Policy 3.24 Personal Information Protection

NILES-MAINE DISTRICT LIBRARY PERSONAL INFORMATION PROTECTION POLICY

The Illinois Personal Information Protection Act is a state law designed to protect the dissemination of personal information by entities, including the Niles-Maine District Library, which collect and disburse personal information. 815 ILCS 530/1, et seq. The Act prohibits the Library District from disclosing "personal information" to unauthorized parties. The Personal Information Protection Act specifically requires data collectors to notify affected individuals whenever a breach of the security of the data collector's system data occurs. This policy is intended to comply with that Act.

1. Niles-Maine District Library ("NMDL") will take all measures reasonably necessary to protect the security, confidentiality and integrity of "personal information" as defined in the Personal Information Act, 815 ILCS530/1 et seq. "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, State or local government records. 815 ILCS 530/5
2. Any suspected breach or compromise of the security (as defined in 815 ILCS 530/5) of NMDL data which contains personal information shall be investigated promptly by the NMDL Director. Using personal information for a purpose unrelated to the business of NMDL, and making personal information available in order to further disclosures that are unauthorized by 815 ILCE 530/5, also constitute breaches or compromises of the security of NMDL data.
3. The NMDL Director may consult with local law enforcement officials and/or NMDL before making a determination as to notifying the affected individuals that there has been a breach of NMDL data which contains personal information.
4. If notice to the affected individuals is appropriate, notice shall be given in accordance with the Personal Information Protection Act. "Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted:
   1. Social Security number
   2. Driver's license number or State identification card number
   3. Account number or credit or debit card number, or an account number or credit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account.
5. No NMDL employee (other than the NMDL Director) shall contact any individual about a suspected breach or compromise of the security of NMDL data which contains personal information. Every such security-related incident must be reported immediately to the NMDL Director.