The Identity Theft Enforcement and Protection Act (the “ITEP Act”) , mandates that businesses have a legal duty to protect and safeguard sensitive personal information.
Similar to the Gramm-Leach Bliley Act, the ITEP Act requires businesses that collect or maintain sensitive personal information in the regular course of business to implement and maintain reasonable procedures and corrective measures to protect and safeguard sensitive personal information from unlawful use or disclosure. Further more , the ITEP Act includes a “Dumpster Diving”provision where companies are required to destroy customer records no longer in use by shredding, erasing modifying the records to make the information unreadable or undecipherable.
The ITEP Act not only allows the Attorney General to seek permanent injunction, but also exposes defendants to a civil penalty of at least 2,000 and up to $50,00 against each defendant.
For more information click here.