Drafter
Clerk 12/11/2002
title
AN ORDINANCE relating to the privacy of credit card, debit card or check card account numbers; amending Ordinance 13923, Section 3, and K.C.C. 4.100.010 and adding a new section to K.C.C. chapter 4.100.
body
BE IT ORDAINED BY THE COUNCIL OF KING COUNTY:
SECTION 1. Purpose. This ordinance sets forth the privacy standards if credit card, debit card or check card numbers are obtained by the county when a customer pays for county goods or services with a credit card, debit card or check card. RCW 42.17.310(1)(ss) exempts certain credit card, debit card and electronic check information from public disclosure. With theft of personally identifiable information, including credit card, debit card and check card information on the rise, the county recognizes the need to protect credit card, debit card and check card account numbers from unauthorized, fraudulent or criminal access.
SECTION 2. Ordinance 13923, Section 3, and K.C.C. 4.100.010 are each hereby amended to read as follows:
Definitions. The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.
A. "Agency" means any department, office or agency managed by an elected official of any branch of King County government.
B. "Authorized personnel" means county staff assigned to process credit card, debit card or check card transactions.
C. "Automated clearing house" means an association of depository institutions that process financial transactions electronically through the Federal Reserve Bank.
D. "Check card" means a card indicating that the holder named on the card has an open checking account in a financial institution shown on the card and that the holder named on the card is authorized to use the card in lieu of a paper check to pay for the purchase of goods or services from participating merchants so long as the account is valid and has adequate funds to cover the cost of either goods or services at the time of the transaction.
((B.)) E. "Convenience fee" means a fee that is charged to a credit card, check card or debit card holder ((payer)) for the convenience of making a payment through an interactive voice response system or through the Internet.
F. "Counter" means the county facility where the customer is physically present when completing the purchase of county goods or services with a credit card, debit card or check card.
((C.)) G. "Credit card" means a card indicating that the holder named on the card has obtained a revolving line of credit from the financial institution issuing the card up to a certain dollar amount valid to a specified date shown on the card. A credit card may be used to pay for ((products or)) goods and services ((, or both)) from merchants participating in the corresponding credit card program.
H. "Customer" means the person who is purchasing county goods or services with a credit card, debit card or check card.
((D.)) I. "Debit card" means a card indicating that the holder named on the card has an open account in a financial institution shown on the card and that the holder named on the card is authorized to pay for purchases of goods and services from participating merchants ((and organizations if)) so long as the account is ((still)) valid and has adequate funds to cover the cost of either goods or services, or both, at the time of the transaction.
((E.)) J. "Electronic payments" means any financial transaction by which funds are transferred to the county through any type of electronic media. The electronic media include, but are not limited to, automated clearing houses, credit cards, debit cards, check cards, smart cards and wire transfers.
K. "Immediately after" means upon completion of the credit card, debit card or check card transaction.
((F.)) L. "Interactive voice response system" means a system that allows users to pay for services over the telephone or other audio-signal carrier using a credit card, debit card or check card.
M. "Merchant copy" means the portion of the physical credit card, debit card or check card transaction receipt that is signed by the holder and retained by the county after completion of the credit card, debit card or check card transaction.
((G.)) N. "Nontax payment" means a payment made for the main purpose of purchasing either goods or services, or both. The transaction may require collection of an excise tax related to the purchase of either goods or services, or both.
((H.)) O. "Smart card" means a card, issued by a participating merchant or organization, that has an electronic chip with a specified amount stored ((electronically)) on the card to be spent for future transactions. ((The usable balance remaining on the card decreases with each purchase of goods or usage of the service.))
((I.)) P. "Tax payment" means a payment made for the purpose of fulfilling tax obligations ((and)) or other special assessments that may be included on the tax statement.
((J.)) Q. "Transaction fee" means a fee charged by a service provider for the execution of an electronic payment.
((K.)) R. "Wire transfer" means a financial transaction in which the transferor of the funds authorizes an immediate transfer of funds from ((his or her)) a bank account to another specified bank account.
NEW SECTION. SECTION 3. There is hereby added to K.C.C. chapter 4.100 a new section to read as follows:
Credit card, debit card or check card number privacy policy.
A. Electronic commerce systems, either Internet or interactive voice response, shall not store credit card, debit card or check card numbers in a database or create a database where the numbers are retrievable by any county employee or county systems except as specifically authorized under subsection E of this section.
B. For credit card, debit card or check card transactions completed at a counter, county staff:
1. Shall not enter credit card, debit card or check card numbers into a database or create a database where the credit card, debit card or check card numbers are retrievable by any county employee or other county systems except as specifically authorized under subsection E of this section;
2. Shall give the holder's copy of the credit card, debit card or check card receipt to the customer; and
3. Shall store the merchant copy of the credit card, debit card or check card receipt for at least three years in a secure location immediately after the transaction is completed, and this location shall be accessible to authorized personnel only.
C. For mail-order and telephone order credit card, debit card or check card transactions, county staff:
1. Shall not enter credit card, debit card or check card numbers into a database or create a database where the credit card, debit card or check card numbers are retrievable by any county employee or other county systems except as specifically authorized pursuant to subsection E of this section;
2. Shall store the merchant copy of the credit card, debit card or electronic check receipt for at least three years in a secure location immediately after the transaction is completed, and this location shall be accessible to authorized personnel only;
3. Shall either mail the credit card, debit card or check card holder the customer's copy of the credit card, debit card or check card receipt or store it with the merchant copy, in accordance with agency policy;
4. Mail order and telephone order forms containing credit card, debit card or check card numbers must be either destroyed or stored with the merchant copy of the credit card, debit card or check card receipt in accordance with agency policy.
D. Agencies with existing systems that store credit card, debit card or check card numbers in locations retrievable by any county employee or other county systems as of the effective date of this ordinance must provide written notification to the executive and council chair with a plan to comply with this section by March 31, 2003. These agencies shall provide written notification to the executive and the council chair upon compliance with this section by December 31, 2003.
E. An agency must obtain written authorization from the executive and provide written notification to the council chair for the use of systems that collect credit card,
debit card or check card numbers in any location where credit card, debit card or check card numbers are retrievable by any county employee or other county systems.
ad requirements
None.