On September 5, 2008, New York Governor David A. Paterson signed into law Bill No. A10625, which amends New York’s General Business Law. Effective immediately, the amendment clarifies who must abide by New York’s Disposal of Personal Records Law, which relates to the disposal of records containing personal identifying information.
Personal identifying information consists of personal information, such as a name, number, personal mark, or other identifier, that can be used to identify a natural person, coupled with one or more data elements. Data elements range in type and are enumerated in the statute.
New York’s Disposal of Personal Records Law requires entities that gather personal information from any source to take appropriate measures when disposing of the information. Previously, the law required a business, firm, partnership, association, corporation, or businessperson to dispose of records containing personal identifying information after (1) shredding the record, (2) destroying the personal identifying information contained in the record, (3) modifying the record to make the personal identifying information unreadable, or (4) taking reasonable actions consistent with commonly accepted industry practice. By removing the term “businessperson” and adding “not-for-profit corporations and nonprofit organizations,” the amended law now asserts that all corporations and associations are equally responsible for protecting consumer identity.
With identity theft on the rise and state and federal governments enforcing stricter legislation, employers subject to New York’s Disposal of Personal Records Law should review the new records disposal guideline and ensure compliance.
We will provide more detailed coverage of the new amendment in the next issue of New York Employment Law Letter.