New York State Laws for Privacy & Shredding

The New York State Legislature has passed a series of laws protecting consumer privacy and personal information.

New York General Business Law – Disposal of Records Law

New York’s Disposal of Personal Records Law requires entities that gather personal information from any source to take appropriate measures when disposing of the information. The law applies to all corporations and associations and they are equally responsible for protecting consumer identity.

1. Shreds the record before the disposal of the record; or
2. Destroys the personal identifying information contained in the record; or
3. Modifies the record to make the personal identifying information unreadable; or
4. Takes actions consistent with commonly accepted industry practices that it reasonably believes will ensure that no unauthorized person will have access to the personal identifying information contained in the record.

New York Employee Personal Identifying Law

Beginning on January 3, 2009, the New York Labor Laws require employers to prevent unlawful disclosures of employee personal identifying information. The personal identifying information may not be posted, displayed, or otherwise communicated to the general public.

The definition of employee personal identifying information under New York law includes but is not limited to the following;

• Social Security Numbers
• Home address or telephone numbers
• Personal e-mail addresses
• Internet user IDs and passwords
• Driver’s license numbers
• Parents surname prior to marriage

Information Security Breach and Notification Act

Under this law, any business in New York that collects, stores or manages a person’s personal information (such as a Social Security number, credit card number or driver’s license) and finds that unauthorized access has been given to a client’s personal information must inform the client “without unreasonable delay.” In addition, the business must notify relevant government parties, including the state attorney general, the Consumer Protection Board and the State Office of Cyber Security.