When a unit is destroying records of an individual that contain personal information of the individual, the unit shall take reasonable steps to protect against unauthorized access to or use of the personal information, taking into account:
(1) the sensitivity of the records;
(2) the nature of the unit and its operations;
(3) the costs and benefits of different destruction methods; and
(4) available technology.