Law / United States / 
Wisconsin
Disposal of records containing personal information by financial institutions, medical businesses and tax preparation businesses
Disposal of records containing personal information, Wis. Stat. sec. 134.97
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a financial institution (a bank, savings bank, savings and loan association or credit union authorized to do business under state or federal law, any issuer of a credit card, or any investment company), a medical business (any organization, for profit or not, that possesses information other than personnel records about a person's physical or mental health, medical history or medical treatment), and a tax preparation business (a for-profit organization that for a fee prepares or counsels on an individual's tax returns); you declare this by stating that you provide financial services or handle health records.
- Do not dispose of a record containing personal information unless you, or a person under contract with you, shred the record, erase the personal information, modify the record to make the personal information unreadable, or take actions you reasonably believe will ensure that no unauthorized person has access to the personal information between the record's disposal and its destruction.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
A violator may be required to forfeit not more than $1,000, and acts arising out of the same incident or occurrence are a single violation.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 1,000
What this law does
A financial institution, medical business or tax preparation business may not dispose of a record containing personal information unless it shreds the record, erases the personal information, modifies the record to make the personal information unreadable, or takes actions it reasonably believes will ensure that no unauthorized person has access to the personal information between disposal and destruction.
A financial institution is any bank, savings bank, savings and loan association or credit union that is authorized to do business under state or federal laws relating to financial institutions, any issuer of a credit card or any investment company. A medical business is any organization or enterprise, for profit or not, that possesses information, other than personnel records, relating to a person's physical or mental health, medical history or medical treatment.
A tax preparation business is any for-profit organization that for a fee prepares an individual's federal, state or local tax returns or counsels an individual regarding those returns.
Personal information means personally identifiable data about an individual's medical condition that are not generally considered public knowledge, an individual's account or customer number, account balance, balance owing, credit balance or credit limit relating to an account or transaction with a financial institution, personally identifiable data provided to a financial institution on opening an account or applying for a loan or credit, or personally identifiable data about an individual's tax returns.
A sale of a record, or the transfer of a record for value, is not disposal. A violator may be required to forfeit not more than $1,000, and acts arising out of the same incident or occurrence are a single violation. A financial institution, medical business or tax preparation business is liable to a person whose personal information is disposed of in violation of the section for the amount of damages resulting from the violation.
When LexLint raises it
When your app profile says your app provides financial services or handles health records.