Under the Act, any person in possession of personal information of another person must safeguard the data, computer files and documents containing the information from misuse by third parties and destroy, erase or make unreadable the data, computer files and documents prior to disposal. The Act defines “personal information” as information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver’s license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number.
Although the Act does not provide a private right of action, anyone who intentionally violates the Act is subject to a civil penalty of $500.00 for each violation.