Records calls, in Alabama

Ala. Code secs. 8-38-3, 8-38-10 · Read the law's page

• Implement and maintain reasonable security measures to protect sensitive personally identifying information against a breach of security. The measures required are those practicable for the entity, including consideration of: designating an employee or employees to coordinate the effort, identifying internal and external risks, adopting and assessing information safeguards, retaining service providers contractually required to maintain appropriate safeguards, evaluating and adjusting the measures for changed circumstances, and keeping management, including the board of directors where one exists, informed of the overall status of the measures. An assessment of the entity's security looks at its measures as a whole, emphasizing failures that are multiple or systemic, and weighs the entity's size, the amount and type of information and activities, and its cost of the measures relative to its resources.
• Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.
• This binds any covered entity (a person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association, or other business entity that acquires or uses sensitive personally identifying information of an Alabama resident) and any third-party agent it contracts with to maintain, store, process, or access that information. An entity already subject to and complying with a federal or state data-breach-notification regime at least as thorough as this chapter is exempt from the entire chapter.
• There is no private right of action for a violation of either duty. Only the Attorney General may bring an action for civil penalties under the chapter, and the chapter's only stated civil-penalty amounts (up to $500,000 per breach, or $5,000 per day) are tied expressly to a violation of the chapter's separate notification provisions, not to this reasonable-security-measures or disposal duty; no distinct penalty figure is stated for either duty. The Attorney General may also sue for actual damages on behalf of named individuals (Section 8-38-9(b)(2)), and may sue a state, county or municipal official or employee to compel performance of the official's duties under the chapter, while government entities themselves are exempt from civil penalties (Section 8-38-9(b)(6)).