Tracks devices, in Arizona

A.R.S. sec. 44-7601 · Read the law's page

• This binds any 'entity': a corporation, foreign corporation, unincorporated association, sole proprietorship, partnership, trust, estate, joint venture, limited liability company, or a government, governmental subdivision or agency, that discards or disposes of a paper record or document containing an individual's first and last name, or first initial and last name, combined with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number.
• Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.
• An entity subject to the Gramm-Leach-Bliley Act, a HIPAA covered entity or business associate, or an entity subject to the federal Fair Credit Reporting Act is exempt. An entity that maintains and complies with its own disposal procedures, consistent with this duty, is deemed compliant.
• A county attorney or the Attorney General may enforce this section, and a civil penalty applies per violation arising out of one incident: up to $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The statute states no private right of action of its own.