Data Disposal and Security: N.J.S.A. § 56:8-161 and 56:8-162.
The numbering and internal citations herein are derived from the applicable state statute. See statute for any applicable exceptions or exemptions.
Key Terms
The term “personal information” means an individual’s first name or first initial and last name linked with any one or more of the following data elements:
(1) Social Security number;
(2) Driver’s license number or State identification card number;
(3) Account, credit, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or
(4) Username, email address, or any other account holder identifying information, in combination with any password or security question and answer that would permit access to an online account.
Dissociated data that, if linked, would constitute personal information is personal information if the means to link the dissociated data were accessed in connection with access to the dissociated data.
Data Disposal
A business or public entity shall destroy, or arrange for the destruction of, a customer’s records within its custody or control containing personal information, which is no longer to be retained by the business or public entity, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable, undecipherable, or nonreconstructable through generally available means.