2008 Technical Bulletins
Oct. 31, 2008
DNA Testing Procedures — Act 413 (R. 429, S. 429)
Sept. 23, 2008
The Importance of County Council Minutes
Sept. 19, 2008
Public Invocation Act of 2008 — Act 241 (R. 282, S. 638)
Aug. 15, 2008
Illegal Immigration Reform Act of 2008 — Act 280 (R. 327, H. 4400)
July 18, 2008
(Identity Theft and Fraud Protection Act of 2008 — Act 190 (R. 202, H. 453)
Oct. 31, 2008
DNA Testing Procedures — Act 413 (R. 429, S. 429)
This Technical Bulletin outlines changes adopted by the General Assembly related to DNA testing procedures included in Act 413 of 2008. A copy of this legislation is attached for your convenience. Please consult your county attorney, if you have specific questions about the application of these changes. The SCAC staff is also available at 1-800-922-6081 to address general questions; please direct specific questions to John DeLoache.
The South Carolina legislature overrode the veto of S. 429 on Oct. 21, 2008. This legislation addresses several DNA testing issues and includes increased evidence preservation requirements for custodians of evidence and DNA sampling upon custodial arrest for certain felonies.
Preservation of Evidence Requirements
Section 17-28-30 creates a post conviction procedure for state prisoners to petition for DNA testing of physical evidence or biological material, if they have been convicted of or plead guilty to at least one of 24 specific crimes involving death, criminal sexual conduct or armed robbery/burglary with a sentence carrying 10 years or more.
Section 17-28-320(A) requires custodians of evidence to preserve all physical evidence and biological material related to the conviction or adjudication of a person for at least one of the crimes identified in the act. A custodian of evidence is any person or agency that possesses or is responsible for the control of evidence during a criminal investigation or proceeding. In most cases, the custodian of evidence will be either the county sheriff’s office or clerk of court.
Section 17-28-320(B) requires that the evidence be preserved until the convicted person is released from incarceration, dies while incarcerated or is executed. If the person was convicted or adjudicated on a guilty or nolo contendere plea, the evidence must be preserved for seven years from the date of sentencing, or until the person is released from incarceration, dies while incarcerated or is executed—whichever occurs first. Evidence must be maintained subject to a chain of custody as required by state law and accompanied by sufficient documentation to locate the evidence. Evidence must be preserved under conditions reasonably designed to preserve the forensic value of the evidence. Generally, this will require custodians to hold evidence in a climate controlled space that allows for control of temperature and humidity, but will not require specialized refrigeration. SCAC will provide additional information regarding the type of facilities that will be required to hold evidence as such guidelines are provided by the State Law Enforcement Division (SLED).
Section 17-28-340 requires the custodian of evidence to register with the S.C. Department of Corrections (DOC) or S.C. Department of Juvenile Justice (DJJ), as applicable, as the custodian of evidence related to the person’s conviction or adjudication under the act. DOC and DJJ will be required pursuant to §17-28-340(A) to notify the registered custodian of evidence when the convicted person is released from incarceration, dies while incarcerated or is executed. DOC and DJJ are currently working on the registration system. SCAC will keep you informed about the agencies’ progress.
Section 17-28-340 creates a procedure for custodians of evidence to petition for the disposal of physical or biological evidence prior to the time periods established by the Act. Section 17-28-340(A)(1) allows for the disposal of evidence that size or physical characteristics make preservation impracticable, is required to be returned to its rightful owner, or is otherwise required to be disposed of by law. Section 17-28-340(A)(2) allows for the disposal of physical or biological evidence in cases where DNA evidence was previously introduced at trial, was found to be inculpatory, and the convicted person has exhausted all appeals and post-conviction procedures. In either case, the custodian must file a petition for disposal of evidence to the General Sessions or Family Court in which the person was adjudicated. The clerk of court shall file the petition, deliver a copy to the convicted person and deliver a copy to the solicitor or Attorney General as applicable. Victims will be notified of the petition by the person or agency that would otherwise provide notice of proceedings to victims pursuant to Article 15, Chapter 3, Title 16. In most instances this will be either the arresting agency or facility with custody of the convicted person. The convicted person, solicitor, Attorney General and victim shall have the right to respond to the petition for disposal within 180 days. The court, after a hearing, shall order the evidence disposed of or preserved. Court Administration is currently working to create forms necessary for the filing of such petitions.
