Processes personal data, in North Carolina

N.C. Gen. Stat. section 75-64 (Chapter 75, Article 2A, added by S.L. 2005-414, s. 1) · Read the law's page

• This binds any business that conducts business in North Carolina, or that maintains or otherwise possesses personal information of a North Carolina resident, when the business or a records-destruction vendor it uses disposes of records containing that information; a bank or financial institution already complying with the Gramm-Leach-Bliley Act's privacy and security provisions, a HIPAA-compliant health insurer or health care facility, and a consumer reporting agency already complying with the Fair Credit Reporting Act are each excepted.
• Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal: burn, pulverize, or shred paper records, and destroy or erase electronic and other nonpaper media, so the information cannot practicably be read or reconstructed, under written policies that describe the destruction procedure and are monitored for compliance.
• Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.
• A person injured by a violation may bring a civil action under G.S. 75-16 for treble the damages found; treble damages for a nonmanagerial employee's own acts or omissions apply only if the business was negligent in training, supervising, or monitoring that employee, and the Attorney General may also sue to enjoin a violation as an unfair or deceptive trade practice under G.S. 75-1.1.

N.C. Gen. Stat. 114A-10(7) · Read the law's page

• Obtain the prior written consent of a child's parent before you create, share, or store a biometric scan of a child under 18, unless the information is stored within the United States and the scan is authorized by a court order, is otherwise required by law, occurs in a place open to the public in which there is no expectation of privacy, or is used solely for security or surveillance of buildings, grounds, or school transportation (G.S. 114A-10(7)).

N.C. Gen. Stat. Secs. 75-61, 75-65 · Read the law's page

• Notify each affected North Carolina resident of a security breach involving their personal information without unreasonable delay, consistent with the legitimate needs of law enforcement.
• Notify the Consumer Protection Division of the North Carolina Attorney General's Office of every breach requiring notice to any affected person, not only breaches above the 1,000-person threshold.
• If you are an agency of the State or its political subdivisions, or an agent or employee of a government agency, that experiences a security breach as defined in the Identity Theft Protection Act, comply with the breach-notice requirements of G.S. 75-65 (G.S. 132-1.10(c1)).for a public body
• Do not assume an identifier extracted from a public recording is exempt as biometric data. North Carolina law never defines the term, so neither an exclusion nor a carve-out for such data can be relied upon.
• Expect a breach-notice violation to expose you to a private civil action for treble damages once an injured North Carolina resident can show injury from the violation.