Affirmative Data Obligations | Beyond Breaches: An Overview of Statutes, Regulations, and Legislation Affecting Business Obligations and Consumer Rights with Respect to Data

Welcome to Womble Bond Dickinson’s 50 state survey of affirmative data use laws. The below interactive map summarizes laws and pending legislation that impose additional requirements on businesses that collect, store, transmit, or otherwise use personal data. Please note that we have excluded industry-specific laws from the scope of this survey, so it will not, for example, include laws strictly governing financial institutions or healthcare providers.

Hover over a state to see introduced legislation or proposed regulations.
Click on a state to see enacted statutes and adopted regulations.

Click here to subscribe to our State Data Use Law Blog. When the blog is updated, we’ll let you know.
If you have questions about laws affecting affirmative data obligations, please contact a member from our Data Privacy Team.

Restrictions on Capture & Use of Biometric Identifiers and Information Security

A private entity in possession of biometric identifiers or biometric information must develop a written policy that establishes a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, an entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.

No private entity may collect, purchase, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first: (i) informs the subject in writing that a biometric identifier or biometric information is being collected or stored; (ii) informs the subject in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (iii) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

No private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from a person's biometric identifier or biometric information.

A private entity cannot disclose, redisclose, or otherwise disseminate a person's biometric identifier or biometric information unless the subject of the identifier consents to the disclosure, such disclosure completes a financial transaction requested by the subject of the identifier or information, or such disclosure is required by law, ordinance, valid warrant or subpoena from a court of competent jurisdiction.

A private entity in possession of a biometric identifier or biometric information shall store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within the private entity's industry or the standard of care in which the private entity stores, transmits, and protects other confidential and sensitive information, whichever is more protective.

740 Ill. Comp. Stat. Ann. 14/15

Restrictions on Use of SSN

Illinois prohibits entities from (i) intentionally communicating or otherwise make available to the general public a social security number; (ii) printing a social security number on any card, wristband, or file required for the individual to access products or services, except an entity that provides an insurance card must print on the card an identification number unique to the holder of the card in the format prescribed by Section 15 of the Uniform Prescription Drug Information Card Act; (iii) requiring an individual to transmit his or her social security number over the Internet unless the connection is secure or the number is encrypted; (iv) requiring the use of a social security number to access an Internet web site, unless a password or other authentication device is also required to access the Internet Web site; or (v) printing a social security number on any materials that are mailed to the individual, unless State or federal law requires the social security number to be on the document to be mailed.

Illinois does allow for social security numbers to be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process or to establish, amend, or terminate an account, contract, or policy or to confirm the accuracy of the social security number. For these purposes, a social security number being mailed may not be visible on an envelope or visible without the envelope having been opened.

815 Ill. Comp. Stat. Ann. 505/2RR

Record Destruction

Illinois requires that an entity dispose of materials containing personal information in a manner that renders the personal information unreadable, unusable, and undecipherable. Such disposal methods include redacting, burning, or shredding paper so that personal information cannot practicably be read or reconstructed, or when digital, erasing the media containing the personal information such that the information cannot be practicably read or reconstructed.

Illinois allows entities to contract with a third party to dispose of personal information, so long as the third party that contracts with the entity to dispose of materials containing personal information implements and monitors compliance with policies and procedures that prohibit unauthorized access to, acquisition of, or use of personal information during the collection, transportation, and disposal of materials containing personal information.

815 Ill. Comp. Stat. Ann. 530/40

Information Security

An entity that owns or licenses, or maintains or stores but does not own or license, records that contain personal information concerning an Illinois resident has to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

Contracts for the disclosure of personal information concerning an Illinois resident that is maintained by entity must include a provision requiring the recipient party of the personal information to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.

815 Ill. Comp. Stat. Ann. 530/45

Record Destruction

Regarding the destruction of personal information, Massachusetts requires that entities must either redact, burn, pulverize or shred documents that contain personal data so they cannot practicably be read or reconstructed.

Electronic media and other non-paper media containing personal information shall be destroyed or erased so that personal information cannot practicably be read or reconstructed.

