for in the Identity Protection Act (5 ILCS 279/1 et seq.). The County may disclose SSN’s to other governmental agencies or to its own agents, employees, contractors, and subcontractors if the disclosure is necessary for the entity to perform its duties and responsibilities. However, if a government contractor or subcontractor requires the SSN of employees to perform the work for which they are contracted they will be required to present the County with a copy of their policy dealing with the protection of those SSN’s.
[Ord. No. 18-3, 1-16-2018]
The County shall comply with the provisions of any other State law with respect to allowing the public inspection and copying of information or documents containing all or any portion of an individual’s Social Security Number. The County shall redact social security number from the information or documents before allowing the public inspection or copying of the information or documents. However, the Act does not apply to documents that are recorded by the County Recorder or required to be open to the public under any law, rule, or the Constitution of the State of Illinois.
When collecting Social Security Numbers, the County shall request each SSN in a manner that allows the SSN to be easily redacted if required to be released as part of a public records request. “Redact” means to alter or truncate data so that no more than five (5) sequential digits of a Social Security Number are accessible as part of personal information.
[Ord. No. 18-3, 1-16-2018]
Only employees who are required to use or handle information or documents that contain SSN’s in the performance of their essential duties will have access to such documents. All employees who have access to SSN’s are trained to protect the confidentiality of SSN’s from the time of collection through the time of destruction.
[Ord. No. 18-3, 1-16-2018]
In addition to the above protections the County will also take affirmative measures to protect SSN’s in any format including, but not limited to, hardcopy, computer records, and computer transmissions. They will assure that all vendors to whom they provide or transmit SSN’s have policies and equipment in place to reasonably protect the SSN information that is being provided to them. Electronic transmissions will be verified to be secure or SSN’s will be encrypted.
A copy of this policy shall be available to employees or the general public upon request.