Makes high-risk automated decisions, in Alaska

Alaska Stat. Secs. 45.48.500-45.48.590 · Read the law's page

• This binds a business (a person who conducts business in Alaska, or who conducts business and holds personal information on Alaska residents) and a state or local governmental agency other than a judicial-branch agency that disposes of records containing personal information; a business already complying with the Gramm-Leach-Bliley Act's disposal rule or the Fair Credit Reporting Act's disposal rule, 15 U.S.C. 1681w, is exempt, as is disposal that federal law requires to be done in a manner this duty does not permit.
• When disposing of records containing personal information, take all reasonable measures necessary to protect against unauthorized access to or use of the records, including burning, pulverizing, or shredding paper documents and destroying or erasing electronic and nonpaper media so the personal information cannot practicably be read or reconstructed.
• Adopt written policies and procedures relating to the adequate destruction and proper disposal of records containing personal information.
• Before contracting with a third party to destroy records, complete due diligence, such as reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.
• A knowing violation draws a civil penalty of up to $3,000 payable to the state, and a person damaged by a violation may separately sue to enjoin further violations and recover actual economic damages, court costs, and full reasonable attorney fees.