Attachment 4.pdf

South Carolina Department of Motor Vehicles

AD-503B

CONTRACT PERSONNEL ACKNOWLEDGMENT OF DUTY OF (Rev. 11/2020)

NON-DISCLOSURE AND DUE DILIGENCE

____Initial

THIS DOCUMENT DOES NOT CREATE ANY CONTRACTUAL RIGHTS OR ENTITLEMENTS. THE AGENCY RESERVES THE RIGHT TO

REVISE THE CONTENT OF THIS DOCUMENT, IN WHOLE OR IN PART.

This is an acknowledgment of the contractor’s obligations to protect personal or sensitive information from wrongful or unlawful disclosure and to protect the SCDMV computer network or computer systems and to the information contained in those systems (hereinafter collectively referred to as "SCDMV confidential information") have a continuing legal duty to maintain the confidentiality of such information and to prevent the improper disclosure of this information.

I, , acknowledge that, as a contractor for the SCDMV, I may have contact with sensitive Personally Identifiable Information (PII). I am also aware that the SCDMV strives to protect the citizens of South Carolina from fraud or invasion of privacy by safeguarding their PII. In addition, I may have contact with confidential information related to SCDMV systems.

I. Personal Identifiable Information (PII):

I understand that the SCDMV defines PII as any data or information either identifying an individual to whom the information applies or enabling the person receiving the data or information to ascertain or determine by any reasonable means the identity of the individual to whom it applies. Below is a listing of PII based on situations that routinely occur in the SCDMV. The information below should be considered in its entirety.

1. Customer Records: In all cases for Customer Records, PII specifically includes:

a. An individual's photograph or digitized image;

b. social security numbers;

c. name;

d. address (but not the 5-digit zip code);

e. telephone number;

f. dates of birth;

g. driver's license or identification number;

h. home telephone number;

i. medical or disability information;

j. checking account numbers;

k. savings account numbers;

l. credit card numbers;

m. debit card numbers;

n. personal identification (PIN) numbers;

o. electronic identification numbers;

p. digital signatures.

q. In all cases for Customer Records, the following PII shall be considered “highly restricted personal information”:

1. social security number;

2. an individual’s photograph or digitized image;

3. medical or disability information.

2. Employee Records (In all cases)

a. Social security numbers;

b. Dates of birth;

c. Home address;

d. Home telephone numbers;

e. Personal cell phone numbers; and

f. Medical and/or disability information.

3. Commercial Solicitation: The following information is PII only for purposes of commercial solicitation as defined in the Family Privacy Protection Act SC Code §30-2-10:

CONTRACT PERSONNEL ACKNOWLEDGMENT OF DUTY OF (Rev. 11/2020)

NON-DISCLOSURE AND DUE DILIGENCE

a. education level;

b. financial status;

c. account or identification number issued by or used, or both, by any federal or state governmental agency or private financial institution;

d. employment history;

e. height;

f. weight;

g. race;

h. other physical details;

i. signature;

j. biometric identifiers; and

k. any credit records or reports.

4. Combinations of Information: Although individually these items may already be PII based on the lists above (for example, a social security number by itself), the following information is also PII when two (2) or more of these pieces of information are together:

a. Current or former names, including first and last names, middle and last names, or first, middle, and last names (not including electronic identification names or parent’s legal surname before marriage);

b. Current or former addresses (not including electronic mail addresses); c. dates of birth;

d. driver’s license or identification number;

e. checking account numbers;

f. savings account numbers;

g. credit card numbers;

h. debit card numbers;

i. personal identification (PIN) numbers;

j. electronic identification numbers;

k. digital signatures; and

l. other numbers, passwords, or information which may be used to access a person’s financial resources, numbers, or information issued by a governmental or regulatory entity that uniquely will identify an individual or an individual’s financial resources.

