Law / United States / 
Arizona
Discarding and disposing of records containing personal identifying information
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds any 'entity': a corporation, foreign corporation, unincorporated association, sole proprietorship, partnership, trust, estate, joint venture, limited liability company, or a government, governmental subdivision or agency, that discards or disposes of a paper record or document containing an individual's first and last name, or first initial and last name, combined with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number.
- Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.
- An entity subject to the Gramm-Leach-Bliley Act, a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate, or an entity subject to the federal Fair Credit Reporting Act is exempt. An entity that maintains and complies with its own disposal procedures, consistent with this duty, is deemed compliant.
- A county attorney or the Attorney General may enforce this section, and a civil penalty applies per violation arising out of one incident: up to $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The statute states no private right of action of its own.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The civil penalty under subsection (C) is tiered by violation count within one incident: not more than $500 for a first violation, $1,000 for a second violation, and $5,000 for a third or subsequent violation. The $5,000 figure recorded here is the ceiling for a third or subsequent violation, not a flat per-violation amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
A county attorney in the county in which the records or documents were wrongfully discarded or disposed, or the Attorney General, under A.R.S. sec. 44-7601(B). Where the same entity violates the section in multiple counties, a county attorney may file a notice of intent to enforce and request that the actions be consolidated.
What this law does
An 'entity' may not knowingly discard or dispose of a paper record or document that combines an individual's first and last name, or first initial and last name, with a Social Security number, a credit, charge or debit card number, a retirement account number, a savings, checking or securities entitlement account number, or a driver license or nonoperating identification license number, without first redacting that information or destroying the record or document.
'Entity' is defined broadly to include a corporation, unincorporated association, sole proprietorship, partnership, trust, or a government, governmental subdivision or agency. The duty applies to paper records and documents only. It does not reach an entity already regulated under the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act (HIPAA), or the federal Fair Credit Reporting Act. An entity that maintains and follows its own consistent disposal procedures is deemed compliant.
A county attorney or the Attorney General may enforce the section, and a civil penalty applies per violation arising out of one incident, rising from up to $500 for a first violation to up to $5,000 for a third or subsequent violation.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .