PCI DSS (Payment Card Industry Data Security Standard)

PCI isn’t technically legislation, but compliance with this 2004 standard is so common that it might as well be. In fact, it’s a wonderful example of industry self-regulation. The PCI standard is recognized across the credit card processing industry, and if you fail to meet its requirements you may receive fines or lose the privilege to process a credit card.

Above all, the regulation requires you to protect stored cardholder data. Secure data sanitization processes will help you maintain this requirement when you decide to decommission unwanted hardware.

SOX (Sarbanes-Oxley Act)

Passed in 2002, SOX was primarily written to govern proper standards for public companies. It requires company information to be certified by the CEO and CFO and gives more power to auditors while evaluating that information.

Section 802 outlines the criminal penalties (up to 20 years in prison) for altering documents as well as the requirements for appropriate destruction of records.

• You must not modify, destroy, or falsify records.

• You must maintain documents for 7 years from the conclusion of the financial audit

• You must maintain all business records and communications including electronic communications for the duration.

SOX’s requirements don’t directly apply to secure data destruction, but the information that must be kept is highly sensitive. After the retention period, you should take care to properly destroy the sensitive information. 

HIPAA (Health Insurance Portability and Accountability Act)

Passed in 1996, HIPAA regulates the protection, use, and disclosure of health data. Penalties for violations can be up to $1.5M per year if data is improperly disclosed. While the Privacy Rule applies only to health plans, health care providers, and health care clearinghouses, any companies that interact with or support these companies may also fall under compliance if they transmit health information in electronic form.

• You must protect individually identifiable health information – Past, Present, and Future.

• You must maintain written privacy policies and procedures.

• You must implement reasonable safeguards including sharing information only with a minimal number of people.

Accidental disclosure of identifiable information can incur fines of $100-$50,000 per violation up to the yearly $1.5M cap as long as it’s not due to willful neglect. 

FACTA (Fair and Accurate Credit Transactions Act)

The FTC passed this rule in 2003 which details the management and destruction of consumer report data.

• You must document what was destroyed and when.

• You must have written policies in place for data destruction.

• You should have strict schedules for timely data destruction.

• You are required to train your employees.

When it comes to electronic data, FACTA requires you to: “destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed”.

GLB Act (Gramm-Leach-Bliley Act)

Passed in 1999, the GLB Act requires financial institutions to protect the security and confidentiality of customer information; including protecting it from anticipated threats or hazards. It also requires institutions to protect against unauthorized access and use of the information. Like HIPAA, this act only applies to personally identifiable information, but in this case, instead of health data, it’s financial.

• You must provide a clear and accurate statement of your company’s privacy policy.

• You must provide customers the ability to opt-out of sharing their information with third parties.

• You must protect all nonpublic personal information (e.g. lists of credit card, payday lending, or also loan customers).

• You are responsible for the actions of yourself and your affiliates.