House Amendment 8240
PAG LIN
1 1 Amend House File 2610 as follows:
1 2 #1. Page 4, by inserting after line 27 the
1 3 following:
1 4 <Sec. . NEW SECTION. 22.15 PROTECTION OF
1 5 PERSONAL INFORMATION == DESTRUCTION OF PUBLIC RECORDS
1 6 == PENALTY.
1 7 1. "Personal information" means an individual's
1 8 first name or first initial and last name in
1 9 combination with any one or more of the following data
1 10 elements that relate to the individual if neither the
1 11 name nor the data elements are encrypted, redacted, or
1 12 otherwise altered by any method or technology in such
1 13 a manner that the name or data elements are
1 14 unreadable:
1 15 a. Social security number.
1 16 b. Driver's license number or other unique
1 17 identification number created or collected by a
1 18 government body.
1 19 c. Financial account number, credit card number,
1 20 or debit card number in combination with any required
1 21 security code, access code, or password that would
1 22 permit access to an individual's financial account.
1 23 d. Unique electronic identifier or routing code,
1 24 in combination with any required security code, access
1 25 code, or password.
1 26 e. Unique biometric data, such as a fingerprint,
1 27 voice print or recording, retina or iris image, or
1 28 other unique physical representation or digital
1 29 representation of the biometric data.
1 30 2. Unless otherwise required by federal or state
1 31 law, each government body shall take reasonable steps
1 32 to destroy or arrange for the destruction of a public
1 33 record, or portion thereof, containing personal
1 34 information within its control, which is no longer
1 35 required to be retained by the government body.
1 36 Destruction of a public record, or portion thereof,
1 37 shall be in accordance with the following minimum
1 38 standards:
1 39 a. Paper documents containing personal information
1 40 shall be either redacted, burned, pulverized, or
1 41 shredded so that personal information cannot
1 42 practicably be read or reconstructed.
1 43 b. Electronic media and other nonpaper media
1 44 containing personal information shall be destroyed or
1 45 erased so that personal information cannot practicably
1 46 be read, reconstructed, or deciphered through any
1 47 means.
1 48 3. A government body may contract with a third
1 49 party to destroy public records containing personal
1 50 information in accordance with the requirements of
2 1 this section. Any third party hired to destroy public
2 2 records containing personal information shall
2 3 implement and monitor compliance with policies and
2 4 procedures that prohibit unauthorized access to or
2 5 acquisition of or use of personal information during
2 6 the collection, transportation, and destruction of
2 7 personal information.
2 8 4. A government body or third party that violates
2 9 the provisions of this section shall be subject to a
2 10 civil penalty of not more than one hundred dollars per
2 11 public record affected, provided such penalty shall
2 12 not exceed fifty thousand dollars for each instance of
2 13 improper destruction. The office of attorney general
2 14 or a county attorney may enforce the provisions of
2 15 this section.>
2 16 #2. Page 6, by inserting after line 7 the
2 17 following:
2 18 <Sec. . IMPLEMENTATION OF ACT. Section 25B.2,
2 19 subsection 3, shall not apply to the section of this
2 20 Act enacting section 22.15.>
2 21 #3. Title page, line 1, by inserting after the
2 22 word <to> the following: <identity determination and
2 23 protection and>.
2 24 #4. Title page, line 3, by inserting after the
2 25 word <individuals,> the following: <and requiring the
2 26 destruction of certain public records containing
2 27 personal information,>.
2 28 #5. By renumbering as necessary.
2 29
2 30
2 31
2 32 PETTENGILL of Benton
2 33
2 34 HF 2610.201 82
2 35 ak/rj/11216
-1-