Pursuant to §17-28-350 it is a misdemeanor for any person to willfully destroy, alter, conceal, or tamper with any physical evidence or biological material with the intent to impair the integrity of the evidence, prevent the DNA testing of such evidence or prevent the production of such evidence in an official proceeding. A first offense for such violations carries a fine up to $1,000. Subsequent violations are punishable by a fine of not more than $5,000 and/or imprisonment for not more than one year. Failure of a custodian of evidence to preserve required evidence does not give rise to a claim for damages against an employee of the State or a political subdivision, unless such action is an act of gross negligence or intentional misconduct. A convicted person may present such information at a hearing or trial, but the failure of a custodian of evidence shall not entitle the person to any relief from adjudication or conviction.
Unidentified Human Remains DNA Database
Section 3 of the act creates an unidentifed Human Remains DNA Database that will be maintained by SLED. Pursuant to §23-3-625, DNA samples are submitted by family members of persons missing more than 30 days after the filing of a missing persons report.
Section 17-7-25 requires a county coroner performing an autopsy on an unidentified body to obtain tissue and fluid samples suitable for DNA identification, typing, and testing. Drawn samples must be transmitted to SLED to be matched against missing persons samples. In addition, §17-5-570(B) has been amended to require a coroner to forward a body that cannot be identified to the Medical University of South Carolina (MUSC) or to another suitable facility for preservation. If the body remains unidentified after 30 days, MUSC or the other facility must notify SLED. If the body remains unidentified 30 days after SLED enters the DNA profile in the combined DNA Indexing System, MUSC or the other facility may retain possession of the body for their use or return it to the coroner of the county where the death occurred for proper disposal.
DNA Sampling upon Custodial Arrest
Section 4 of the act, amends §23-3-620 by requiring that a DNA sample be taken after a lawful custodial arrest, service of a courtesy summons or direct indictment of any person for a felony offense or other offense that is punishable by a sentence of five years or more, eavesdropping, peeping or stalking. The DNA sample must be taken at a jail, sheriff’s office, courthouse, or detention facility at the time the person is booked and processed following the custodial arrest, or other location when the taking of fingerprints is required. The sample then must be submitted to SLED. If an arrested person is released from custody before providing a DNA sample they must provide a sample on or before the first court appearance at a location specified by the law enforcement agency with jurisdiction over the offense. Section 23-3-670(A) provides that the cost of collection supplies must be paid for by the State General Fund and further provides that a person required to provide a DNA sample must pay a $250 processing fee, which may not be waived by the court. If the person is incarcerated, the fee must be paid before the person is paroled or released—otherwise the fee must be a condition of the person’s sentence.
Section 23-3-650 requires that an appropriately–trained person may take a DNA sample. A person taking a sample is immune from liability if the sample was taken according to recognized procedures; however, the act does not provide immunity from liability for negligence in taking a sample.
Before the person is released from confinement or from the agency’s jurisdiction, a DNA sample must be provided for inclusion in the State DNA Database. Unless a sample has already been provided, an agency having custody of an offender who is required to provide a DNA sample must notify SLED at least three days, excluding weekends and holidays, before the person is paroled or released from confinement.
Section 23-3-660 provides that a person whose DNA record or profile has been included in the State DNA Database must have his DNA record or profile expunged, if the pending charges have been nolle prossed, dismissed, been reduced below the requirement for inclusion in the database, the person has been found not guilty, or the conviction is reversed, set aside or vacated. Section 23-3-660(B) requires that the solicitor in the county of conviction must notify SLED when the person becomes eligible to have his DNA record expunged. SLED must purge the DNA profile and all other identifiable record information at no cost to the person.
