Identity Theft Protection Act

During the 2005 legislative session, the General Assembly enacted the North Carolina Identity Theft Protection Act. This act imposes restrictions upon the collection and segregation of Social Security Numbers (SSN) and upon the disclosure and security of SSNs and other personal identifying information (PII). Below is a summary of the major impact:

1. SSNs may not be transmitted over the internet in unencrypted form.
2. SSNs may not be used for authentication without other identifying information.
3. SSNs may not be printed on any material mailed to an individual unless specifically required by federal law.
4. Individuals must be notified of security breaches when there’s a reasonable likelihood that their identifying information has been compromised.
5. Identifying information covers a wide range of data, including SSNs, bank account numbers, driver’s license numbers, biometric data (fingerprints), passwords and parent’s legal surname prior to marriage (often used by financial institutions as a form of authentication).
6. A violation of this act can result in significant monetary damages, exposure of personal information that could result in damages to the individual, and security breaches that could tarnish the reputation of the university.

Get Started

ITPA PII Use Request Process

  1. Submit this ITPA PII Use Request form for approval to collect, store, use or disclose SSNs or other PII subject to the North Carolina State Privacy and/or Identity Theft Protection Act(s).
  2. Submit a Technology Security Assessment request if new or unapproved technology will be used to process or store the PII in your request (e.g., software, devices, services, online service, etc.). Security concerns help determine approval of your request.
  3. The ITPC reviews your request and may contact you with any questions.
  4. The request is presented at the next available committee meeting for final approval. You may be asked to attend to address concerns from ITPC members.

Allow at least 30 days for the entire process.

Note: The submission of this request does not equate to approval.