44-7601

44-7601. Discarding and disposing of records
containing personal identifying information; civil penalty;
enforcement; definition

A. An entity shall not knowingly discard or dispose of records or documents
without redacting the information or destroying the records or documents if the records
or documents contain an individual's first and last name or first initial and last name
in combination with a corresponding complete:

1. Social security number.

2. Credit card, charge card or debit card number.

3. Retirement account number.

4. Savings, checking or securities entitlement account number.

5. Driver license number or nonoperating identification license number.

B. This section may be enforced by either of the following:

1. A county attorney in the county in which the records or documents were
wrongfully discarded or disposed. If a violation occurs by the same entity in multiple
counties, a county attorney in a county in which records or documents were not properly
discarded or disposed of, after filing a notice of intent to enforce this section, may
send a copy of the notice to the county attorney in each county in which records or
documents were not properly discarded or disposed of and may request that the actions be
consolidated.

2. The attorney general.

C. A civil penalty shall be imposed for each violation of subsection A arising out
of one incident. The civil penalty shall not exceed:

1. Five hundred dollars for a first violation.

2. One thousand dollars for a second violation.

3. Five thousand dollars for a third or subsequent violation.

D. An entity that maintains and complies with the entity's own procedures for the
discarding or disposing of records or documents containing the information listed in
subsection A that is consistent with the requirements of this section shall be deemed to
be in compliance with this section.

E. This section does not apply to any of the following:

1. An entity subject to title V of the Gramm-Leach-Bliley act of 1999 (P.L.
106-102; 113 Stat. 1338; 15 United States Code sections 6801 through 6809).

2. Covered entities as defined under regulations implementing the health insurance
portability and accountability act, 45 Code of Federal Regulations section 160.103
(1996).

3. An entity subject to the federal fair credit reporting act, 15 United States
Code section 1681x.

F. This section only applies to paper records and paper documents.

G. For the purposes of this section, "entity" includes a corporation, foreign
corporation, not for profit corporation, profit and not for profit unincorporated
association, nonprofit corporation, sole proprietorship, close corporation, corporation
sole or limited liability company, a professional corporation, association or limited
liability company, a business trust, estate, partnership, registered limited liability
partnership, trust or joint venture, government, governmental subdivision or agency or
any other legal or commercial entity.