First Regular Session S.B. 1114
COMMITTEE ON JUDICIARY
SENATE AMENDMENTS TO S.B. 1114
(Reference to printed bill)
Strike everything after the enacting clause and insert:
"Section 1. Title 44, chapter 9, article 17, Arizona Revised Statutes, is amended by adding section 44-1373.03, to read:
44-1373.03. Destruction of information; liability; exception; definitions
A. At the time an entity disposes of records that it will no longer retain, the entity shall take all reasonable steps to destroy or arrange for the destruction of personal financial and health information and personal identification numbers that are issued by government entities in an individual's records and that are within the entity's custody or control.
B. If an entity discovers that the security of personal identifying information has been breached through theft or otherwise improperly obtained, the entity shall do the following, within the most expedient time possible and without unreasonable delay, for any person whose personal identifying information was affected by the breach:
1. Transmit notification about the breach.
2. Provide information on what can be done to protect against the unauthorized use of personal identifying information.
C. An entity is not liable under this section for records that it has relinquished to the custody and control of the individual to whom the records pertain.
D. This section does not apply to the disposal of records by a transfer of the records to another entity if the transfer is not otherwise prohibited by law, including a transfer to archive or otherwise preserve public records as required by law.
E. An individual who has reason to believe that he may be injured by an act or failure to act that does not comply with subsection a may apply to a court of competent jurisdiction to enjoin the act or failure to act. The court may grant an injunction with terms and conditions as the court deems equitable.
F. The attorney general may bring a civil action in the name of this state for damages or injunctive relief, or both, against an entity that fails to comply with subsection a.
G. The rights and remedies that are provided under this section are in addition to any other rights or remedies that are provided by law.
H. For the purposes of this section, any bank, financial institution, health care organization or other entity that is subject to federal regulations under the interagency guidelines establishing standards for safeguarding customer information, the guidelines for safeguarding member information or the standards for privacy of individually identifiable health information and that is in compliance with these federal guidelines is deemed to be in compliance with this section.
I. For the purposes of this section:
1. "Destroy" means shredding, erasing or otherwise modifying personal information in records in order to make the personal information unreadable or undecipherable through any reasonable means.
2. "Entity" includes a sole proprietor, partnership, corporation, limited liability company, trust, association, financial institution, governmental entity, other than the federal government, and any other individual or group that is engaged in a trade, occupation, enterprise, governmental function or similar activity in this state, however organized and whether or not organized to operate at a profit.
3. "Individual" means a natural person, except that if the individual is under a legal disability, individual includes a parent or legal guardian.
4. "Personal identifying information" has the same meaning prescribed in section 13-2001.
5. "Record" includes any material, regardless of the physical form, on which information is recorded or preserved by any means, including in written or spoken words, graphically depicted or electromagnetically transmitted. Record does not include publicly available directories that contain information an individual has voluntarily consented to have publicly disseminated or listed, including an individual's name, address or telephone number."
Amend title to conform
|
|