II. SCDMV Confidential System Information:

I understand that I have the duty to protect, keep confidential and not to disclose any information regarding the SCDMV's computer or information systems including all infrastructure, hardware, software and software documentation, utilized by the SCDMV, whether the same is owned by, leased by or licensed to the SCDMV. In the performance of these duties I must:

• take precaution to prevent improper access to any passwords, user identifications, or other information that may be used to access the SCDMV's computer systems and to strictly comply with all SCDMV policies and standards relating to use and security of the SCDMV's information resources

• limit access to information contained in the SCDMV computer systems only to persons who are authorized to view it or receive it and avoid sharing, recording, transmitting, altering or deleting the information except as required in the performance of my duties

• treat all systems information, including, but not limited to, systems design, software and hardware components, and any other Information Technology information as confidential

• not take any steps to reverse engineer, translate, disassemble or decompile any machine or object code to derive a source code.

III. I further acknowledge the following duties and responsibilities to the SCDMV under this agreement:

1. I will not view, print, download, transfer or release (to include orally) any PII or Confidential data unless a specific job related duty requires me to do so.

2. I will, to the best of my ability, safeguard all aspects of every customer’s PII. This includes but is not limited to all computer and hard copy data.

3. I will, to the best of my ability, safeguard and protect any and all types of personal identifying information of SCDMV employees and sensitive information related to SCDMV operations.

4. I will not use any PII that I become privy to in the course of my work for anything other than SCDMV job related duties.

5. I will, to the best of my ability, safeguard and protect the SCDMV computer network. This includes but is not limited to ensuring that I take all due diligence precautions regarding network security.

6. I understand that after my assignment ends with the SCDMV I will not disclose any PII or confidential data that I had access to during my assignment with the SCDMV.

I understand that, if I make any improper disclosure of such personal information from any other person’s driver or vehicle file, a report of such disclosure will be made and submitted to the Inspector General’s Office for review and possible prosecution.

Improper use of SCDMV data may result in violation of contract.

In addition, I have been advised that if I knowingly or willfully breach my duty of non-disclosure, I may face criminal charges, including but not limited to penalties under title 18 of the United States Code, in addition to civil liability for damages, punitive damages and attorneys’ fees. I likewise acknowledge that if I breach my duty of due diligence I may likewise incur civil liability as allowed by law.

Printed name:

Signature:

The signing of this acknowledgement must be witnessed by contractor’s senior level supervisor. If free agent, must be witnessed by SCDMV contact person.

Printed name:

Signature:

( Contractor’s Name) Date:

( Witness’ Name ) Date:

The Following Codes of Law pertain to Form AD-503B, Contract Personnel Acknowledgement of Duty of Non-Disclosure and Due Diligence:

SECTION 30-4-160 of the 1976 South Carolina Code of Laws Sale of Social Security number or driver’s license photograph or signature.

(A) This chapter does not allow the Department of Motor Vehicles to sell, provide, or otherwise furnish to a private party

Social Security numbers in its records, copies of photographs, or signatures, whether digitized or not, taken for the purpose of a driver’s license or personal identification card.

(B) Photographs, signatures, and digitized images from a driver’s license or personal identification card are not public records.

SECTION 30-4-165 of the 1976 South Carolina Code of Laws Privacy of driver’s license information.

(A) The Department of Motor Vehicles may not sell, provide, or furnish to a private party a person’s height, weight, race, social security number, photograph, or signature in any form that has been compiled for the purpose of issuing the person a driver’s license or special identification card. The department shall not release to a private party any part of the record of a person under fifteen years of age who has applied for or has been issued a special identification card.

(B) A person’s height, weight, race, photograph, signature, and digitized image contained in his driver’s license or special identification card record are not public records.

(C) Notwithstanding another provision of law, a private person or private entity shall not use an electronically-stored version of a person’s photograph, social security number, height, weight, race, or signature for any purpose, when the electronically-stored information was obtained from a driver’s license record.

SECTION 30-2-20 of the 1976 South Carolina Code of Laws Privacy policies and procedures required of all state entities.

