Disposal of personal information.

Existing law requires a business to take all reasonable steps to destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information that is no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means. Existing law provides for specified civil remedies for a violation of these provisions. This bill would, instead, require a business to take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by taking any of the actions described above. The bill would exempt from these provisions information that is made available to the general public from federal, state, or local government records. The bill would provide that a cause of action shall not lie against a business that disposes of abandoned records containing personal information in accordance with these provisions. The bill would set forth findings regarding records that end up in the possession of a storage company or commercial landlord, and would provide that it is the intent of the Legislature to create a safe harbor for such a record custodian who properly disposes of the records. Existing law requires a landlord, if personal property remains on the premises after a tenancy or commercial tenancy has terminated and the premises have been vacated by the tenant, to give written notice to the tenant and to any other person the landlord reasonably believes to be the owner of the property, as specified. This bill would provide that, if the property consists of records, the tenant shall be presumed to be the owner of the records. This bill would define "records" as it relates to these provisions.