Effective Dates
The effective date of the act is Jan.1, 2009. However, the willful and intentional destruction of evidence provision found in §17-28-350 became effective Oct. 21, 2008. Clerks of court should be careful to dispose of evidence only as authorized by Rule 606 of the S.C. Appellate Court Rules or other state law or court rule until Dec. 31, 2008. County sheriff’s offices or other law enforcement offices should dispose of evidence as authorized by state law. In addition, two portions of the act have delayed implementation contingent upon funding. First, the requirements for taking DNA samples upon arrest included in §23-3-620 are contingent upon SLED’s receipt of the funding necessary to implement these provisions. Second, budget proviso 89.127 delays implementation of post-conviction DNA testing until state or federal funds are appropriated. Custodians of evidence, however, should prepare to begin the preservation of evidence requirements Jan. 1, 2009. SCAC will continue to monitor implementation of these sections of the act.
Sept. 23, 2008
The Importance of County Council Minutes
On Sept. 2, 2008, the Supreme Court decided Eagle Container Co., LLC v. County of Newberry, _______S.C._____, _____S.E.2d _____ (2008). Hardwick Stuart represented the county and was able to get the court to overturn the trial court and the Court of Appeals in an important case involving the approval of a landfill application. What precipitated the action was a recent change to the county ordinance governing the land use approval process. The issue was whether the amendment—which had redefined a single term, "landfill"—had made all landfills an approved use and, consequently, a permit was no longer required.
The SCAC Board of Directors approved Newberry County's request and directed the staff to file an Amicus Curiae on behalf of the county. In reviewing the case, the staff took a slightly different approach and focused on the minutes of the county council meetings in which the amendment was discussed. County council is acting as a legislative body when it passes ordinances. The minutes, which were fairly detailed, included a discussion between the planning director and a councilman regarding the purpose of the amendment.
Article 3 of the Newberry County Zoning Ordinance establishes the general purpose of each zoning district, and then lists some major uses that are permitted in each district. Article 5 provides regulations for each zoning district, specifically including landfill under the "special exception" classification. Special exception uses must be approved by the Board of Zoning Appeals after a hearing, if certain conditions have been met.
On Dec. 11, 2002, Newberry County Council amended Article 3 to add the word "landfill" to the list of uses permitted. Landfill also remained under Article 5 as a special exception. Eagle Container filed suit, contending that under the amended Article 3, a landfill was a permitted use in R2 Rural Districts and a permit to operate a landfill should have been granted to it outright without a special exception hearing. The lower courts agreed, finding that by adding "landfill" to uses permitted under Article 3, the council was impliedly repealing "landfill" as a special exception under Article 5 and changing the classification of landfill to an automatically permitted use.
In overturning the Court of Appeals, the Supreme Court determined that the language of the Newberry County Zoning Ordinance was not ambiguous, based on Mr. Stuart's very cogent argument. The court added that, even if it viewed the ordinance with the amendment as ambiguous, it could look to the intent of the council to establish that council intended to leave landfills in the special exception classification. Relying on council minutes from Nov. 6, 2002, and Nov. 20, 2002, the court recognized that it was abundantly clear from Planning/Zoning Director Bridges' statements that the council had no intention of changing the classification of landfill from a special exception to an automatically permitted use.
The county argued that it intended that landfills must still be approved as special exceptions, as described in Article 5, and that adding "landfill" to Article 3 just included it in a list of possible uses permitted. The Supreme Court agreed with the county that Article 3 simply lists general uses, whereas Article 5 provides for the regulation and categorization of such uses, and thus landfills still must be approved as special exceptions.
Eagle Container argued that county council minutes are incomplete and inaccurate recordings of the council meeting; consequently, they could not be relied on by the courts. But the Supreme Court found merit in the county council minutes as competent evidence of legislative intent. As the court noted, county council minutes are public records, required by the Freedom of Information Act (S.C. Code Ann. §30-4-90 (1991)), and required by Home Rule Act (S.C. Code §4-9-110 (1986)). It should be noted that the specificity and thorough treatment of the issue in the minutes aided the Supreme Court in their determination that the minutes reflected the intent of council. Counties should be aware that the Supreme Court indicated in Eagle Container that courts may look to county council minutes to determine the council's legislative intent when passing ordinances.
