Law / United States / 
North Carolina
Identity Theft Protection Act, destruction of personal information records
N.C. Gen. Stat. section 75-64 (Chapter 75, Article 2A, added by S.L. 2005-414, s. 1)
In force since .
A security baseline statutes rule binding private bodies.
What it requires
- This binds any business that conducts business in North Carolina, or that maintains or otherwise possesses personal information of a North Carolina resident, when the business or a records-destruction vendor it uses disposes of records containing that information; a bank or financial institution already complying with the Gramm-Leach-Bliley Act's privacy and security provisions, a Health Insurance Portability and Accountability Act (HIPAA)-compliant health insurer or health care facility, and a consumer reporting agency already complying with the Fair Credit Reporting Act are each excepted.
- Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal: burn, pulverize, or shred paper records, and destroy or erase electronic and other nonpaper media, so the information cannot practicably be read or reconstructed, under written policies that describe the destruction procedure and are monitored for compliance.NIST CSF 2.0ID.AM-08
- Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.NIST CSF 2.0GV.SC-06NIST CSF 2.0GV.SC-07
- A person injured by a violation may bring a civil action under G.S. 75-16 for treble the damages found; treble damages for a nonmanagerial employee's own acts or omissions apply only if the business was negligent in training, supervising, or monitoring that employee, and the Attorney General may also sue to enjoin a violation as an unfair or deceptive trade practice under G.S. 75-1.1.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- ID.DE-P5Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- GV.SC-06Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
- GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- CIS Controls
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
G.S. 75-64(f) makes a violation of the section a violation of G.S. 75-1.1. In a suit by the Attorney General in which the defendant is found to have violated G.S. 75-1.1 and the acts were, when committed, knowingly violative of a statute, G.S. 75-15.2 lets the court impose a civil penalty of up to $5,000 for each violation. The same ceiling applies where the practice was specifically prohibited by a court order. The statute names no aggregate cap.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
No dedicated regulator. A violation is a deemed violation of the state's general unfair-or-deceptive-trade-practices statute, G.S. 75-1.1, enforceable by a person injured under G.S. 75-16 for treble damages, or by the North Carolina Attorney General, who may sue to enjoin the violation and, under G.S. 75-15.1, obtain restoration of property or cancellation of a contract obtained through it.
Settledness
- As of
- Open questions
- Does the requirement in G.S. 75-64(b) that the reasonable measures 'must include' policies on 'burning, pulverizing, or shredding' papers reach a business that holds no paper records containing personal information?
- Does 'unless such individual is injured as a result of the violation' in G.S. 75-64(f) let an individual sue under G.S. 75-16 where improperly disposed information has been exposed but no out-of-pocket loss has occurred?
What it reaches
Obligation class
Security, Retention
Applicability criteria
Subsection (e) excepts a bank or financial institution subject to and in compliance with the Gramm Leach Bliley Act privacy and security provision, a health insurer or health care facility subject to and in compliance with the HIPAA privacy and security standards, and a consumer reporting agency subject to and in compliance with the Federal Credit Reporting Act. G.S. 75-61(1) excludes any government or governmental subdivision or agency from "business".
- As of
- Combinator
- Any of
- Criteria
- Any business that conducts business in North Carolina
- any business that maintains or otherwise possesses personal information of a resident of North Carolina
What this law does
Any business that conducts business in North Carolina, or that maintains or otherwise possesses the personal information of a North Carolina resident, must take reasonable measures to protect against unauthorized access to or use of that information in connection with or after its disposal.
Required measures include burning, pulverizing, or shredding paper records so the information cannot practicably be read or reconstructed, and destroying or erasing electronic and other nonpaper media the same way. "Business" excludes any government or governmental subdivision or agency.
The duty also does not apply to a bank or financial institution already complying with the Gramm-Leach-Bliley Act, a Health Insurance Portability and Accountability Act (HIPAA)-compliant health insurer or health care facility, or a consumer reporting agency already complying with the Fair Credit Reporting Act. A violation is a deemed violation of G.S. 75-1.1, enforceable by a person injured under G.S. 75-16 for treble damages or by the Attorney General to enjoin the violation.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .