{"id":306,"date":"2016-05-25T12:27:33","date_gmt":"2016-05-25T16:27:33","guid":{"rendered":"https:\/\/sites.bu.edu\/dome\/?p=306"},"modified":"2016-05-25T14:19:07","modified_gmt":"2016-05-25T18:19:07","slug":"privacy-in-the-tech-age-delaware-law-protects-personal-identifying-information","status":"publish","type":"post","link":"https:\/\/sites.bu.edu\/dome\/2016\/05\/25\/privacy-in-the-tech-age-delaware-law-protects-personal-identifying-information\/","title":{"rendered":"Privacy in the Tech Age: Delaware Law Protects Personal Identifying Information"},"content":{"rendered":"<p>On Jan 1, 2015, Delaware\u2019s \u201cSafe Destruction of Records Containing Personal Identifying Information\u201d law (\u201c<a href=\"http:\/\/delcode.delaware.gov\/title19\/title19.pdf\"><span>\u00a7736<\/span><\/a>\u201d) went into effect. Under this law, a Delaware business that tries but fails to adequately destroy a record containing an employee\u2019s personally identifying information (\u201cPII\u201d) could face liability.\u00a0 Any employee who suffers actual harm due to such a failure can sue their employer for violating \u00a7736.<\/p>\n<p>While a seemingly straight-forward and pragmatic law, the details (or the definitions in this case) may prove particularly problematic for a vast majority of the nation\u2019s businesses.\u00a0 Specifically, \u00a7736 defines both \u201cPII\u201d and \u201crecord\u201c in extremely broad terms.<\/p>\n<figure id=\"attachment_312\" aria-describedby=\"caption-attachment-312\" style=\"width: 390px\" class=\"wp-caption alignright\"><a href=\"\/dome\/files\/2016\/05\/delaware-legislative-hall-582.jpg\"><img loading=\"lazy\" src=\"\/dome\/files\/2016\/05\/delaware-legislative-hall-582-477x636.jpg\" alt=\"Legislative Hall Dover, Delaware\" width=\"380\" height=\"507\" class=\" wp-image-312\" srcset=\"https:\/\/sites.bu.edu\/dome\/files\/2016\/05\/delaware-legislative-hall-582-477x636.jpg 477w, https:\/\/sites.bu.edu\/dome\/files\/2016\/05\/delaware-legislative-hall-582.jpg 582w\" sizes=\"(max-width: 380px) 100vw, 380px\" \/><\/a><figcaption id=\"caption-attachment-312\" class=\"wp-caption-text\">Legislative Hall<br \/>Dover, Delaware<\/figcaption><\/figure>\n<p>Any information that is <a href=\"http:\/\/delcode.delaware.gov\/title19\/title19.pdf\"><span>\u201cinscribed on a tangible medium, or that is stored in an electronic or other medium and is retrievable in perceivable form on which personal identifying information is recorded or preserved\u201d<\/span><\/a> qualifies as a record under this law. Practically speaking, that includes any document, note, email, or database that contains PII.<\/p>\n<p>Similarly, the law\u2019s <a href=\"http:\/\/delcode.delaware.gov\/title19\/title19.pdf\"><span>definition of PII<\/span><\/a> encompasses a vast array of information. Under \u00a7736, a record contains PII if it includes an employee\u2019s first name or first initial and last name in combination with one of the following:<\/p>\n<ul>\n<li>social security number<\/li>\n<li>passport number<\/li>\n<li>driver\u2019s license or state identification card number<\/li>\n<li>insurance policy number<\/li>\n<li>financial services account number<\/li>\n<li>bank account number<\/li>\n<li>credit card number<\/li>\n<li>debit card number<\/li>\n<li>tax or payroll information<\/li>\n<li>confidential health care information.<\/li>\n<\/ul>\n<p>These highly inclusive definitions create a law with broad protections for employees and their personal data. A company faces liability in the event that records containing an employee\u2019s PII were not properly destroyed, those records were improperly accessed, and the employee suffered real harm as a result.<\/p>\n<p><strong>Records Containing PII<\/strong><\/p>\n<p><strong>\u00a0<\/strong>Based on \u00a7736\u2019s definitions of \u201cPII\u201d and \u201crecord\u201d many different sources of information could result in liability under this law. Some of these sources are obvious.\u00a0 Such as the physical piece of paper that an employee fills out to sign up for direct deposit or a database containing a company\u2019s payroll information.<\/p>\n<p>But there are less obvious sources of PII that could also result in liability. For example, consider a company that typically combines an employee\u2019s first initial and last name to create that employee\u2019s login credentials and email account.\u00a0 That employee is travelling for business and emails their passport number to a travel coordinator.\u00a0 Under \u00a7736, that email could trigger liability.