ARIZONA STATE SENATE
Phoenix, Arizona
Purpose:
Requires businesses to destroy or remove personal information from business records prior to disposing of the records.
Background:
The Fraternal Order of Police reports that identity theft in the United States has increased 600 percent in the last ten years. Forty-two states, including Arizona, have laws relating specifically to identity theft. Currently, statute classifies the use of personal identifying information, such as name, address, telephone number or social security number, for any unlawful purpose without the consent of that person as taking the identity of another person, a class 4 felony (A.R.S. 13-2008).
H.B. 2351 addresses the issue of illegally obtaining personal identifying information by requiring businesses to destroy personal information contained in the businesses’ records prior to disposal. It also classifies knowingly possessing an individual’s personal information without the consent of the individual or the business that disposed of the records as a class 1 misdemeanor (up to 6 months in jail and up to $2,500 in fines with an additional 77 percent surcharge).
There is no anticipated impact to the state general fund associated with this bill.
Provisions:
1. Prohibits a business from disposing of records containing personal information unless the business makes a good faith effort to do any of the following prior to disposal:
a. shred or incinerate the records
b. erase personal information from the records
c. modify the records to make the personal information unreadable
d. enter into a contract with a third party to dispose of the records as long as the third party agrees to destroy the records prior to disposal and ensure that no unauthorized person will have access to personal information contained in the records.
2. Stipulates that, if a business makes a good faith effort to destroy personal information contained on business records, the business has an affirmative defense to any claim against the business arising out of the use of personal information contained in records disposed of by the business.
3. Classifies the act of knowingly possessing an individual’s personal information without the consent of the individual or the business that disposed of the records as a class 1 misdemeanor.
4. Holds any person who uses an individual’s personal information contained in records disposed of by a business liable to that individual and the business for damages resulting from the use of the personal information. Exempts the person from liability if either the individual whose personal information was used or the business that disposed of the records consented to the use of the personal information.
5. Exempts federal, state and local law enforcement agencies and their employees and agents from the provisions regarding the destruction of personal information and possessing business records after disposal by the business.
6. Exempts persons engaged in a newspaper, radio, television or other news gathering organization who receive records containing personal information for news gathering purposes from the provisions regarding the destruction of personal information and possessing business records after disposal by the business.
7. Defines terms.
8. Provides for a general effective date.
1. Stipulates that the return of records to the customer is not included in the definition of dispose.
2. Includes incineration as a method of destroying personal information.
3. Clarifies the requirements of a contracting third party for destroying personal information on business records.
4. Eliminates the penalties section.
5. Stipulates that, if a business makes a good faith effort to destroy personal information contained on business records, the business has an affirmative defense to any claim against the business arising out of the use of personal information contained in records disposed of by the business.
6. Makes conforming changes.
1. Incorporates the amendments adopted by the Judiciary Committee.
2. Exempts federal, state and local law enforcement agencies and their employees and agents from the provisions regarding the destruction of personal information and possessing business records after disposal by the business.
3. Exempts persons engaged in a newspaper, radio, television or other news gathering organization who receive records containing personal information for news gathering purposes from the provisions regarding the destruction of personal information and possessing business records after disposal by the business.
4. Makes technical and conforming changes.
House Action Senate Action
JUD 3/13/01 W/D JUD 3/27/01 DPA 5-2-1
CED 2/12/01 DP 6-0-0-4 COM 4/4/01 DPA 3-2-1
3rd Read 3/20/01 38-17-5
Prepared by Senate Staff
April 4, 2001