Newly passed privacy laws to affect how IU releases personal information

The Indiana state legislature has recently passed three new laws that will affect institutional operations at IU. The laws are designed to protect personal information and failure to abide by them can lead to criminal penalties. \nThe three laws will take effect July 1 and are designed to protect personal information -- including social security numbers, financial account numbers, debit card numbers, security codes and driver's license numbers. In order to protect such information these laws require IU not to disclose outside of the University more than the last four digits of an individual's social security number, unless IU has written consent of the disclosure. \nThe second law requires IU to dispose of such personal information in a secure manner to prevent third parties from misusing the information. Finally, the third law requires that IU notify individuals whose personal information has been exposed to unauthorized access as a result of a system security breach. \nWhen these laws go into effect, Beth Cate, associate University counsel, said there will be "no big sweeping changes" since IU "is always attempting to keep personal information secure." \nHowever, she said some subtle changes will need to be made and old records containing students' social security numbers seems to be the most pressing instance. \nSpecifically she said many teachers in the past would allow students to fill in their social security number instead of their school ID number if they forgot it. Now, these records are going to have be disposed of properly in order to not be in violation of any of the rules. \nAccording to the IU Information Technology Policy Office's Web site, "knowing, intentional, or reckless disclosure of an SSN in violation of the new law is a felony, which carries up to three years jail time and up to $10,000 in fines. A negligent disclosure is an infraction, which carries up to one year jail time and up to $5,000 in fines." \nIn addition, these laws open a venue for individuals to sue the University or its employees under the state's common law because of negligence, according to the Web site.