<\/p>\n<p>These more obscure one-off emails may prove difficult if not impossible to identify and consequently protect. As such, identifying the records that require proper destruction could present a challenge. In order to truly guard against a \u00a7736 violation, a company may need to ensure that all records, even records free of PII, are destroyed appropriately.<\/p>\n<p style=\"text-align: left;\"><strong><a href=\"\/dome\/files\/2016\/05\/shredding.jpeg\"><img loading=\"lazy\" src=\"\/dome\/files\/2016\/05\/shredding.jpeg\" alt=\"shredding\" width=\"402\" height=\"125\" class=\" size-full wp-image-311 aligncenter\" \/><\/a><\/strong><\/p>\n<p style=\"text-align: left;\"><strong>Properly Destroyed Records.<\/strong><\/p>\n<p><strong>\u00a0<\/strong>The law specifies that a company must take <a href=\"http:\/\/delcode.delaware.gov\/title19\/title19.pdf\"><span>\u201call reasonable steps to destroy or arrange for the destruction of each such record by shredding, erasing, or otherwise destroying or modifying the personal identifying information in those records to make it unreadable or indecipherable.\u201d<\/span><\/a> While most companies implement document destruction policies for sensitive documents, this law requires additional steps for the destruction of digital records.\u00a0 Ensuring that digital data is erased is easier said than done. Even data deleted from a hard drive is typically recoverable. Digital forensics <a href=\"http:\/\/www.digitalforensics-experts.com\/\"><span>experts<\/span><\/a> and simple <a href=\"http:\/\/www.easeus.com\/datarecoverywizardpro\/\"><span>data recovery software programs<\/span><\/a> tout the ability to quickly recover previously deleted data. In order to completely destroy data from a hard drive, experts <a href=\"http:\/\/pcsupport.about.com\/od\/toolsofthetrade\/tp\/erase-hard-drive.htm\"><span>recommend<\/span><\/a> deleting the information, re-writing over the information, and physically destroying the drive. This process is just not practical every time someone deletes an email. As such, the requirement that the company takes \u201call reasonable\u201d steps may prove difficult to comply with.<\/p>\n<p><strong>Improperly Accessed Data<\/strong><\/p>\n<p><strong>\u00a0<\/strong>In order for a company to face liability, the PII must be improperly accessed. Unfortunately, corporate security and data privacy breaches have become increasingly <a href=\"http:\/\/www.usatoday.com\/story\/tech\/2014\/09\/24\/data-breach-companies-60\/16106197\/\"><span>common<\/span><\/a>. While breaches involving customer data typically receive more <a href=\"http:\/\/www.forbes.com\/sites\/paularosenblum\/2014\/01\/17\/the-target-data-breach-is-becoming-a-nightmare\/\"><span>media coverage<\/span><\/a>, the nefarious actors stealing data do not always differentiate between <a href=\"http:\/\/www.nytimes.com\/2015\/06\/05\/us\/breach-in-a-federal-computer-system-exposes-personnel-data.html\"><span>employee and customer PII<\/span><\/a>. The increasing frequency of these breaches indicates that companies should be ready for a breach. Companies should take all necessary steps to ensure data security and avoid a breach but should also be prepared to respond to one. In the context of \u00a7736, being prepared means ensuring that record deletion and destruction policies are adequate under the law.<\/p>\n<p><strong>Employee<\/strong><strong>\u2019s Harm<\/strong><\/p>\n<p><strong>\u00a0<\/strong>Any improperly accessed PII has the potential to result in a stolen identity, which can then lead to a number of horrible outcomes. Victims of identity theft have experienced <a href=\"https:\/\/bestidtheftcompanys.com\/2013\/how-much-does-it-cost-to-be-an-identity-theft-victim#!\"><span>severe financial consequences<\/span><\/a>, <a href=\"http:\/\/ojp.gov\/programs\/identitytheft.htm\"><span>mistaken jail time<\/span><\/a>, and <a href=\"http:\/\/www.idtheftcenter.org\/Medical-ID-Theft\/prescription-fraud-and-identity-theft.html\"><span>even life-threatening medical consequences<\/span><\/a>. Identity theft results in real and substantive <a href=\"https:\/\/www.javelinstrategy.com\/news\/1556\/92\/16-Billion-Stolen-from-12-7-Million-Identity-Fraud-Victims-in-2014-According-to-Javelin-Strategy-Research\/d,pressRoomDetail\"><span>harms<\/span><\/a>. That harm compounds as the number of people whose data was stolen increases. For companies with thousands of employees, a single data breach could result in significant liability.<\/p>\n<p><strong>Business that Must Comply with \u00a7736<\/strong><\/p>\n<p>Delaware\u2019s \u201cSafe Destruction of Records Containing Personal Identifying Information\u201d law also has broad impact due to its expansive reach. Since Delaware is a <a href=\"http:\/\/corp.delaware.gov\/\"><span>preferred location<\/span><\/a> to incorporate or organize a business, this law could have affected a significant number of US companies.