Sept. 19, 2008
Public Invocation Act of 2008 — Act 241 (R. 282, S. 638)
This Technical Bulletin outlines changes adopted by the General Assembly relating to invocations at public body meetings. A copy of the act is attached for your convenience. Please consult your county attorney, if you have specific questions about the application of these changes. The SCAC staff is also available at 1-800-922-6081 to address general questions.
The South Carolina Legislature enacted Act 241 of 2008 (R. 282, S. 638), to provide a procedure for state and local governments to enact policies for an invocation to open a public meeting. The act applies to a deliberative public body, which includes the governing body of a county or municipal government, a school district, a branch or division of a county or municipal government, or a special purpose or public service district. An invocation procedure can be adopted by ordinance, resolution or policy statement.
A deliberative public body may formulate an invocation policy by one of three methods: (1) the members of the body offer an invocation on an objective and rotating basis; (2) the body may elect a chaplain; or (3) the body may allow invocation speakers from the community of religious leaders where the body is located. If the body allows speakers from the community, to ensure objectivity, the body annually shall compile a list of all known, established religious congregations and assemblies by reference to local telephone books or similar sources or both, and mail an invitation to the religious leader of each congregation and assembly containing the following statement: "A religious leader is free to offer an invocation according to the dictates of his own conscience, but, in order to comply with applicable constitutional law, the public body requests that the public invocation opportunity not be exploited to proselytize or advance any one, or to disparage any other faith or belief." Those who accept the invitation must be scheduled to deliver invocations on a first-come, first-served basis.
Under the act, the Attorney General is directed to provide advice on the current status of the law concerning public invocations, update this statement to reflect any changes made in the law, and to make the statement available through the most economic and convenient method, including posting on the Attorney General's website. The Attorney General is required to defend any deliberative public body against a facial challenge to the constitutionality of this act.
Nothing in this act prohibits a county from developing its own policy on public invocations. However, county entities that plan to implement a public invocation procedure should review some of the recent cases addressing this issue (See Marsh v. Chambers, 463 U.S. 783; Simpson v. Chesterfield County Board of Supervisors, 404 F.3d 276; Wynne v. Town of Great Falls, 376 F.3d 292) and consult with their county attorneys.
Aug. 15, 2008
Illegal Immigration Reform Act of 2008 — Act 280 (R. 327, H. 4400)
This Technical Bulletin outlines changes adopted by the General Assembly relating to illegal immigration. A copy of the act is attached for your convenience. Please consult your county attorney, if you have specific questions about the application of these changes. The SCAC staff is also available at 1-800-922-6081 to address general questions. Please direct questions to Kent Lesesne.
In an effort to further assist counties in their implementation of the E-Verify system of employment eligibility verification, which is required by the act to be used beginning Jan. 1, 2009—SCAC has arranged for an orientation seminar to be held at SCAC's offices on Thursday, Oct. 9, and again on Friday, Oct. 10. There will be a brief overview of the Illegal Immigration Reform Act by SCAC staff. The U.S. Department of Homeland Security will walk through registration for and use of the E-Verify program, and the U.S. Department of Justice Office of Special Counsel will discuss potential discriminatory use of immigration status information. A separate mailing will be sent, and it will be necessary to pre-register for one of these seminars.
The Legislature enacted Act 280 of 2008 (R. 327, H. 4400) to address the issue of illegal immigration in South Carolina. The effective date of the act is June 4, 2008.
The act requires all employers to verify the citizenship or immigration status of all new hires through the federal E-Verify program or a valid S.C. driver's license or identification card issued by the S.C. Department of Motor Vehicles (SCDMV). The act makes some distinctions between the requirements for public employers versus private employers. Section 8-14-10(A)(5) defines public employer to include all political subdivisions of the state. Section 8-14-10(A)(9) defines a private employer as any employment and any person for whom the individual performs a service, of whatever nature, as an employee, as defined in §12-8-10.
