Amended
IN
Senate
June 13, 2019 |
Assembly Bill | No. 253 |
Introduced by Assembly Member Mark Stone |
January 23, 2019 |
Existing law establishes the University of California, under the administration of the Regents of the University of California, the California State University, under the administration of the Trustees of the California State University, and the California Community Colleges, under the administration of the Board of Governors of the California Community Colleges, and private, independent institutions of higher education as the 4 segments of postsecondary education in this state. Existing law requires the Office of Privacy Protection in the Department of Consumer Affairs to establish a task force, with specified members, to conduct a review of the use by all public and private colleges and universities in this state of social security numbers in order to recommend practices to minimize the collection, use, storage, and retention of social security numbers. Existing law requires the task
force to submit a report of its findings and recommendations to the Office of Privacy Protection and to the Assembly Committee on Judiciary and the Senate Committee on Judiciary, on or before July 1, 2010.
This bill would repeal that obsolete reporting requirement.
(a)As used in this section, “college and university” includes all institutions of public higher education and all independent institutions of higher education.
(b)The Office of Privacy Protection in the Department of Consumer Affairs shall establish a task force to conduct a review of the use by all colleges and universities of social security numbers in order to recommend practices to minimize the collection, use, storage, and retention of social security numbers in relation to academic and operational needs and applicable legal requirements.
(c)The task force shall be known as the “College and University Social Security Number Task Force.” The Office of
Privacy Protection shall determine the composition of the task force, which shall include, but not be limited to, all of the following:
(1)Two representatives from each of the three institutions of public higher education.
(2)Two representatives of the California Association of Independent Colleges and Universities.
(3)Two representatives each from two organizations devoted to the protection of personal privacy.
(4)One representative from a national organization devoted to the management of information technology in higher education.
(5)One representative from the business community with expertise in technological solutions to privacy concerns.
(6)One representative each from the Assembly Committee on Judiciary and the Senate Committee on Judiciary.
(d)The task force shall seek input, as deemed necessary and appropriate, from all of the following:
(1)Representatives of organizations with expertise in technical policy and practices of Internet disclosure, privacy policy relevant to Internet disclosure, and fostering public integrity and accountability.
(2)The constituencies of the college and university communities, including students, staff, and faculty.
(e)The task force shall review and make recommendations to minimize the collection, use, storage, and retention of social security numbers by California colleges and
universities and shall include, but not be limited to, all of the following:
(1)A survey of best practices at colleges and universities and the costs of implementing those best practices.
(2)The necessary use and protection of social security numbers for all of the following:
(A)Research purposes.
(B)Academic purposes, including, but not limited to, academic research, admission, financial aid, and other related operational uses.
(C)Operational uses by academic medical centers, including, but not limited to, patient identification, tracking, and care.
(D)Business purposes, including, but not limited to, the provision of
employee benefits, tax purposes, loan programs, and other requirements imposed by current state and federal statutes and regulations.
(E)Another operational need of the college or university.
(3)Current personal privacy protections provided to students, applicants, staff, and faculty of colleges and universities.
(4)Existing state and federal legal requirements, including regulatory requirements, mandating the use of social security numbers at colleges and universities.
(5)The possible use of personal identifiers or other substitutes for social security numbers that protect personal information and meet the operational needs of colleges and universities.
(6)The cost of funding any
recommendations presented by the task force, including those that are of minimal cost and can be implemented immediately and those that require additional funding or time to implement.
(f)The task force shall commence meetings no later than May 1, 2008.