AB738: Bill Text

LRB-3249/1

CS/RC/JTK/GMM/MS/MDK:wlj:ch

2005 - 2006 LEGISLATURE

2005 Assembly BILL 738

October 11, 2005 - Introduced by Representatives Schneider, Parisi, Albers, Gronemus, Ziegelbauer and Freese, cosponsored by Senator Carpenter. Referred to Committee on Criminal Justice and Homeland Security.

AB738,2,2 An Act to renumber 19.37 (4); to amend 59.20 (3) (d) and 59.43 (1) (intro.); and to create 19.36 (13), 19.36 (14), 19.37 (4) (b) and (c), 59.43 (1m), 100.53, 103.135, 134.44, 138.25 and 230.16 (12) of the statutes; relating to: prohibiting use of social security numbers on state civil service examinations, prohibiting requests by merchants for customers' social security numbers, requiring notice of unauthorized acquisitions of computerized personal information, posting certain personal information in government records on the Internet and accessing certain public records and employer records containing the social security numbers of individuals, prohibiting a register of deeds from recording certain instruments that contain more than a partial social security number, prohibiting number of credit inquiries as factor in credit reports, granting rule-making authority, and providing penalties.

Analysis by the Legislative Reference Bureau

Use of social security numbers on state civil service exams

The bill prohibits an applicant's social security number from being used for the purpose of identifying the applicant on any examination for a position in the state civil service system.

Notification of unauthorized acquisitions of computerized personal information

This bill requires notification of the unauthorized acquisition of personal information that is stored on a computer or other electronic medium (unauthorized acquisition). Under the bill, personal information includes an individual's social security number, medical data, and data relating to financial accounts or transactions, but not information that is available to the public.

Under the bill, if a person that owns or licenses computerized personal information knows or has reason to know of an unauthorized acquisition, the person must give notice to the individual who is the subject of the information that was acquired and to at least three major credit reporting agencies. The bill requires that the notice to the individual contain certain information, including a warning that an unauthorized acquisition may adversely affect the individual's credit rating, an advisory to monitor the individual's credit information, and telephone numbers and addresses for at least three major credit reporting agencies. The notice must be in writing, except that, if a person is required to give notice to more than one individual as a result of a single unauthorized acquisition and the cost of giving written notice to all individuals would exceed $250,000, notice may be given by doing all of the following: 1) sending an electronic mail message to the individuals; 2) posting a notice on the Internet; and 3) notifying news media. The bill requires that a notice to credit reporting agencies include the name of the individual who is the subject of the unauthorized disclosure and a general identification of the type of information that was acquired.

Also under the bill, if a person that maintains computerized personal information owned or licensed by another knows or has reason to know that the information has been acquired by a person not authorized to do so by the owner or licensee of the information, that person must notify the owner or licensee.

The bill provides that the Department of Justice or the district attorney may bring an action for an injunction against a person who violates the provisions of the bill. The bill also permits an individual injured by a violation to bring an action against the violator, including the state or any body in state government, for damages.

Requests by merchants for customers' social security numbers

Current law generally does not prohibit a seller from requesting that a customer disclose his or her social security number. This bill prohibits a seller of goods at retail from making such a request unless the seller is required to do so in issuing fish and game approvals as an agent of the Department of Natural Resources (DNR). Under current law, DNR is required to obtain the social security number from an applicant for a fish and game approval so that the state may determine whether the applicant is delinquent in the payment of certain state taxes or in the payment of child support or other court-ordered family support or birth expenses. If an applicant is delinquent or fails to provide his or her social security number, the agent must deny the application for the approval.

Posting of personal information in government records on the Internet

This bill provides that no state or local government officer or agency that maintains an Internet site may post on that site any public record containing the name of an individual together with any of the following information: 1) the individual's birth date; 2) the number of a driver's license issued to the individual by the Department of Transportation; 3) the telephone number at the individual's place of employment; and 4) the unpublished home telephone number of the individual. The prohibition does not apply to publication or electronic posting of a telephone number at an individual's place of employment by a governmental unit that is the employer of the individual. In addition, the prohibition does not apply to the posting of information that is required to be provided as a part of the sex offender registry program.

Currently, state and local government officers and agencies may post information in public records on the Internet unless access to that information is required to be withheld by law.

Access to certain public records containing social security numbers

Currently, the custodian of the records of any state or local governmental unit must provide access to any public record in his or her custody unless otherwise authorized or required by law or unless the custodian demonstrates that the public interest in withholding access to the record outweighs the strong public interest in providing access to that record. Federal law prohibits state and local governmental units from disclosing social security numbers under certain conditions.