Mass. Gen. Laws Ann. ch. 93I, § 2

Information Security

Massachusetts requires that entities have a written and comprehensive information security program which indicates the establishment and maintenance of a security system covering its computers, including any wireless systems. The security program must at least include: (1) Secure user authentication protocols; (2) Secure access control measures; (3) Encryption of all transmitted records and files containing personal information; (4) Reasonable monitoring of systems for unauthorized use of or access to personal information; (5) Encryption of all personal information stored on laptops or other portable devices; (6) Up-to-date firewall protection and operating system security patches; (7) Reasonably up-to-date versions of system security agent software which must include malware protection; and (8) Education and training of employees on the proper use of the computer security system and the importance of personal information security.

Duty to Protect and Standards for Protecting Personal Information
(1) Every person that owns or licenses personal information about a resident of the Commonwealth shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to (a) the size, scope and type of business of the person obligated to safeguard the personal information under such comprehensive information security program; (b) the amount of resources available to such person; (c) the amount of stored data; and (d) the need for security and confidentiality of both consumer and employee information. The safeguards contained in such program must be consistent with the safeguards for protection of personal information and information of a similar character set forth in any state or federal regulations by which the person who owns or licenses such information may be regulated.

(2) Without limiting the generality of the foregoing, every comprehensive information security program shall include, but shall not be limited to:

(a) Designating one or more employees to maintain the comprehensive information security program;

(b) Identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper or other records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, including but not limited to:

1. ongoing employee (including temporary and contract employee) training;

2. employee compliance with policies and procedures; and

3. means for detecting and preventing security system failures.

(c) Developing security policies for employees relating to the storage, access and transportation of records containing personal information outside of business premises.

(d) Imposing disciplinary measures for violations of the comprehensive information security program rules.

(e) Preventing terminated employees from accessing records containing personal information.

(f) Oversee service providers, by:

1. Taking reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate security measures to protect such personal information consistent with these regulations and any applicable federal regulations; and

2. Requiring such third-party service providers by contract to implement and maintain such appropriate security measures for personal information; provided, however, that until March 1, 2012, a contract a person has entered into with a third party service provider to perform services for said person or functions on said person’s behalf satisfies the provisions of 17.03(2)(f)(2) even if the contract does not include a requirement that the third party service provider maintain such appropriate safeguards, as long as said person entered into the contract no later than March 1, 2010.

(g) Reasonable restrictions upon physical access to records containing personal information,, and storage of such records and data in locked facilities, storage areas or containers.

(h) Regular monitoring to ensure that the comprehensive information security program is operating in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal information; and upgrading information safeguards as necessary to limit risks.

(i) Reviewing the scope of the security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records containing personal information.

(j) Documenting responsive actions taken in connection with any incident involving a breach of security, and mandatory post-incident review of events and actions taken, if any, to make changes in business practices relating to protection of personal information.

201 Mass. Code Regs. 17.03

Information Security

An entity that conducts business in Nebraska and owns, licenses, or maintains computerized data that includes personal information about a resident of Nebraska must implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information and the nature and size of the entity and its operations, including safeguards that protect the personal information when the entity disposes of the personal information. If an entity discloses computerized data that includes personal information about a resident of Nebraska to a nonaffiliated, third-party service provider, then that entity shall require by contract that such service provider implement and maintain reasonable security procedures and practices that (i) are appropriate to the nature of the personal information disclosed to the service provider; and (ii) are reasonably designed to help protect the personal information from unauthorized access, acquisition, destruction, use, modification or disclosure. This requirement does not apply for contracts entered into prior to July 18, 2018, or if such entity complies with a state or federal law that provides greater protection to personal information than this section or if such entity complies with Gramm-Leach-Bliley Act or HIPAA.

Restrictions On Use of SSN

In Nebraska, an employer cannot do the following: (a) display more than the last four digits of an employee's SSN to the general public or an employee’s coworkers; (b) require an employee to transmit more than the last four digits of his or her SSN over the Internet unless the connection is secure or the information is encrypted; (c) require an employee to use more than the last four digits of his or her SSN to access an Internet web site unless a password or other authentication device is also required to access the Internet web site; or (d) require an employee to use more than the last four digits of his or her SSN as an employee number for any type of employment-related activity.

