A new law recently passed in the State of New York regulates the disposal of records that contain sensitive personal information (NY CLS Gen Bus § 399-h (2006)). This law becomes effective December 4, 2006 and requires that when a business disposes of records containing "personal identifying information, " it does so in a responsible manner.
The personal identifying information protected by this law is defined as the name or other identifying information of a natural person combined with:
- Social security number;
- Driver’s license or non-driver identification card number;
- Mother’s maiden name;
- Financial account number or code;
- Electronic serial number; or
- Personal identification number or code that can be used for identity theft.
Prior to disposal, unencrypted personal identifying information contained in print or electronic media is required to be shredded, destroyed, or modified so that it is unreadable. Alternatively, a business may use other methods consistent with commonly accepted industry standards that it reasonably believes will ensure that no unauthorized person will have access to the information.
The law provides for injunctive relief and/or a civil penalty of not more than $5,000. A showing of due diligence in an attempt to properly dispose of records shall be an affirmative defense. The New York Attorney General has the authority to enforce this law.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.