National and regional retailers must be aware not only of laws enacted by Congress, but of new legislation enacted in a number of states that affects a wide range of important topics, some obvious, some obscure. For example, a retailer must stay abreast not only of wage and hour requirements, but who a store can hire, how records containing personal information are kept and disposed of, and what can go into the dumpster (and whether that trash must be shredded or otherwise secured). This article highlights some of the state laws enacted in 2007 affecting retailers.

Personal information protection continues to concern state legislators. Although all 50 states and the District of Columbia already have laws imposing criminal penalties for identity theft, some of which were augmented in 2007, Oregon and Massachusetts both passed legislation in 2007 aimed at protecting consumers from identity theft by controlling the treatment of personal information used in the course of business.

Oregon passed the Oregon Consumer Identity Theft Protection Act (SB 583) that requires any person that owns, maintains, or otherwise possesses data that includes a consumer’s personal information that is used in the course of the person’s business, vocation, occupation or volunteer activities and was subject to a breach of security, to give notice of the breach of security to any consumer whose personal information was included in the breach. The Act contains security freeze provisions, and effective Jan. 1, 2008, requires the development, implementation, and maintenance of reasonable safeguards to protect the security, confidentiality and integrity of the personal information, including disposal of the data. The Act contains strong enforcement and penalty provisions.

Massachusetts passed an Act Relative to the Protection of Personal Information (HB 4144) that addresses not only security freezes, but the required parameters for the destruction of records containing personal information, plus detailed requirements for the notice to consumers of security breaches.

Texas, which has existing statutes addressing the retention and disposal of business records (Tex. Bus. & Com. Code §35.48, beefed up in 2005) and the Identity Theft Enforcement Protection Act (Tex. Bus. & Com. Code §48.001-48.102, added in 2005), has seen active enforcement of its laws during 2007, coupled with strong media coverage.

With the addition of the Oregon and Massachusetts legislation, thirty five states now have some form of personal information protection statutes that affect retailers. Retailers with locations in a number of states must remain aware of the requirements imposed in each state on the retention, protection, and disposal of personal information. The definition of protected personal information varies by state, and can range from the obvious (social security numbers, drivers license numbers, and account numbers) to photos, or a name or physical description.

Immigration status and employment checks.

Arizona made headlines with its 2007 enactment of the Fair and Legal Employment Act (HB 2779), placing the burden on employers to verify an employee’s legal immigration status. Effective Jan. 1, 2008, a civil action may be instituted against the employer who knowingly or intentionally hires an unauthorized alien, and a determination of violation will subject the employer to a lengthy probation period and a suspension of all licenses. The law requires the offending employer to sign a sworn affidavit stating that he has fired all unauthorized aliens and that the employer will not intentionally or knowingly employ any unauthorized alien. If there is a second violation of the law committed during the period of probation, the court will order the appropriate licensing agencies to permanently revoke all licenses held by the employer. Every employer, after hiring an employee, must use E-Verify (formerly the Basic Pilot Program) to verify employment eligibility of the new employee, and proof of verification will create a rebuttable presumption that the employer did not violate the law.

Two actions were filed in the United States District Court for the District of Arizona challenging the Arizona law and seeking injunctive relief. In one challenge, labeled Arizona Contractors by the court, a motion for injunction pending appeal was denied in a Dec. 21, 2007 order. In a challenge labeled Arizona Contractors II, the plaintiffs’ motion and application for a temporary restraining order were denied, but a hearing on a motion for preliminary injunction is set for Jan. 16, 2007.

A law passed by Oklahoma, effective Nov. 1, 2007, included a requirement that after July 1, 2008, no contractor or subcontractor can contract with a public employer unless it participates in a status verification system to verify information of all new employees. The law also has anti-discrimination provisions favoring legal status employees (HB 1804). The National Conference of State Legislatures identified a total of 31 state laws enacted in 20 states in 2007 that addressed the employment of immigrants.


Texas passed a law (SB 1389) effective Sept. 1, 2007, requiring a person who offers a consumer rebate to mail the rebate or electronically pay the amount of the rebate to the consumer within the time period promised, or if no time is promised, not later than the 30th day after the date the person receives a properly completed rebate request. Several other states considered laws addressing rebate problems during 2007, continuing a trend.

Minimum wage increases.

New Mexico raised its minimum wage effective Jan. 1, 2008 to $6.50 an hour, and as of Jan. 1, 2009, to $7.50 an hour (SB 324). A number of other states have increased their minimum wage requirements for 2008. The U.S. Department of Labor maintains an interactive list of state minimum wage requirements on line at