New York - Disposal of Records Containing PII


  • Code chapter 20, section 399-H
  • law states that no person or business may dispose of a record containing “personal identifying information” without shredding, destroying, or modifying it so that the information is no longer readable
  • records are any information held in any physical form, either paper or electronic
    • Any type of data storage medium is a record
  • Personal identifying information is information in a record that identifies a person by name and includes any of the following:
    • SSN
    • Driver’s license number or identification card number
    • Mother’s maiden name, financial account numbers or code, or any other identification number
  • law allows for penalties of up to $5,000 for improper disposal
  • attorney general alone has the authority to pursue violations of the law
  • no private cause of action