Under §8-14-20(B) of the act, beginning on Jan. 1, 2009, every public employer shall register with and participate in the federal E-Verify program to verify the employment authorization of all new employees. Public employers must screen all new employees through the E-Verify program within three days of their hiring date. The public employer cannot enter into a service contract with a contractor for the physical performance of services, unless the contractor verifies the work authorization of all new employees through the E-Verify program, or the employee has a valid S.C. driver's license or identification card issued by SCDMV. A public employer does not need to audit or independently verify a contractor's compliance with the act. Pursuant to §8-14-80, the director of the Budget and Control Board shall prescribe all forms and any necessary regulations for the application of the act to contracts or agreements.
Section 8-14-10 defines a contractor as any person having a contract with a political subdivision in which the total value of the contract in a 12-month period exceeds $15,000. For entities other than a political subdivision, the threshold value of the contract is $25,000. A contractor may also be a private employer. This verification requirement for new employees also applies to subcontractors and sub-subcontractors. Section 8-14-10(A)(6)(a), (b), and (c) defines a ‘service contract' as a contract that involves the physical performance of manual labor, if the total cost of such labor exceeds (i) 30 percent of the total cost of all labor, or (ii) 5 percent of the contract price. The term does not include a contract with a political subdivision with a total of less than $15,000 or with a public employer other than a political subdivision with a total value of less than $25,000. The term ‘contractor' does not include a contract primarily for the acquisition of an end product, nor does it include a contract that is predominantly for the performance of professional or consultant services.
Pursuant to §8-14-20(D)(1), (2) and (3), on and after Jan. 1, 2009, contractors, sub-contractors, or sub-subcontractors of 500 or more employees must register and participate in the federal E-verify program to verify the employment authorization of all new employees, or only employ workers who possess a valid S.C. driver's license or identification card issued by SCDMV. Those with 100 or more employees but less than 500 employees must comply with the work verification requirement on and after July 1, 2009. Finally, contractors, sub-contractors, and sub-subcontractors with less than 100 employees must comply on and after Jan. 1, 2010. Section 8-14-20(C) prohibits a public employer and contractor from dividing work under a contract that would otherwise constitute a single service contract into separate contracts to avoid the requirements of the act.
Pursuant to §41-8-20(A), the act creates an implied employment license granted to any private entity employing individuals beginning July 1, 2009. This imputed employment license is in addition to any business licenses issued by local government. On and after July 1, 2009, a private employer may not employ a person if this imputed employment license has been suspended or revoked. Private employers, like public employers, must verify the work authorization of all new employees through the E-Verify program, or the employee must have a valid S.C. driver's license or identification card issued by SCDMV. Section 41-8-20(B) requires that on and after July 1, 2009, all private employers of 100 or more employees must verify the work authorization of their new employees. All private employers with less than 100 employees must comply with the verification requirement on and after July 1, 2010. If a private employer fails to verify a new employee, they can be fined or even have their imputed employment license revoked by the S.C. Department of Labor, Licensing and Regulation (LLR). All fines collected are retained by LLR. A state, county or local official must not attempt to independently determine if a person is authorized to work in the U.S.
Section 43-83-30(D) provides that a business that provides immigration services must obtain a license issued by LLR in addition to any local business licenses. The business must not provide legal advice, unless they are an attorney. Under §43-83-30 (I) and (K), a business that fails to comply with these requirements may be fined up to $1,000 per violation, as well as a revocation of all licenses.
Section 23-3-80 (A), (C), and (D) authorizes SLED to enter into a Memorandum of Understanding between the State and the U.S. Department of Justice or Homeland Security for the enforcement of federal immigration laws by state and local law enforcement, which includes the detention and removal of detained unlawful aliens. Under this agreement, a sheriff may enter as a party to the Memorandum of Understanding, subject to the availability of funds from the federal government, to have corrections officers and local law enforcement trained to enforce federal immigration and customs laws. Additionally, §23-3-1100(A) requires the state, county, municipality, and regional jail authorities to make a reasonable effort to verify the nationality of prisoners confined in their respective facilities. A prisoner's legal status in the U.S. can be considered as a factor in granting a bond.