All state agencies, boards, commissions, institutions, departments, and other state entities, by whatever name known, must develop privacy policies and procedures to ensure that the collection of personal information pertaining to citizens of the State is limited to such personal information required by any such agency, board, commission, institution, department, or other state entity and necessary to fulfill a legitimate public purpose.

US CODE Title 18 Chapter 123 § 2721.

Prohibition on release and use of certain personal information from State motor vehicle records

(A) In General.— A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity:

1. personal information, as defined in 18 U.S.C. 2725 (3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section; or

2. highly restricted personal information, as defined in 18 U.S.C. 2725 (4), about any individual obtained by the department in connection with a motor vehicle record, without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9): Provided, That subsection (a)(2) shall not in any way affect the use of organ donation information on an individual’s driver’s license or affect the administration of organ donation initiatives in the States.

(B) Permissible Uses.— Personal information referred to in subsection (a) shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992, the Automobile Information Disclosure Act (15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C.

7401 et seq.), and chapters 301, 305, and 321–331 of title 49, and, subject to subsection (a)(2), may be disclosed as follows:

1. For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.

2. For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers;

http://www4.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html#3 http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html#3 http://www4.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html#4 http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html#4 http://www4.law.cornell.edu/uscode/html/uscode15/usc_sup_01_15.html http://www4.law.cornell.edu/uscode/html/uscode15/usc_sup_01_15.html http://www4.law.cornell.edu/uscode/html/uscode15/usc_sec_15_00001231----000-.html http://www4.law.cornell.edu/uscode/html/uscode15/usc_sec_15_00001231----000-.html http://www4.law.cornell.edu/uscode/html/uscode42/usc_sup_01_42.html http://www4.law.cornell.edu/uscode/html/uscode42/usc_sup_01_42.html http://www4.law.cornell.edu/uscode/html/uscode42/usc_sec_42_00007401----000-.html http://www4.law.cornell.edu/uscode/html/uscode42/usc_sec_42_00007401----000-.html http://www4.law.cornell.edu/uscode/html/uscode49/usc_sup_01_49.html http://www4.law.cornell.edu/uscode/html/uscode49/usc_sup_01_49.html motor vehicle market research activities, including survey research; and removal of nonowner records from the original owner records of motor vehicle manufacturers.

3. For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only—

a. to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and

b. if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.

4. For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.

5. For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.

6. For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.

7. For use in providing notice to the owners of towed or impounded vehicles.

8. For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.

9. For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver’s license that is required under chapter 313 of title 49.

10. For use in connection with the operation of private toll transportation facilities.

11. For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.

12. For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.

13. For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.

14. For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.

(C) Resale or Redisclosure.— An authorized recipient of personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (12)). An authorized recipient under subsection (b)(11) may resell or redisclose personal information for any purpose. An authorized recipient under subsection (b)(12) may resell or redisclose personal information pursuant to subsection (b)(12). Any authorized recipient (except a recipient under subsection (b)(11)) that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.

(D) Waiver Procedures.— A State motor vehicle department may establish and carry out procedures under which the department or its agents, upon receiving a request for personal information that does not fall within one of the exceptions in subsection (b), may mail a copy of the request to the individual about whom the information was requested, informing such individual of the request, together with a statement to the effect that the information will not be released unless the individual waives such individual’s right to privacy under this section.

(E) Prohibition on Conditions.— No State may condition or burden in any way the issuance of an individual’s motor vehicle record as defined in 18 U.S.C. 2725 (1) to obtain express consent. Nothing in this paragraph shall be construed to prohibit a State from charging an administrative fee for issuance of a motor vehicle record.

http://www4.law.cornell.edu/uscode/html/uscode49/usc_sup_01_49_10_VI_20_B_40_313.html http://www4.law.cornell.edu/uscode/html/uscode49/usc_sup_01_49_10_VI_20_B_40_313.html http://www4.law.cornell.edu/uscode/html/uscode49/usc_sup_01_49.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sup_01_18.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002725----000-.html#1