THE GENERAL ASSEMBLY OF PENNSYLVANIA

SENATE BILL

INTRODUCED BY TOMLINSON, BROWNE, ALLOWAY, KITCHEN, ORIE, BOSCOLA, FONTANA, SOLOBAY, TARTAGLIONE, M. WHITE, MENSCH, WAUGH, D. WHITE, RAFFERTY, ERICKSON, WARD, EICHELBERGER, FERLO, COSTA, BREWSTER, KASUNIC AND BRUBAKER, JANUARY 28, 2011

REFERRED TO COMMUNICATIONS AND TECHNOLOGY, JANUARY 28, 2011  

AN ACT

Amending the act of June 29, 2006 (P.L.281, No.60), entitled "An

act relating to confidentiality of Social Security numbers;

and making a related repeal," further providing for title of

act; extending privacy provisions to certain confidential

individual information; and further providing for

applicability.

The General Assembly of the Commonwealth of Pennsylvania

hereby enacts as follows:

Section 1.  The title of the act of June 29, 2006 (P.L.281,

No.60), entitled "An act relating to confidentiality of Social

Security numbers; and making a related repeal," is amended to

read:

AN ACT

Relating to confidentiality of Social Security numbers and other

individual information; and making a related repeal.

Section 2.  Sections 1 and 4 of the act are amended to read:

Section 1.  Privacy of [Social Security numbers] confidential

individual information.

(a)  General rule.--A person or entity or State agency or

political subdivision shall not do any of the following:

(1)  Publicly post or publicly display in any manner [an

individual's Social Security number] confidential individual

information. "Publicly post" or "publicly display" means to

intentionally communicate or otherwise make available to the

general public.

(2)  Print [an individual's Social Security number]

confidential individual information on any card required for

the individual to access products or services provided by the

person, entity or State agency or political subdivision.

(3)  Require an individual to transmit [his or her Social

Security number] confidential individual information over the

Internet unless the connection is secure or the [Social

Security number] confidential individual information is

encrypted.

(4)  Require an individual to use [his or her Social

Security number] confidential individual information to

access an Internet website unless a password or unique

personal identification number or other authentication device

is also required to access the website.

(5)  (i)  Print [an individual's Social Security number]

confidential individual information on any materials that

are mailed to the individual unless Federal or State law

requires the [Social Security number] confidential

individual information to be on the document to be

mailed.

(ii)  Notwithstanding [this provision, Social

Security numbers] subparagraph (i), confidential

individual information may be included in applications

and forms sent by mail, including documents sent as part

of an application or enrollment process or to establish,

amend or terminate an account, contract or policy or to

confirm the accuracy of the [Social Security number. A

Social Security number] confidential individual

information. Confidential individual information that is

permitted to be mailed under this section may not be

printed, in whole or in part, on a postcard or other

mailer not requiring an envelope, or visible on the

envelope or without the envelope having been opened.

(6)  Disclose in any manner, except to the agency issuing

the license, [the Social Security number] confidential

individual information of an individual who applies for a

recreational license. For the purposes of this paragraph, a

"recreational license" means a license issued pursuant to 30

Pa.C.S. (relating to fish) or 34 Pa.C.S. (relating to game).

(b)  Applicability.--Except as provided in subsection (c),

subsection (a) applies only to the use of [Social Security

numbers] confidential individual information on or after the

effective date of this section.

(c)  Exception.--

(1)  A person or entity, not including a State agency or

political subdivision, that has used, prior to the effective

date of this section, [an individual's Social Security

number] confidential individual information in a manner

inconsistent with subsection (a) may continue using that

[individual's Social Security number] confidential individual

information in that manner on or after the effective date of

this section, if all of the following conditions are met:

(i)  The use of the [Social Security number]

confidential individual information is continuous. If the

use is stopped for any reason, subsection (a) shall

apply.

(ii)  The individual is provided an annual

disclosure, commencing in the year after the effective

date of this section, that informs the individual that he

or she has the right to stop the use of his or her

[Social Security number] confidential individual

information in a manner prohibited by subsection (a).

(2)  An individual who receives an annual disclosure

under paragraph (1) has the right to stop the use of his or

her [Social Security number] confidential individual

information in a manner prohibited by subsection (a) and must

exercise that right by submitting a written request to the

person or entity. The person or entity shall discontinue use

of the [individual's Social Security number] confidential

individual information within 30 days of the receipt of the

request. There shall be no fee or charge for complying with

the request. A person or entity shall not deny services to an

individual because the individual makes a written request

pursuant to this subsection.

(d)  Construction.--This section shall not be construed to

prevent the collection, use or release of [a Social Security

number] confidential individual information as required by

Federal or State law or the use of [a Social Security number]

confidential individual information for internal verification,

administrative purposes or for law enforcement investigations.

(e)  Unified judicial system documents.--This section does

not apply to a document that originated with, or is filed with,

recorded in or is maintained by any court component or part of

the unified judicial system.

(f)  Government documents.--This section does not apply to

any document that:

(1)  is required by law to be open to the public; and

(2)  originates with, or is filed, recorded or maintained

by any government agency, instrumentality or taxing

authority.

(g)  Penalty.--Actions in violation of this act shall be

deemed a summary offense and shall be punishable by a fine of

not less than $50 and not more than $500 and, for every second

or subsequent violation, by a fine of not less than $500 and not

more than $5,000. Fines under this section shall be distributed

equally between the Crime Victim's Compensation Fund

administered by the Pennsylvania Commission on Crime and

Delinquency and the Office of Attorney General for future

identity theft prevention.

(h)  Definition.--For purposes of this act, "confidential

individual information" means the Social Security number, date

of birth, driver's license number and financial institution

account number of an individual.

Section 4.  Applicability.

The provisions of this act shall not apply, to the extent

preempted by Federal law, to:

(1)  A financial institution, as defined by section

509(3) of the Gramm-Leach-Bliley Act (Public Law 106-102, 15

U.S.C. § 6809(3)) or regulations adopted by agencies as

designated by section 504(a) of the Gramm-Leach-Bliley Act,

subject to Title V of the Gramm-Leach-Bliley Act or a

"licensee" as defined by 31 Pa. Code § 146a.2 (relating to

definitions).

(2)  A covered entity, as defined by regulations

promulgated at 45 CFR Pts. 160 (relating to general

administrative requirements) and 164 (relating to security

and privacy) pursuant to Subtitle F of the Health Insurance

Portability and Accountability Act of 1996 (Public Law

104-191, 110 Stat. 1936).

(3)  An entity subject to the Fair Credit Reporting Act

(Public Law 91-508, 15 U.S.C. § 1681 et seq.).

Section 3.  This act shall take effect in 60 days.