Under §8-29-10, every state agency and political subdivision must verify the lawful presence in the U.S. of any alien 18 years or older who has applied for state or local public benefits, as defined in 8 USC §1621, or for federal public benefits, as defined in 8 USC §1611, that are administered by an agency or a political subdivision of this state. In reviewing the public benefits defined under these federal laws, it does not appear that this provision is applicable to any county assistance programs. However, no authoritative decision has been made, and careful review of your county's programs is warranted.
Section 14-7-1630(A) expands the jurisdiction of the state grand jury by including charges of making false statements or representation regarding a person's lawful presence in the U.S., creating false immigration documents, and aiding and abetting in the creation of false immigration documents through an immigration assistance service.
Finally, §6-1-170 (B) and (D), state that local government may not enact any ordinance that prohibits a law enforcement officer, local official or local government employee from seeking to enforce state immigration law. Local government also may not enact any ordinance that exceeds or otherwise conflicts with federal law or that is in conflict with state law regarding immigration.
July 18, 2008
Identity Theft and Fraud Protection Act of 2008 — Act 190 (R. 202, S. 453)
This Technical Bulletin outlines changes adopted by the General Assembly in Act No. 190 of 2008, relating to identity theft and fraud protection laws. Please consult your county attorney, if you have specific questions about the interpretation or application of these changes. SCAC's staff is also available at 1-800-922-6081 to address general questions.
The S.C. Legislature enacted Act 190 of 2008 (R. 202, S. 453), which provides a comprehensive change in the laws to address the growing problem of identity theft and identity fraud. It also provides some guidelines for counties on how to handle personal identifying information. The effective date of the act is Dec. 31, 2008.
Personal identifying information is defined pursuant to Section 16-13-510(C) and includes, but is not limited to: (1) Social Security Numbers; (2) driver's license numbers; (3) checking account numbers; (4) savings account numbers; (5) credit card numbers; (6) debit card numbers; (7) personal identification numbers; (8) electronic identification numbers; (9) digital signatures; (10) other numbers or information which may be used to access a person's financial resources; or (11) identifying information that defines a person other than the person presenting the document. Documents described by item (11) include—but are not limited to—passports, driver's licenses, birth certificates, immigration documents and state-issued identification cards.
Under §37-20-160(A) of the act, a person who is the victim of identity theft may, upon written request to a consumer reporting agency, place a security freeze on their consumer credit file. The security freeze can only be lifted at the request of the consumer; however, this security freeze does not apply to a local government entity—including a law enforcement agency or court—if acting pursuant to a court order, warrant, subpoena or administrative subpoena. It also does not apply to a local official attempting to collect a debt owed by the consumer to a public entity.
While the law prohibits public posting or display of a person's Social Security Number and precludes the use of a person's Social Security Number in certain consumer transactions, under §37-20-180(B)(4) and (8), it does not preclude the use and release of a person's Social Security Number to do a background check or collect a debt—including a debt collected pursuant to the Setoff Debt Collection Act, §12-56-10. It also does not preclude a person from providing their Social Security Number to a local government entity, nor does it preclude the use of a Social Security Number or other personal identifying information as part of the maintenance and reporting of employment records.
Although there are legitimate reasons for local government entities to collect Social Security Numbers or other personal identifying information from individuals, government entities should collect the information only for legitimate purposes or when required by law. Local governments should also minimize the instances this information is disseminated either internally or externally with other governmental agencies or the general public. Public bodies that collect Social Security Numbers must segregate that number on a separate page from the rest of the record, or as otherwise appropriate, so that the Social Security Number may be easily redacted pursuant to a public records request in compliance with §30-2-310(A)(1)(b).
