Law / United States / 
Massachusetts
Standards for disposal of records containing personal information
Mass. Gen. Laws ch. 93I, sec. 2
In force.
A security baseline statutes rule binding public and private bodies.
- Criminal exposure
- No
- Obligation class
- Security
As of .
What it requires
- This binds each agency or person that disposes of records containing personal information.
- Dispose of paper documents containing personal information by redacting, burning, pulverizing or shredding them so that personal data cannot practicably be read or reconstructed.
- Destroy or erase electronic media and other non-paper media containing personal information so that the personal information cannot practicably be read or reconstructed.
- If you are a third party hired to dispose of material containing personal information, implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during the collection, transportation and disposal of personal information.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Massachusetts Attorney General, who may file a civil action in the superior or district court in the name of the commonwealth to recover the civil fine.
What this law does
When disposing of records, each agency or person must meet the minimum standards for proper disposal of records containing personal information. Paper documents containing personal information must be redacted, burned, pulverized or shredded so that personal data cannot practicably be read or reconstructed. Electronic and other non-paper media containing personal information must be destroyed or erased so that personal information cannot practicably be read or reconstructed.
A third party hired to dispose of the material must implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during collection, transportation and disposal. A violator is subject to a civil fine of not more than $100 per data subject affected, not to exceed $50,000 for each instance of improper disposal. The attorney general may file a civil action to recover the penalties.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.