132-1.10. Social security numbers and other personal identifying information.

(a) The General Assembly finds the following:

(1) The social security number can be used as a tool to perpetuate fraud against a person and to acquire sensitive personal, financial, medical, and familial information, the release of which could cause great financial or personal harm to an individual. While the social security number was intended to be used solely for the administration of the federal Social Security System, over time this unique numeric identifier has been used extensively for identity verification purposes and other legitimate consensual purposes.

(2) Although there are legitimate reasons for State and local government agencies to collect social security numbers and other personal identifying information from individuals, government should collect the information only for legitimate purposes or when required by law.

(3) When State and local government agencies possess social security numbers or other personal identifying information, the governments should minimize the instances this information is disseminated either internally within government or externally with the general public.

(b) Except as provided in subsections (c) and (d) of this section, no agency of the State or its political subdivisions, or any agent or employee of a government agency, shall do any of the following:

(1) Collect a social security number from an individual unless authorized by law to do so or unless the collection of the social security number is otherwise imperative for the performance of that agency's duties and responsibilities as prescribed by law. Social security numbers collected by an agency must be relevant to the purpose for which collected and shall not be collected until and unless the need for social security numbers has been clearly documented.

(2) Fail, when collecting a social security number from an individual, to segregate that number on a separate page from the rest of the record, or as otherwise appropriate, in order that the social security number can be more easily redacted pursuant to a valid public records request.

(3) Fail, when collecting a social security number from an individual, to provide, at the time of or prior to the actual collection of the social security number by that agency, that individual, upon request, with a statement of the purpose or purposes for which the social security number is being collected and used.

(4) Use the social security number for any purpose other than the purpose stated.

(5) Intentionally communicate or otherwise make available to the general public a person's social security number or other identifying information. "Identifying information", as used in this subdivision, shall have the same meaning as in G.S. 14-113.20(b), except it shall not include electronic identification numbers, electronic mail names or addresses, Internet account numbers, Internet identification names, parent's legal surname prior to marriage, or drivers license numbers appearing on law enforcement records. Identifying information shall be confidential and not be a public record under this Chapter. A record, with identifying information removed or redacted, is a public record if it would otherwise be a public record under this Chapter but for the identifying information. The presence of identifying information in a public record does not change the nature of the public record. If all other public records requirements are met under this Chapter, the agency of the State or its political subdivisions shall respond to a public records request, even if the records contain identifying information, as promptly as possible, by providing the public record with the identifying information removed or redacted.

(6) Intentionally print or imbed an individual's social security number on any card required for the individual to access government services.

(7) Require an individual to transmit the individual's social security number over the Internet, unless the connection is secure or the social security number is encrypted.

(8) Require an individual to use the individual's social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site.

(9) Print an individual's social security number on any materials that are mailed to the individual, unless state or federal law required that the social security number be on the document to be mailed. A social security number that is permitted to be mailed under this subdivision may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened.

(c) Subsection (b) of this section does not apply in the following circumstances:

(1) To social security numbers or other identifying information disclosed to another governmental entity or its agents, employees, or contractors if disclosure is necessary for the receiving entity to perform its duties and responsibilities. The receiving governmental entity and its agents, employees, and contractors shall maintain the confidential and exempt status of such numbers.

(2) To social security numbers or other identifying information disclosed pursuant to a court order, warrant, or subpoena.

(3) To social security numbers or other identifying information disclosed for public health purposes pursuant to and in compliance with Chapter 130A of the General Statutes.

(4) To social security numbers or other identifying information that have been redacted.

(5) To certified copies of vital records issued by the State Registrar and other authorized officials pursuant to G.S. 130A-93(c). The State Registrar may disclose any identifying information other than social security numbers on any uncertified vital record.

(6) To any recorded document in the official records of the register of deeds of the county.

(7) To any document filed in the official records of the courts.

(c1) If an agency of the State or its political subdivisions, or any agent or employee of a government agency, experiences a security breach, as defined in Article 2A of Chapter 75 of the General Statutes, the agency shall comply with the requirements of G.S. 75-65.