Neb. Rev. Stat. Ann. § 48-237

Record Destruction

A business that maintains records which contain personal information concerning the customers of the business shall take reasonable measures to ensure the destruction of those records when the business decides that it will no longer maintain the records. § 603A.200. “Reasonable measures to ensure the destruction” means any method that modifies the records containing the personal information in such a way as to render the personal information contained in the records unreadable or undecipherable, such as shredding or erasing. § 603A.200.

Information Security

Nevada requires entities that collect data from Nevada residents to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure.

Further, the entity to whom the information is disclosed pursuant to a contract must also implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure.

Nev. Rev. Stat. Ann. § 603A.210

Data Obligations

Effective on October 1, 2019, consumers will be allowed to opt out of data sales by web operators. Covered businesses must establish a designated request address through which consumers may submit a verified opt-out request

Record Destruction

A business that maintains records which contain personal information concerning the customers of the business shall take reasonable measures to ensure the destruction of those records when the business decides that it will no longer maintain the records. “Reasonable measures to ensure the destruction” in Nevada means any method that modifies the records containing the personal information in such a way as to render the personal information contained in the records unreadable or undecipherable, such as shredding or erasing.

Nev. Rev. Stat. Ann. § 603A.

Restrictions On Use of SSN

Nevada prohibits an entity from intentionally, publicly displaying a person’s SSN unless authorized by that person or required to do so by law. To do so is considered a misdemeanor.

However, Nevada allows entities to use an SSN for internal verification or administrative purposes, and the aforementioned restrictions do not apply to documents that are open to the public by law or regulation.

A person whose SSN has been willfully and intentionally posted or displayed in violation of this section can bring a civil cause of action against the violating entity. If successful, the court may award actual damages, reasonable attorney's fees and costs to the person.

Nev. Rev. Stat. Ann. § 205.4605

In Nevada, “post or display in any public manner” means to communicate or otherwise make available to the general public, including, without limitation:(1) printing the SSN of another person on any card required for that person to access products or services provided by the entity; (2) requiring another person to transmit his or her SSN over the Internet unless the connection is secure or the SSN is encrypted; (3) requiring the use of a SSN to access an Internet website, unless a password or other authentication device is also required to access the Internet website; or (4) printing the SSN of another person on any material that is mailed to the person in a way that is visible to the public.

Nev. Rev. Stat. Ann. § 205.4605

PIN Security

If an entity doing business in Nevada accepts a payment card during a sale of goods or services, the entity must comply with the current version of the Payment Card Industry (PCI) Data Security Standard, as adopted by the PCI Security Standards Council or its successor organization, with respect to those transactions, not later than the date for compliance set forth in the PCI Data Security Standard or by the PCI Security Standards Council or its successor organization.

An entity doing business in Nevada that does not fall under the aforementioned is prohibited from the (a) transfer any personal information through an electronic, nonvoice transmission other than a facsimile to a receiving entity outside of the collecting entity’s secure system unless the collecting entity uses encryption to ensure the security of electronic transmission. Further, a collecting entity may not move any data storage device containing personal information beyond the logical or physical controls of the collecting entity, its third party contractors or, if the data storage device is used by or is a component of a multifunctional device, the entity who assumes the obligation of the collecting entity to protect the personal information, unless the collecting entity uses encryption to ensure the security of the information.

Nev. Rev. Stat. Ann. § 603A.215

Record Destruction

A business or public entity shall destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information, which is no longer to be retained by the business or public entity, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable, undecipherable or nonreconstructable through generally available means.

N.J. Stat. Ann. § 56:8-162.

Restrictions On Use of SSN

No person, including any public or private entity, shall:

(1) Publicly post or publicly display an individual's Social Security number, or any four or more consecutive numbers taken from the individual's Social Security number;

(2) Print an individual's Social Security number on any materials that are mailed to the individual, unless State or federal law requires the Social Security number to be on the document to be mailed;

(3) Print an individual's Social Security number on any card required for the individual to access products or services provided by the entity;

(4) Intentionally communicate or otherwise make available to the general public an individual's Social Security number;

(5) Require an individual to transmit his Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted; or

(6) Require an individual to use his Social Security number to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site.

