(A)(1) Except as provided in Sections 30-2-320 and 30-2-330 of this article, a public body, as defined in Section 30-1-10(B), may not:
(a) collect a social security number or any portion of it containing six digits or more from an individual unless authorized by law to do so or unless the collection of the social security number is otherwise imperative for the performance of that body's duties and responsibilities as prescribed by law. Social security numbers collected by a public body must be relevant to the purpose for which collected and must not be collected until and unless the need for social security numbers has been clearly documented;
(b) fail, when collecting a social security number or portion of it containing six digits or more from an individual, to segregate that number on a separate page from the rest of the record, or as otherwise appropriate, so that the social security number may be easily redacted pursuant to a public records request;
(c) fail, when collecting a social security number or any portion of it containing six digits or more from an individual, to provide, at the time of or before the actual collection of the social security number by that public body, upon request of the individual, a statement of the purpose or purposes for which the social security number is being collected and used;
(d) use the social security number or a portion of it containing six digits or more for any purpose other than the purpose stated;
(e) intentionally communicate or otherwise make available to the general public an individual's social security number or a portion of it containing six digits or more or other personal identifying information. "Personal identifying information", as used in this section, has the same meaning as "personal identifying information" in Section 16-13-510, except that it does not include electronic identification names, including electronic mail addresses, or parent's legal surname before marriage;
(f) intentionally print or imbed an individual's social security number or a portion of it containing six digits or more on any card required for the individual to access government services;
(g) require an individual to transmit the individual's social security number or a portion of it containing six digits or more over the Internet, unless the connection is secure or the social security number is encrypted;
(h) require an individual to use the individual's social security number or a portion of it containing six digits or more to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site; or
(i) print an individual's social security number or a portion of it containing six digits or more on materials that are mailed to the individual, unless state or federal law requires the social security number be on the mailed document.
(2) An entity that collects and uses social security numbers or other personal identifying information as part of the maintenance and reporting of employment records or the administration or provision of employee benefits programs is exempt from the prohibitions in this subsection.
(B) Before a public body, as defined in Section 30-1-10(B), may transfer or dispose of information technology hardware or storage media owned or leased by it, all personal and confidential information must be removed and the hardware and storage media must be sanitized in accordance with standards and policies adopted by the Department of Administration, Division of the State Chief Information Officer. The director or appropriate information technology manager of the public body owning or leasing the information technology hardware or storage media shall verify that all personal and confidential information is removed and the information technology hardware and storage media are sanitized in accordance with those standards and policies before the transfer or disposal occurs.
(C) When a public body disposes of a record that contains personal identifying information of an individual, the body shall modify, by shredding, erasing, or other means, the personal identifying information to make it unreadable or undecipherable.
(D) A public body is considered to comply with subsection (C) if it contracts with a person engaged in the business of disposing of records for the modification of personal identifying information on behalf of the body in accordance with subsection (C).
HISTORY: 2008 Act No. 190, Section 3.B, eff December 31, 2008.
Code Commissioner's Note
At the direction of the Code Commissioner, references in this section to the offices of the former State Budget and Control Board, Office of the Governor, or other agencies, were changed to reflect the transfer of them to the Department of Administration or other entities, pursuant to the directive of the South Carolina Restructuring Act, 2014 Act No. 121, Section 5(D)(1), effective July 1, 2015.