Section 145.20  Disposal of Records

a)         When disposing of records that contain personal information, including, but not limited to, social security numbers, driver's license numbers or non-driver identification card numbers, financial account numbers or codes, debit card numbers or codes, automated teller machine card numbers or codes, electronic serial numbers, or personal identification numbers, a debt settlement provider shall take all reasonable measures necessary to protect against unauthorized access to or use of the records.

b)         Compliance Methods

1)         Debt settlement providers must maintain and enforce policies and procedures to implement this Section, and the measures that may be taken to comply with this Section include the following:

A)        implementing and monitoring compliance with policies and procedures that require the burning, pulverizing or shredding of paper documents containing personal information so that the personal information cannot practicably be read or reconstructed;

B)        implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the personal information cannot practicably be read or reconstructed.

2)         A debt settlement provider may enter into a written contract with a third party engaged in the business of record destruction to dispose of records containing personal information.