Records calls, in North Carolina

N.C. Gen. Stat. section 75-64 (Chapter 75, Article 2A, added by S.L. 2005-414, s. 1) · Read the law's page

• This binds any business that conducts business in North Carolina, or that maintains or otherwise possesses personal information of a North Carolina resident, when the business or a records-destruction vendor it uses disposes of records containing that information; a bank or financial institution already complying with the Gramm-Leach-Bliley Act's privacy and security provisions, a HIPAA-compliant health insurer or health care facility, and a consumer reporting agency already complying with the Fair Credit Reporting Act are each excepted.
• Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal: burn, pulverize, or shred paper records, and destroy or erase electronic and other nonpaper media, so the information cannot practicably be read or reconstructed, under written policies that describe the destruction procedure and are monitored for compliance.
• Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.
• A person injured by a violation may bring a civil action under G.S. 75-16 for treble the damages found; treble damages for a nonmanagerial employee's own acts or omissions apply only if the business was negligent in training, supervising, or monitoring that employee, and the Attorney General may also sue to enjoin a violation as an unfair or deceptive trade practice under G.S. 75-1.1.