This bill provides that, if a new record containing the social security number of an individual, together with information revealing the identity of that individual, is kept by a state or local governmental unit on or after January 1, 2007, or if a record in the custody of a state or local governmental unit is modified to insert the social security number of an individual on or after January 1, 2007, and the record contains information revealing the identity of that individual, the custodian of the record must delete the social security number before permitting access to the record by any person other than an officer or employee of the governmental unit, unless the person who requests access to the record is specifically authorized by federal or state law or by the subject individual to have access to the social security number.

The bill, however, permits the requester of a record to have access to the social security number of an individual, unless otherwise restricted by law, if:

1. The record pertains to that individual alone, to the marital or parental rights or responsibilities of that individual and his or her spouse or former spouse, to the property of that individual held jointly or in common with one or more other individuals, or to a civil lawsuit in which the individual is a specifically named party, and the individual provides appropriate identification; or

2. The requester is an authorized representative of an insurer or an organization that performs investigations for insurers and the social security number is relevant to an investigation of suspected, anticipated, or actual insurance fraud.

The bill provides that, if any person misrepresents his or her identity for the purpose of obtaining access to the social security number of another individual, the person is subject to a forfeiture (civil penalty) of not more than $1,000 for each social security number obtained by means of misrepresentation. In addition, under the bill, if any insurer or other person obtains a social security number and uses that number for purposes other than an investigation of suspected, anticipated, or actual insurance fraud, the person is subject to a forfeiture of not more than $1,000 for each social security number used by the person for unauthorized purposes.

The bill also provides that no state or local governmental unit may provide access to any record to which access is restricted that contains the social security number of an individual, together with information revealing the identity of that individual, to any officer or employee of the unit other than the custodian of the record or an employee working under the immediate supervision of the custodian unless the officer's or employee's official responsibilities require the officer or employee to have access to the number or the officer or employee is authorized by the subject individual to have access to the number.

Access to employer records containing social security numbers

In addition, the bill prohibits an employer from providing access to any record that contains the social security number of an employee of the employer, together with information revealing the identity of that employee, to any person unless the number is redacted; the person is authorized by federal or state law or by the employee who is the subject of the record to have access to the number; or the person is an officer, employee, or agent of the employer and his or her official responsibilities require him or her to have access to the number.

Register of deeds; prohibition on recording certain documents; social security numbers

Generally, under current law, a register of deeds is required to record in his or her office any document that is authorized by law to be so recorded. Documents that are recorded in a register of deeds' office include deeds, mortgages, real estate conveyances, documents relating to certain security interests, and certain financial documents. In addition, a register of deeds is required under current law to make and deliver on demand, to any person who pays the required fees, a copy of any record, paper, or file in the register's office.

Under this bill, a register of deeds may not record any instrument offered for recording if the instrument contains more than the last four characters of the social security number of an individual. If a register of deeds is presented with an instrument that contains more than the last four characters of the social security number of an individual, and if the register of deeds records the instrument but does not discover the error until after the instrument is recorded, the register of deeds may not be held liable for the instrument drafter's placement of the social security number on the instrument and may remove or obscure enough of the social security number so that no more than the last four characters of the number are discernable on the instrument.

Also under this bill, if a register of deeds records an instrument that contains an entire social security number, the instrument drafter is liable to the individual whose social security number appears in the instrument for damages of not more than $5,000, plus actual damages.

The changes to current law made in the bill do not apply to federal tax liens.

The bill also prohibits credit reporting agencies from using the number of creditor inquiries as a factor in any credit scoring methodology used in preparing credit reports.

Because this bill creates a new crime or revises a penalty for an existing crime, the Joint Review Committee on Criminal Penalties may be requested to prepare a report concerning the proposed penalty and the costs or savings that are likely to result if the bill is enacted.

For further information see the state and local fiscal estimate, which will be printed as an appendix to this bill.

The people of the state of Wisconsin, represented in senate and assembly, do enact as follows:

AB738, s. 1 Section 1. 19.36 (13) of the statutes is created to read:

AB738,5,5 19.36 (13) Access to certain records on Internet sites. (a) Except as provided in par. (b), no authority that maintains an Internet site may post on that site any record containing the name of an individual, together with any of the following information pertaining to that individual:

AB738,5,6 1. The individual's birth date.

AB738,5,7 2. The number of an operator's license issued to the individual under ch. 343.

AB738,5,9 3. Except as provided in par. (b), the telephone number at the individual's place of employment.

AB738,5,10 4. The unpublished home telephone number of the individual.

AB738,5,11 (b) This subsection does not apply to any of the following:

AB738,6,3 1. The publication or electronic posting of the telephone number at an individual's place of employment by an authority that is the employer of the individual.

AB738,6,5 2. The posting of any information that is required to be provided under s. 301.45 (2).

AB738, s. 2 Section 2. 19.36 (14) of the statutes is created to read:

AB738,6,8 19.36 (14) Social security numbers. (a) In this subsection, "employee" includes an individual holding a local public office or a state public office.