Pursuant to §30-2-310 (B) and (C), public bodies disposing of technology hardware such as computer equipment must have all personal and confidential information removed and sanitized in accordance with standards and policies adopted by the State Budget and Control Board, Division of the State Chief Information Officer. When a public body disposes of a record that contains personal identifying information of an individual, it must modify the personal identifying information by shredding, erasing or other means to make it unreadable or undecipherable. Section 30-2-310(D) allows a public body to contract with a third party in the business of shredding records.
Section 16-11-725 makes it a Class F felony crime to rummage through or steal another person's household garbage or litter for the purpose of obtaining information to commit financial identity fraud or identity theft. This provision does not prevent state or local law enforcement officers from apprehending suspected offenders who may be hiding in the cover of garbage or litter, but does not give law enforcement any additional rights or powers upon private property.
Under §30-2-330(A), a person preparing or filing a document to be recorded in the official records by the register of deeds or the clerk of court may not include an individual's Social Security Number, driver's license, state identification, passport, checking or savings account, credit or debit card number, personal identification code or passwords in the document—unless required by law or court order. Pursuant to §30-2-330(B), a consumer or their attorney may request, at no charge, that such personal identifying information be redacted from an image or copy of an official record of a public document, such as a mortgage, on the register of deeds or clerk of court's public website. The request must be in writing and must specify the identification page number of the document that contains the personal identifying information. The register of deeds or the clerk of court has no duty to verify the identity of the person requesting the redaction, and they are immune from claims or damages that arise from personal identifying information on the public records. There is some question as to whether the information redaction process provided in §30-2-330(B) applies only to electronic copies or to physical copies in light of §30-1-30, which prohibits the alteration of public records.
Section 16-13-512(A) (1) and (3) states that any business or state or local government entity that accepts credit cards or debit cards must not print on a receipt more than five digits of the credit card or debit card number and the expiration date. This does not apply to credit card or debit card numbers taken solely by handwriting or by an imprint or copy of the credit or debit card. Machines in use before Jan. 1, 2005 have to come into compliance with this provision by Dec. 31, 2011, while credit card machines put into use after Jan. 1, 2005 have until Dec. 31, 2009 to come into compliance with §16-13-512(D) (1) and (2).
Under the provisions of §1-11-490, beginning on July 1, 2009, all state agencies and political subdivisions must notify all affected individuals as soon as reasonably possible of a security breach in their database containing the individual's personal identifying information. Section 37-20-110(15) defines a security breach as an incident of unauthorized access to and acquisition of records or data that was not rendered unusable through encryption, redaction or other methods containing personal identifying information that compromises the security, confidentiality or integrity of personal identifying information maintained by a person when illegal use of the information has occurred or is reasonably likely to occur, or use of the information creates a material risk of harm to the consumer. Good faith acquisition and use of personal identifying information by an employee or agent of the person for a legitimate purpose is not considered a security breach.
Notice of a security breach may be given in writing, by facsimile or by telephone. If the agency or political subdivision can demonstrate that the cost of providing notice would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or there is insufficient contact information, the agency or political subdivision may provide notice by e-mail, by posting it conspicuously on their website or by major statewide media. If notice is to be provided to more than 1,000 persons at one time, the agency or political subdivision must also provide notification to Consumer Affairs and all national consumer reporting agencies. Failure to notify may result in an administrative fine up to $1,000 for each resident whose information was accessible by the breach—the amount of the fine to be determined by the Department of Consumer Affairs.
When dealing with Act No. 190 of 2008, it would be prudent to also review the Federal Trade Commission "Red Flag Rule" identity theft protection requirements, which is codified at 16 CFR 681. It requires all financial institutions and creditors to implement an identity theft program for customer accounts. The rule requires reasonable procedures to identify red flags such as an address discrepancy on a customer account or unusual/suspicious activity on an account—such as a high number of credit inquiries. The procedures must be able to detect the red flags that have been established and respond to them appropriately. Finally, the red flag program must be updated periodically to reflect the risk of identity theft. All affected entities must comply with the Red Flag Rule by Nov. 8, 2008.
View 2007 Technical Bulletins
View 2006 Technical Bulletins