the notification of persons affected by any unauthorized access to personal information.
requiring an individual to use a Social Security number to access an Internet website, unless a password or other authentication device is also required to access that website.
When businesses decide to discard records that contain "personal information," the ITPA requires those records to be destroyed. The destruction-of-records requirement includes all documents, paper and electronic, that contain an individual's first name or first initial and last name combined with the person's: (1) Social Security number; (2) driver's license number or state identification card number; or (3) credit or debit card account number in combination with any required security code, access code, or password permitting access to the individual's financial account.
The ITPA also requires any business that compiles or maintains computerized records containing personal information to notify any person whose personal information was accessed by an unauthorized person. Therefore, if any file, database, or other electronic record containing a person's name and Social Security number is compromised, that person must be advised, as must the New Jersey State Police.
All companies doing business in New Jersey must take steps to comply with the ITPA by preventing the display of Social Security numbers, limiting access to records containing personal information, and maintaining specific destruction procedures for all records containing personal information. Businesses may want to contact legal counsel to assist in training and reviewing existing procedures and document- destruction policies, both paper and electronic, and to create response plans in the event of a breach of security to ensure compliance with the ITPA and its federal counterparts.