The collision industry has been focusing on a new California law on how larger businesses should handle customer personal data starting next year, but repairers shouldn’t overlook an existing duty on any company — large or small — to render incomprehensible discarded consumer records.
California Civil Code Title 18.1 was highlighted in the recent settlement between Service King and multiple counties’ district attorneys. It also appeared in 2018 settlements addressing similar respective disputes various counties had with AutoNation and Cooks Collision.
All three settlements contained stipulations that the companies were not admitting to any of the allegations.
Civil Code 1798.81 states: “A business shall take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by (a) shredding, (b) erasing, or (c) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.”
Personal information was defined as “any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. ‘Personal information’ does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.”
Under CCC 1798.84, a consumer can bring a civil action against a company who fails to make their information unreadable.
California district attorneys can also take action against a repairer.
Alameda County Deputy District Attorney Kevin Wong confirmed Monday his agency had used the state’s “unfair competition” rules in California Business and Professions Code 17200 as grounds to go after Service King on the consumer information violation. The code declares any “any unlawful, unfair or fraudulent business act or practice” to be unfair competition and gives agencies like Wong’s the authority to enforce this with civil actions.
The law allows for penalties of up to $2,500 for each unfair competition violation.
The bulk of the investigations against the three companies involved hazardous materials the repairers allegedly disposed of improperly. The alleged hazmat violations were discovered at least in part by investigations of the businesses’ garbage, based on Santa Clara County, Yolo County and Alameda County DA news releases associated with the three actions.
“Invoices and other documents containing personal customer information were also found in the trash,” the Santa Clara County District Attorney’s Office wrote Feb. 26 in announcing the AutoNation settlement. “State law requires businesses to take reasonable steps when disposing of customer records by shredding, redacting, or erasing the personal information.”
The settlement announced Friday with Service King bans the company from “Failing to take reasonable steps to dispose, or arrange fro the disposal, of customer records containing personal information when the records are no longer to be retained by each Facility by first shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable, as required by Civil Code section 1798.81.”
Santa Clara County Supervising Deputy District Attorney Bud Porter, who was involved in all three investigations, said authorities have over the years found intact employment and customer records alongside electronic and hazardous waste. Sometimes they even find unshredded customer documents in a bag next to a bag of shredded records, he said.
Porter, whose responsibilities now include overseeing the Environmental Protection Unit, said authorities will notify a company about the records when it reports the presence of the hazardous waste.
A company might have to buy more shred bins and do training, he said.
Sometimes it might not be the business’ fault, Porter said: The customer might have been the one chucking out identifying documents into the business’ trash intact, he said. A solution might be to put out signage warning customers against doing so and directing them to use a shred bin instead, he said.
Shops in other states might be bound by similar laws and not realize it. A 2018 document from data destruction company Blancco shows multiple examples of language like California’s existing nationwide.
Even if your state doesn’t impose such a duty, you still might want to adopt appropriate best practices now as as a form of customer service and to prepare for potential copycat laws or regulations.
For example, Virginia this year saw House Bill 2793 proposing virtually identical “make it unreadable or undecipherable” language for businesses. The bill never left a House Committee, but you get the idea.
Alameda County District Attorney’s Office, Oct. 25, 2019
Blancco, July 28, 2018
Featured image: California businesses must shred or otherwise render indecipherable customer information under Civil Code Title 18.1. (Ralf Geithe/iStock)