(d) No person preparing or filing a document to be recorded or filed in the official records of the register of deeds, the Department of the Secretary of State, or of the courts may include any person's social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords in that document, unless otherwise expressly required by law or court order, adopted by the State Registrar on records of vital events, or redacted. Any loan closing instruction that requires the inclusion of a person's social security number on a document to be recorded shall be void. Any person who violates this subsection shall be guilty of an infraction, punishable by a fine not to exceed five hundred dollars ($500.00) for each violation.

(e) The validity of an instrument as between the parties to the instrument is not affected by the inclusion of personal information on a document recorded or filed with the official records of the register of deeds or the Department of the Secretary of State. The register of deeds or the Department of the Secretary of State may not reject an instrument presented for recording because the instrument contains an individual's personal information.

(f) Any person has the right to request that a register of deeds or clerk of court remove, from an image or copy of an official record placed on a register of deeds' or court's Internet Website available to the general public or an Internet Web site available to the general public used by a register of deeds or court to display public records by the register of deeds or clerk of court, the person's social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords contained in that official record. The request must be made in writing, legibly signed by the requester, and delivered by mail, facsimile, or electronic transmission, or delivered in person to the register of deeds or clerk of court. The request must specify the personal information to be redacted, information that identifies the document that contains the personal information and unique information that identifies the location within the document that contains the social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords to be redacted. The request for redaction shall be considered a public record with access restricted to the register of deeds, the clerk of court, their staff, or upon order of the court. The register of deeds or clerk of court shall have no duty to inquire beyond the written request to verify the identity of a person requesting redaction and shall have no duty to remove redaction for any reason upon subsequent request by an individual or by order of the court, if impossible to do so. No fee will be charged for the redaction pursuant to such request. Any person who requests a redaction without proper authority to do so shall be guilty of an infraction, punishable by a fine not to exceed five hundred dollars ($500.00) for each violation.

(f1) Without a request made pursuant to subsection (f) of this section, a register of deeds, clerk of court, or the Administrative Office of the Courts may remove from images or copies of publicly accessible official records any of the identifying and financial information listed in subsection (f) of this section that is contained in that official record. Registers of deeds, clerks of court, and the Administrative Office of the Courts may apply optical character recognition technology or other reasonably available technology to publicly accessible official records in order to, in good faith, identify and redact any of the identifying and financial information listed in subsection (f) of this section. Notwithstanding the foregoing, law enforcement personnel, judicial officials, and parties to a case and their counsel shall be entitled to access, inspect, and copy unredacted records.

(f2) The Administrative Office of the Courts or a clerk of superior court may keep confidential the names, phone numbers, and e-mail addresses collected for the purpose of a court proceeding notification system.

(g) A register of deeds or clerk of court shall immediately and conspicuously post signs throughout his or her offices for public viewing and shall immediately and conspicuously post a notice on any Internet Web site available to the general public used by a register of deeds or clerk of court a notice stating, in substantially similar form, the following:

(1) Any person preparing or filing a document for recordation or filing in the official records may not include a social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords in the document, unless expressly required by law or court order, adopted by the State Registrar on records of vital events, or redacted so that no more than the last four digits of the identification number is included.

(2) Any person has a right to request a register of deeds or clerk of court to remove, from an image or copy of an official record placed on a register of deeds' or clerk of court's Internet Web site available to the general public or on an Internet Web site available to the general public used by a register of deeds or clerk of court to display public records, any social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords contained in an official record. The request must be made in writing and delivered by mail, facsimile, or electronic transmission, or delivered in person, to the register of deeds or clerk of court. The request must specify the personal information to be redacted, information that identifies the document that contains the personal information and unique information that identifies the location within the document that contains the social security, employer taxpayer identification, drivers license, state identification, passport, checking account, savings account, credit card, or debit card number, or personal identification (PIN) code or passwords to be redacted. No fee will be charged for the redaction pursuant to such a request. Any person who requests a redaction without proper authority to do so shall be guilty of an infraction, punishable by a fine not to exceed five hundred dollars ($500.00) for each violation.

(h) Any affected person may petition the court for an order directing compliance with this section. No liability shall accrue to a register of deeds or clerk of court or to his or her agent for any action related to provisions of this section or for any claims or damages that might result from a social security number or other identifying information on the public record or on a register of deeds' or clerk of court's Internet website available to the general public or an Internet Web site available to the general public used by a register of deeds or clerk of court.