Law / United States / 
Indiana
Persons holding a customer's personal information, disposal of personal information
Ind. Code secs. 24-4-14-1 to 24-4-14-8
In force.
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds any person (an individual, partnership, corporation, limited liability company or other organization) that holds a customer's personal information, other than state government and its political subdivisions, a unit and the county offices the chapter lists, and a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act; a person in the business of waste collection is bound only as to personal information it holds directly in connection with that business.
- Do not dispose of a customer's unencrypted, unredacted personal information, which means discarding or abandoning it in an area accessible to the public, without shredding, incinerating, mutilating, erasing or otherwise rendering it illegible or unusable.
- Treat personal information as redacted only if it has been altered or truncated so that no more than the last four digits of a driver's license number, state identification number or account number, or no more than five digits of a Social Security number, are accessible.
These lines are LexLint's reading of the law's text, as of .
What this law does
A person who disposes of the unencrypted, unredacted personal information of a customer without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable commits a Class C infraction. The offense is a Class A infraction if the person disposes of the unencrypted, unredacted personal information of more than one hundred customers or has a prior unrelated judgment for a violation of the section.
To dispose of personal information means to discard or abandon the personal information of a customer in an area accessible to the public. A customer is a person who has received, or contracted for, the provision of goods or services from another person holding the person's personal information, or who provides personal information to another person in connection with a transaction with a nonprofit corporation or charitable organization.
A person is an individual, a partnership, a corporation, a limited liability company, or another organization. Personal information has the meaning set forth in IC 24-4.9-2-10 and includes information stored in a digital format. That definition covers a Social Security number that is not encrypted or redacted, and an individual's name together with a driver's license number, state identification card number or credit card number that is not encrypted or redacted.
Personal information is redacted if it has been altered or truncated so that not more than five digits of a Social Security number are accessible. The chapter does not apply to the executive, judicial, or legislative department of state government or any political subdivision.
It also does not apply to a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act, if applicable.
A person in the business of waste collection is outside the chapter except to the extent the person holds a customer's personal information directly in connection with the business of waste collection. No day on which the provisions this entry describes came into force has been located: the codified text carries only a public-law-and-year citation, P.L.125-2006, with no day.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.