This went into effect earlier this year, but has apparently come up in a
couple of cases where there were fines levied related to a failure to comply
by companies in NY State who had information on MASS State residents.

Larry

http://www.mass.gov/legis/laws/mgl/93i-1.htm

http://www.mass.gov/legis/laws/mgl/93i-2.htm

Snip from http://www.kb-law.com/news/NewEnglandInHouse.htm

"Destroying personal information

Chapter 93I will require all organizations that dispose of records
containing personal information to destroy such records, whether paper or
electronic, “so that personal information cannot practicably be read or
reconstructed.” Paper records containing personal information should be
shredded or burned.

Electronic records containing personal information must be fully erased, a
process that generally requires rewriting over the space on the storage
media where the records formerly existed. Organizations may contract with
third parties such as data management companies to appropriately destroy
records, as long as the third party implements and monitors compliance with
the security provisions in Chapter 93H. Contracts with these third parties
should now include explicit data safeguard requirements. Organizations
should train employees about the new destruction requirements. Simply
tossing paper into the recycle bin or pressing the “delete” key will no
longer suffice.
Penalties for failing to comply

Any organization that violates Chapter 93I faces a civil fine of up to $100
per affected person, with a total possible fine of $50,000 for each instance
of improper disposal. Failure to comply with Chapter 93H or 93I may subject
the offender to a suit by the Attorney General under Chapter 93A, the
consumer protection law. Violations may mean triple damages, as well as
attorneys’ fees and legal costs. "

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]