A BILL TO BE ENTITLED
AN ACT amending the identity theft protection act of 2005.
The General Assembly of North Carolina enacts:
SECTION 1.  G.S. 132‑1.10 is amended by adding the following new subsection to read:
"(c1)	If an agency of the State or its political subdivisions, or any agent or employee of a government agency, experiences a security breach, as defined in Article 2A of Chapter 75 of the General Statutes, the agency shall comply with the requirements of G.S. 75‑65."
SECTION 2.  G.S. 132‑1.10(b)(5) reads as rewritten:
"(b)	Except as provided in subsections (c) and (d) of this section, no agency of the State or its political subdivisions, or any agent or employee of a government agency, shall do any of the following:
…
(5)	Intentionally communicate or otherwise make available to the general public a person's social security number or other identifying information. "Identifying information", as used in this subdivision, shall have the same meaning as in G.S. 14‑113.20(b), except it shall not include electronic identification numbers, electronic mail names or addresses, Internet account numbers, Internet identification names, parent's legal surname prior to marriage, or drivers license numbers appearing on law enforcement records. Identifying information shall be confidential and not be a public record under this Chapter. A record, with identifying information removed or redacted, is a public record if it would otherwise be a public record under this Chapter but for the identifying information. The presence of identifying information in a public record does not change the nature of the public record. If all other public records requirements are met under this Chapter, the agency of the State or its political subdivisions shall respond to a public records request, even if the records contain identifying information, as promptly as possible, by providing the public record with the identifying information removed or redacted."
SECTION 3.  G.S. 132‑1.10(d) reads as rewritten:
"(d)	No person preparing or filing a document to be recorded or filed in the official records of the register of deeds, the Department of the Secretary of State, or of the courts may include any person's social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords in that document, unless otherwise expressly required by law or court order, adopted by the State Registrar on records of vital events, or redacted. Any loan closing instruction that requires the inclusion of a person's social security number on a document to be recorded shall be void. Any person who violates this subsection shall be guilty of an infraction, punishable by a fine not to exceed five hundred dollars ($500.00) for each violation."
SECTION 4.  G.S. 132‑1.10(e) reads as rewritten:
"(e)	The validity of an instrument as between the parties to the instrument is not affected by the inclusion of personal information on a document recorded or filed with the official records of the register of deeds or the Department of the Secretary of State. The register of deeds or the Department of the Secretary of State may not reject an instrument presented for recording because the instrument contains an individual's personal information."
SECTION 5.  G.S. 132‑1.10(f) reads as rewritten:
"(f)	Any person has the right to request that the Department of the Secretary of State, a register of deeds or clerk of court remove, from an image or copy of an official record placed on the Department of the Secretary of State's, a register of deeds' or court's Internet Website available to the general public or an Internet Web site available to the general public used by the Department of the Secretary of State, a register of deeds or court to display public records by the Department of the Secretary of State, the register of deeds or clerk of court, the person's social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords contained in that official record. The request must be made in writing, legibly signed by the requester, and delivered by mail, facsimile, or electronic transmission, or delivered in person to the Department of the Secretary of State, the register of deeds or clerk of court. The request must specify the personal information to be redacted, information that identifies the document that contains the personal information and unique information that identifies the location within the document that contains the social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords to be redacted. The request for redaction shall be considered a public record with access restricted to the Department of the Secretary of State, the register of deeds, the clerk of court, their staff, or upon order of the court. The Department of the Secretary of State, the register of deeds or clerk of court shall have no duty to inquire beyond the written request to verify the identity of a person requesting redaction and shall have no duty to remove redaction for any reason upon subsequent request by an individual or by order of the court, if impossible to do so. No fee will be charged for the redaction pursuant to such request. Any person who requests a redaction without proper authority to do so shall be guilty of an infraction, punishable by a fine not to exceed five hundred dollars ($500.00) for each violation."
SECTION 6.  G.S. 132‑1.10(g) reads as rewritten:
"(g)	The Department of the Secretary of State, a register of deeds or clerk of court shall immediately and conspicuously post signs throughout his or her offices for public viewing and shall immediately and conspicuously post a notice on any Internet Web site available to the general public used by the Department of the Secretary of State, a register of deeds or clerk of court a notice stating, in substantially similar form, the following:
(1)	Any person preparing or filing a document for recordation or filing in the official records may not include a social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords in the document, unless expressly required by law or court order, adopted by the State Registrar on records of vital events, or redacted so that no more than the last four digits of the identification number is included.
(2)	Any person has a right to request the Department of the Secretary of State, a register of deeds or clerk of court to remove, from an image or copy of an official record placed on the Department of the Secretary of State's, a register of deeds' or clerk of court's Internet Web site available to the general public or on an Internet Web site available to the general public used by the Department of the Secretary of State, a register of deeds or clerk of court to display public records, any social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords contained in an official record. The request must be made in writing and delivered by mail, facsimile, or electronic transmission, or delivered in person, to the Department of the Secretary of State, the register of deeds or clerk of court. The request must specify the personal information to be redacted, information that identifies the document that contains the personal information and unique information that identifies the location within the document that contains the social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords to be redacted. No fee will be charged for the redaction pursuant to such a request. Any person who requests a redaction without proper authority to do so shall be guilty of an infraction, punishable by a fine not to exceed five hundred dollars ($500.00) for each violation."
SECTION 7.  G.S. 132‑1.10(h) reads as rewritten:
"(h)	Any affected person may petition the court for an order directing compliance with this section. No liability shall accrue to the Department of the Secretary of State, a register of deeds or clerk of court or to their agents for any action related to provisions of this section or for any claims or damages that might result from a social security number or other identifying information on the public record or on the Department of the Secretary of State's, a register of deeds' or clerk of court's Internet website available to the general public or an Internet Web site available to the general public used by the Department of the Secretary of State, a register of deeds or clerk of court."
SECTION 8.  The provisions of G.S. 132‑1.10(b)(5) shall not apply to identifying information accessible on the Internet Web site of the Department of the Secretary of State or by magnetic tapes, electronic data feeds, or electronic file transfers of all records or updates of records on file with the Secretary of State until July 1, 2007.  Notwithstanding the exemption provided by this section, the Department of the Secretary of State shall, whenever funds are made available, make it a priority to first remove identifying information contained in Uniform Commercial Code financing statements filed with the Department of the Secretary of State under Chapter 25 of the General Statutes no later than June 30, 2007.
SECTION 9.  The Department of the Secretary of State shall study the alternatives and costs for redacting identifying information contained in the records of the Department of the Secretary of State, including the Internet Web site of the Department, and shall report the results of its study to the Office of State Budget and Management and to the House and Senate cochairs of the Joint Appropriations Subcommittee on General Government on or before February 1, 2007.  This study shall focus on the most expeditious, cost‑effective method of redacting identifying information on or before January 1, 2007.
SECTION 10.  Section 1 of this act becomes effective October 1, 2006.  Sections 5 through 7 of this act are effective when the act becomes law and expire on July 1, 2007. The remainder of this act is effective when the act becomes law.