Law / United States / 
Alaska
Alaska Personal Information Protection Act, disposal of records duty
Alaska Stat. Secs. 45.48.500-45.48.590
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds any business or governmental agency that disposes of records containing personal information on an Alaska resident; a business already complying with the Gramm-Leach-Bliley Act's disposal rule or the Fair Credit Reporting Act's disposal rule, 15 U.S.C. 1681w, is exempt, as is disposal that federal law requires to be done in a manner this duty does not permit.
- When disposing of records containing personal information, take all reasonable measures necessary to protect against unauthorized access to or use of the records, including burning, pulverizing, or shredding paper documents and destroying or erasing electronic and nonpaper media so the personal information cannot practicably be read or reconstructed.NIST CSF 2.0ID.AM-08
- Adopt written policies and procedures relating to the adequate destruction and proper disposal of records containing personal information.NIST CSF 2.0ID.AM-08
- Before contracting with a third party to destroy records, complete due diligence, such as reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.NIST CSF 2.0GV.SC-06
- A knowing violation draws a civil penalty of up to $3,000 payable to the state, and a person damaged by a violation may separately sue to enjoin further violations and recover actual economic damages, court costs, and full reasonable attorney fees.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civil penalty under AS 45.48.550(a), payable to the state, for a knowing violation of AS 45.48.500-45.48.590; the statute states no per-resident multiplier the way the Act's own breach-notification penalty at AS 45.48.080 does. A person damaged by a violation may separately bring a civil action under AS 45.48.560 to enjoin further violations and recover actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees, which carries no fixed cap of its own.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 3,000
Who enforces it
Enforcement body
AS 45.48.500-590 names no dedicated enforcement agency. A knowing violation is liable to the state for a civil penalty not to exceed $3,000 under AS 45.48.550, and an individual damaged by a violation may separately bring a civil action under AS 45.48.560.
Settledness
- As of
- Open questions
- Does 'all reasonable measures necessary' in AS 45.48.500(a) require more than the measures that AS 45.48.510 says 'may be taken' to comply with the disposal duty?
- When has a business or governmental agency 'otherwise complied' in selecting a third party engaged in the business of record destruction, so that AS 45.48.500(b) ends its liability for the disposal, beyond the due diligence steps that AS 45.48.520 says it 'ordinarily' includes?
What this law does
A business and a governmental agency that disposes of records containing personal information on an Alaska resident must take all reasonable measures necessary to protect against unauthorized access to or use of the records. The business or governmental agency must also adopt written policies and procedures relating to the adequate destruction and proper disposal of those records.
Permitted measures include burning, pulverizing, or shredding paper documents, and destroying or erasing electronic and nonpaper media, so that the personal information cannot practicably be read or reconstructed.
Where a business or governmental agency instead contracts with a third party engaged in the business of record destruction, it must first complete due diligence, ordinarily reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.
It is not liable for the disposal once it has relinquished control of the records to that third party or to the individual to whom the records pertain.
A business is exempt if it is subject to and complying with the Gramm-Leach-Bliley Financial Modernization Act, or if the manner of its disposal is subject to and complies with the Fair Credit Reporting Act's disposal rule, 15 U.S.C. 1681w. A business or governmental agency is also exempt to the extent federal law requires a manner of disposal the Alaska duty does not permit. A knowing violation is liable to the state for a civil penalty not to exceed $3,000.
Separately, an individual damaged by a violation may bring a civil action to enjoin further violations and recover actual economic damages, court costs, and full reasonable attorney fees. This duty is distinct from the Act's breach-notification duty, AS 45.48.010 to 45.48.070, which is this jurisdiction's privacy-topic row.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .