Law / United States / 
Montana
Impediment of Identity Theft, record destruction duty
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security, Retention
As of .
What it requires
- This binds any business holding a customer's records containing personal information within its custody or control, a business being any sole proprietorship, partnership, corporation, association, or other group, whether or not organized to operate at a profit, including an entity that destroys records, but not an industry regulated under Title 33 of the Montana Code.
- Take all reasonable steps to destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer necessary to be retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- CIS Controls
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Private right of actionYes
Penalty structure
A civil fine of not more than $10,000 for each willful violation of a practice declared unlawful by 30-14-103, recoverable on behalf of the state in an action under 30-14-111; a violation of this duty is a violation of 30-14-103, with penalties as provided in 30-14-142. A willful violation is one the violator knew or should have known violated 30-14-103. A separate fine of not more than $10,000 applies to each violation of an injunction or restraining order. The statute names no aggregate cap.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Montana Department of Justice: a violation of the record-destruction duty is a violation of 30-14-103, and the department may bring an action in the name of the state to restrain the unlawful act and recover the civil fines set by 30-14-142.
What this law does
A business must take all reasonable steps to destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information that is no longer necessary to be retained by the business, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.
Business includes a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, and an entity that destroys records, but does not include industries regulated under Title 33 of the Montana Code. A violation of the duty is a violation of the Consumer Protection Act's unlawful-practices section, 30-14-103, and the penalties are as provided in 30-14-142.
In an action under 30-14-111, if the court finds a willful violation, the state may recover a civil fine of not more than $10,000 for each violation. A consumer who suffers an ascertainable loss of money or property from a practice declared unlawful by 30-14-103 may bring an individual action, but not a class action, to recover the greater of that loss or $500.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.