Section 10IAC5-3-1. Mitigating factors

   The attorney general may, in his or her discretion, determine that the release of Social Security numbers was a negligent act and not a knowing, intentional, or reckless act if a state agency or employee establishes that the following provisions, singly or in combination, have been met:

(1) The release of the Social Security numbers is immediately stopped.

(2) Any individuals whose Social Security numbers are disclosed are immediately notified in a timely manner.

(3) The release of the Social Security numbers was as follows:

(A) Unintended.

(B) De minimis and nonsystematic.

(4) The handling of the Social Security numbers was conducted pursuant to a contractual relationship, and the contract contained a clause requiring the state agency and the contractor to comply with the following:

(A) The release of Social Security number provisions set forth in IC 4-1-10.

(B) The notice of security breach provisions set forth in IC 4-1-11.

(5) The state agency had established reasonable policies and procedures designed to prevent the unauthorized disclosure of individual Social Security numbers.

(6) Corrective measures are initiated to prevent future disclosures under similar circumstances.

(7) Other relevant circumstances as determined by the attorney general.

(Office of Attorney General for the State; 10 IAC 5-3-1; filed Jun 16, 2006, 2:50 p.m.: 20060712-IR-010050319FRA; readopted filed Aug 8, 2012, 11:11 a.m.: 20120905-IR-010120294RFA)