\u00a0 In response to this fear, the Legislature passed <a href=\"http:\/\/delcode.delaware.gov\/sessionlaws\/ga148\/chp021.shtml#TopOfPage\"><span>an amendment<\/span><\/a> to the law in May 2015 to limit the law\u2019s reach to only commercial entities that \u201ctransact business\u201d in Delaware.<\/p>\n<p>In order to avoid liability under \u00a7736, Delaware companies may need to update existing data deletion and security processes. Because of the complexity in identifying all records that contain PII, the increasing probability of a breach, and difficulty in completely deleting digital data, however, the best way to avoid liability under \u00a7736 may be to ensure the encryption of all digital records that could possibly contain PII. Under \u00a7736, if all of the data that comprises the PII is <a href=\"http:\/\/delcode.delaware.gov\/title19\/title19.pdf\"><span>encrypted then a company avoids liability<\/span><\/a> should a breach occur. If either the name or the additional information is unencrypted, however, the company may face liability under \u00a7736. As such, this solution may not cover the email containing a passport number sent from an email address comprised of the employees name, but will capture many other obscure records that may contain PII.<\/p>\n<p>Delaware\u2019s \u201cSafe Destruction of Records Containing Personal Identifying Information\u201d law provides pragmatic privacy protections for employees, but may create significant challenges for Delaware companies. While large corporations may be able to both implement appropriate measures to avoid liability under \u00a7736 and absorb the cost of any resulting liability should the measures fail, smaller companies may not be able to do either.<\/p>\n<p>As is true in many aspects of corporate law, Delaware may be leading the way in how companies will deal with data and privacy in the future.\u00a0 Other state, therefore, may look to this law as a model to amend their data laws.<\/p>\n<p><span><strong><a href=\"\/dome\/files\/2016\/02\/DebbieHinck1_2014-e1454614835697.jpg\"><img loading=\"lazy\" src=\"\/dome\/files\/2016\/02\/DebbieHinck1_2014-e1454614835697-425x636.jpg\" alt=\"Debbie Hinck 1 2014\" width=\"105\" height=\"158\" class=\"  wp-image-284 alignleft\" srcset=\"https:\/\/sites.bu.edu\/dome\/files\/2016\/02\/DebbieHinck1_2014-e1454614835697-425x636.jpg 425w, https:\/\/sites.bu.edu\/dome\/files\/2016\/02\/DebbieHinck1_2014-e1454614835697-685x1024.jpg 685w, https:\/\/sites.bu.edu\/dome\/files\/2016\/02\/DebbieHinck1_2014-e1454614835697.jpg 1136w\" sizes=\"(max-width: 105px) 100vw, 105px\" \/><\/a>Deborah J. Hinck<\/strong> is a Colorado native who has recently adopted Boston, Massachusetts as home. She received her B.S. with a double major in Electrical Computer Engineering and Applied Mathematics from the University of Colorado and her M.A. in Communications from the University of Washington. Deborah is expected to graduate from Boston University with a\u00a0<\/span><em>Juris Doctor<\/em><span> in Spring 2017. She is interested in technology law and policy, including intellectual property, digital privacy, and digital security. Deborah hopes to contribute in these areas in the future.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On Jan 1, 2015, Delaware\u2019s \u201cSafe Destruction of Records Containing Personal Identifying Information\u201d law (\u201c\u00a7736\u201d) went into effect. Under this law, a Delaware business that tries but fails to adequately destroy a record containing an employee\u2019s personally identifying information (\u201cPII\u201d) could face liability.\u00a0 Any employee who suffers actual harm due to such a failure can [&hellip;]<\/p>\n","protected":false},"author":11524,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[10,11,5],"tags":[],"_links":{"self":[{"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/posts\/306"}],"collection":[{"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/users\/11524"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/comments?post=306"}],"version-history":[{"count":4,"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/posts\/306\/revisions"}],"predecessor-version":[{"id":313,"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/posts\/306\/revisions\/313"}],"wp:attachment":[{"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/media?parent=306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/categories?post=306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sites.bu.edu\/dome\/wp-json\/wp\/v2\/tags?post=306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}