Personal Information Protection Act

This act governs how businesses and government agencies handle personal information about individuals, covering data-security breaches, security freezes on credit information, the use of Social Security numbers, and the disposal of records containing personal data. It requires notice to affected individuals — and in certain cases to other agencies — after a breach of security, lets a person place, confirm, and remove a freeze restricting access to their credit information, and limits when Social Security numbers may be requested, collected, disclosed, sold, or otherwise transferred, subject to exceptions for employees, agents, and specified employment purposes. Entities holding personal records must adopt protective policies and procedures and exercise due diligence in destroying those records, with noncompliance enforceable through civil penalties and court action.

Editorial summary generated from the text of this act. It is not part of the statute — read the sections below for the operative language.