In its first use of new enforcement powers, the State of Kansas recently filed an action against Searchtec, Inc. over Searchtec’s alleged inappropriate disposal of records. According to the complaint, Searchtec is in the business of handling and processing documents which contain personal information for various customers. The State alleged that Searchtec failed to fulfill its legal duties under the Wayne Owen Act (which is part of and supplemental to the Kansas Consumer Protection Act) by repeatedly dumping records containing personal information in various unsecured waste receptacles owned by other entities without rendering the personal information unreadable or undecipherable.
Effective as of July of 2016, the Wayne Owen Act expressly imposes duties on parties handling and processing documents containing personal information. The Kansas Consumer Protection Act already generally prohibited suppliers from engaging in unconscionable acts or practices in connection with a consumer transaction, but now under the new act suppliers are expressly duty-bound to do the following: (1) implement and maintain reasonable procedures and practices to protect the personal information in their custody from unauthorized access, use, modification, or disclosure; (2) exercise reasonable care to protect the personal information from unauthorized access, use, modification, or disclosure; and (3) take reasonable steps to destroy or arrange for the destruction of any records within an entity’s custody or control containing personal information when such entity no longer intends to maintain or possess the records.
TIP: This case serves as a reminder that states remain concerned about how companies dispose of materials containing personally identifiable information, and companies who engage in such practices would be well served to ensure that their disposal methods protect against unauthorized access or acquisition of personal information.