Nothing in this section shall prevent a public or private entity from using a Social Security number for internal verification and administrative purposes, so long as the use does not require the release of the Social Security number to persons not designated by the entity to perform associated functions allowed or authorized by law.
Nothing in this section shall prevent the collection, use or release of a Social Security number, as required by State or federal law.
Notwithstanding this section, Social Security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend or terminate an account, contract or policy, or to confirm the accuracy of the Social Security number. A Social Security number that is permitted to be mailed under this subsection may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been open.
Nothing in this section shall apply to documents that are recorded or required to be open to the public pursuant to Title 47 of the Revised Statutes. This section shall not apply to records that are required by statute, case law, or New Jersey Court Rules, to be made available to the public by entities provided for in Article VI of the New Jersey Constitution.
Nothing in this section shall apply to the interactive computer service provider's transmissions or routing or intermediate temporary storage or caching of an image, information or data that is otherwise subject to this section.

N.J. Stat. Ann. § 56:8-164

Information Security

A business that owns or licenses personal identifying information of a New Mexico resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal identifying information from unauthorized access, destruction, use, modification or disclosure.

N.M. Stat. Ann. § 57-12C-4 (West)

A person that discloses personal identifying information of a New Mexico resident pursuant to a contract with a service provider shall require by contract that the service provider implement and maintain reasonable security procedures and practices appropriate to the nature of the personal identifying information and to protect it from unauthorized access, destruction, use, modification or disclosure. § 57-12C-5

Restrictions On Use of SSN

(1) make the entirety of a social security number available to the general public. This prohibition includes:

(a) intentionally communicating a social security number to the general public; and

(b) printing a social security number on a receipt issued for the purchase of products or services, including a receipt for the purchase of services from the state or its political subdivisions;

(2) require the use of a social security number:

(a) over the internet without a secure connection or encryption security; or

(b) to access an internet account unless a password or unique personal identification number or other personal authentication device is also required to access the account;

(3) print a social security number on materials mailed to a consumer unless authorized or required by federal or state law; provided that nothing in this paragraph prohibits a business from requiring a consumer, as part of an application or enrollment process, or to establish, amend or terminate an account, contract or policy, or to confirm the accuracy of the social security number, to enter a social security number on material to be mailed by the consumer as long as it is not required to be entered, in whole or in part:

(a) on a postcard or other mailer not requiring an envelope;

(b) on the envelope; or

(4) transmit material that associates a social security number with an account number for a bank, savings and loan association or credit union, unless both numbers are required as part of an application or enrollment process or to establish, amend or terminate an account, contract or policy or to confirm the accuracy of the social security, bank, savings and loan association or credit union account number; or

(5) refuse to transact business because of a refusal to provide the social security number for use of that number in a manner prohibited by Paragraphs (1) through (4) of this subsection.

N.M. Stat. Ann. § 57-12B-4

Record Destruction

A person that owns or licenses records containing personal identifying information of a New Mexico resident shall arrange for proper disposal of the records when they are no longer reasonably needed for business purposes. As used in this section, “proper disposal” means shredding, erasing or otherwise modifying the personal identifying information contained in the records to make the personal identifying information unreadable or undecipherable.

N.M. Stat. Ann. § 57-12C-3 (West)

Record Destruction

Any business that conducts business in NC and maintains or possesses personal information of a NC resident must take reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal. § 75-64(a).

Reasonable measures must include: (1) Implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of papers containing personal information so that information cannot be practicably read or reconstructed. (2) Implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the information cannot practicably be read or reconstructed. (3) Describing procedures relating to the adequate destruction or proper disposal of personal records as official policy in the writings of the business entity. § 75-64(b).

Restrictions on Use of SSN

The state specifically protects SSNs under its data destruction and breach notification provisions.

Additionally, state laws provide that a business may not do any of the following:

(1) Intentionally communicate or otherwise make available to the general public an individual's SSN.

(2) Intentionally print or imbed an individual's SSN on any card required for the individual to access products or services provided by the person or entity.

(3) Require an individual to transmit his or her SSN over the Internet, unless the connection is secure or the social security number is encrypted.

(4) Require an individual to use his or her SSN to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site.

(5) Print an individual's SSN on any materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed.

