Privacy Law Library

Document Safe Destruction Act

VT Document Destruction Act

Data security

Requires businesses to destroy customer records containing personal information, such as SSNs, ID numbers and financial account numbers, when they no longer keep them, by shredding, erasing or otherwise making the data unreadable. Disposal companies must adopt and monitor policies that protect the information during collection, transport and disposal.

Where

Vermont

Citation

9 V.S.A. § 2445

Status

In force

In force since

2007-01-01

Enforced by

Vermont Attorney General and State's Attorneys; Department of Financial Regulation for its licensees

People can sue

No

Penalties

Enforced with Consumer Protection Act remedies (civil penalties up to $10,000 per violation under 9 V.S.A. § 2458) or DFR's Title 8 powers.

Applies to

• Businesses (not the State or political subdivisions) with custody of customer records containing personal information
• Businesses that dispose of personal financial information and do business in Vermont or dispose of Vermont residents' information
• Exempts GLBA-regulated financial institutions, HIPAA-compliant health insurers and facilities, and FCRA-compliant consumer reporting agencies