Protect Social Security numbers and meet Illinois IPA duties

The Illinois Identity Protection Act (5 ILCS 179) is a state law that limits how Illinois State and local government agencies collect, use, display and disclose Social Security numbers. It bans practices such as publicly posting SSNs, printing them on access cards or mailers and requiring them to be sent over an insecure Internet connection. It also requires every covered agency to adopt and implement a written identity-protection policy.

Illinois State agencies, local government agencies and the individuals they employ must comply. The Act defines a person as someone employed by a State or local government agency, so it does not place direct duties on private businesses. Contractors still feel its effect: before an agency discloses SSNs to a contractor or subcontractor, it must receive that contractor's policy showing how the Act's protections will be met.

Under Sections 35 and 37, the policy must identify the Act, require training for employees who have access to SSNs, limit access to employees who need to handle them, require SSNs to be collected in a way that makes them easy to redact, and provide a statement of purpose when an SSN is collected or on request. State agencies send a copy to the Social Security Number Protection Task Force; local agencies file theirs with their governing board.

Any person who intentionally violates the prohibitions in Section 10 is guilty of a Class B misdemeanor under Section 45. Because the Act defines a person as an individual employed by a State or local government agency, the criminal risk falls on individual employees as well as creating compliance exposure for the agency. Separately, agencies must still meet the policy and filing duties in Sections 35 and 37.

They are three separate Illinois laws. The Identity Protection Act (5 ILCS 179) governs how public bodies handle Social Security numbers. The Biometric Information Privacy Act (740 ILCS 14) regulates private entities that collect biometric identifiers such as fingerprints. The Personal Information Protection Act (815 ILCS 530) requires data breach notification and reasonable security for personal information. An organisation may need to address more than one of them.

An agency may collect, use or disclose an SSN only when State or federal law requires it or it is otherwise necessary for the agency's duties, the need and purpose are documented before collection, and the SSN is relevant to that purpose. Section 10(c) lists exceptions, including disclosures to contractors that have supplied a policy, court orders and subpoenas, internal verification, and fraud prevention or background checks.

The Illinois IPA is narrower: it focuses only on Social Security numbers held by public bodies. Many of its practical safeguards, such as access control, encryption in transit, training and documented policies, overlap with ISO 27001 Annex A controls and SOC 2 criteria. Mapping one set of controls across all three means evidence collected for one can support the others, though the IPA's specific prohibitions still need checking.

Yes, on request. The Illinois IPA is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once enabled, you can generate an identity-protection policy, collect evidence of access limits and encryption automatically, monitor for control drift and manage contractor policies. OneClickComply does not certify compliance, but its audit team can advise on how you meet the Act.