(6) Sell, lease, loan, trade, rent, or otherwise intentionally disclose an individual's SSN to a third party without written consent to the disclosure from the individual, when the party making the disclosure knows or in the exercise of reasonable diligence would have reason to believe that the third party lacks a legitimate purpose for obtaining the individual's SSN. § 75-62(a). Section (b) provides exemptions, including when a SSN is used in an application or documents for enrollment of an account, verification for administrative purposes, required by other law, when a SSN is redacted, and several other specific exceptions.

Publication of Personal Information

State law also prohibits a business from knowingly broadcasting or publishing to the public personal information of another with actual knowledge that the person whose personal information is disclosed has previously objected to such disclosure. “Personal information” has the same definition as above with the exception of (14) Parent’s surname prior to marriage. § 75-66.

Restrictions on Publication & Use of SSN

With some exceptions, a business may not:

(1) publicly post or publicly display or otherwise intentionally communicate or make available to the general public a consumer's social security number or a portion of it containing six digits or more;

(2) intentionally print or imbed a consumer's social security number or any portion of it containing six digits or more on any card required for the consumer to access products or services provided by the person;

(3) require a consumer to transmit his social security number or a portion of it containing six digits or more over the Internet, unless the connection is secure or the social security number is encrypted;

(4) require a consumer to use his social security number or a portion of it containing six digits or more to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site;

(5) print a consumer's social security number or a portion of it containing six digits or more on materials that are mailed to the individual, unless state or federal law requires the social security number to be on the document to be mailed;

(6) sell, lease, loan, trade, rent, or otherwise intentionally disclose a consumer's social security number or a portion of it containing six digits or more to a third party without written consent to the disclosure from the consumer, unless the third party seeking disclosure of the social security number does so for a legitimate business or government purpose or unless authorized or specifically permitted by law to do so or unless the disclosure is otherwise imperative for the performance of the person's duties and responsibilities as prescribed by law. A legitimate business purpose of the third party includes, but is not limited to, locating an individual to provide a benefit to that individual, such as a pension, insurance, or unclaimed property benefit, or to find an individual who is missing or a lost relative, or to serve civil process. A legitimate purpose of the third party does not include the bulk purchase or rental of social security numbers or use in marketing.

S.C. Code Ann. § 37-20-180

Record Destruction

When a business disposes of a business record that contains personal identifying information of a customer of a business, the business shall modify, by shredding, erasing, or other means, the personal identifying information to make it unreadable or undecipherable.

S.C. Code Ann. § 37-20-190

Restrictions on Capture & Use of Biometric Identifiers

Persons who capture biometric identifiers for a commercial purpose may not sell, lease, or disclose the biometric identifier. They must also store, transmite & protect from disclosure the biometric identifier using reasonable care and in a manner that is the same as or more protective than the manner in which the person stores, transmits, and protects any other confidential information the person possesses. It also requires the person to destroy the biometric identifier within a reasonable time, but no later than 1 year after the purpose for collecting the identifier expires.

TX Bus. & Comm. Code § 503.001

Restrictions On Use of SSN

A person may not require an individual to disclose the individual’s SSN to obtain goods / services unless the person adopts a privacy policy, makes that policy available to the disclosing individual, & maintains the confidentiality & security of the SSN disclosed.

TX Bus. & Comm. Code § 501.052

Prohibitions of Displaying & Using SSN & Drivers License Numbers

A person may not print an individual’s driver’s license number on a receipt.

TX Bus. & Comm. Code § 501.1011

A merchant or third party under contract with the merchant may not disclose a consumer’s driver’s license number or SSN to any other third party, and can only use the DLN or SSN to monitor, investigate, or prosecute fraudulent return of merchandise. They must destroy or arrange for the destruction of the DLN and SSN at expiration of six months from the date of the last transaction.

TX Bus. & Comm. Code § 501.101

Record Destruction

When a business disposes of a business record that contains PII of a customer of the business, the business shall modify by shredding, erasing or other means the PII to make the PII unreadable.

TX Bus. & Comm. Code § 72.004

Information Security

(a) A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information collected or maintained by the business in the regular course of business.

TX Bus. & Comm. Code § 521.052