Personal identifying information; safe destruction of records.

Safe destruction of records containing personalidentifying information. Requires a commercial entity that isin possession of, or has within its custody or control, records that(i) contain consumers' unencrypted, unredacted personal identifyinginformation and (ii) are no longer needed by the commercial entityto take reasonable steps to destroy, or arrange for the destructionof, the records by shredding, erasing, or otherwise destroying or modifying the personal identifying information in the records tomake it unreadable or indecipherable. The measure does not applyto certain financial institutions, health insurance or health carefacilities, consumer reporting agencies, or governmental entities.The measure authorizes a consumer who incurs actual damages due toa reckless or intentional violation of these requirements by a commercialentity to bring a civil action.