North Carolina's Social Security Number and Records Disposal Rules: G.S. 75-62 and 75-64

Article 2A Beyond the Breach Statute

G.S. 75-60 titles Article 2A the "Identity Theft Protection Act." The history notes on sections 75-62, 75-63 and 75-64 trace to Session Law 2005-414; 75-62 and 75-63 show later amendments, and 75-64 shows none. Breach notice lives in G.S. 75-65. This article is about the other duties in the Article: Social Security number handling in 75-62, the credit freeze in 75-63, and record destruction in 75-64.

Two definitions from G.S. 75-61 control the reach of both operative sections. "Business" covers a sole proprietorship, partnership, corporation, association or other group, "however organized and whether or not organized to operate at a profit," and includes financial institutions and their parents and subsidiaries; the term excludes "any government or governmental subdivision or agency." "Personal information" combines a person's first name or first initial and last name with identifying information as defined in G.S. 14-113.20(b), a list that runs from Social Security numbers and account numbers through digital signatures, biometric data, fingerprints and passwords. Publicly available directories and information lawfully made available from government records are outside the definition.

What GS 75-62 Restricts

Subsection (a) provides that a business may not, except as subsection (b) allows, do any of the following:

1. Intentionally communicate or otherwise make an individual's Social Security number available to the general public.
2. Intentionally print or imbed the number on any card required for the individual to access products or services.
3. Require the individual to transmit the number over the internet, "unless the connection is secure or the social security number is encrypted."
4. Require use of the number to access a website, unless a password, unique personal identification number or other authentication device is also required.
5. Print the number on materials mailed to the individual, unless state or federal law requires it to be on the document.
6. Sell, lease, loan, trade, rent or otherwise intentionally disclose the number to a third party without written consent, "when the party making the disclosure knows or in the exercise of reasonable diligence would have reason to believe that the third party lacks a legitimate purpose for obtaining the individual's social security number."

The first two practices turn on intent. The third and fourth concern what a business requires of the individual, and the sixth carries its own knowledge and diligence condition; the text reaches a disclosure only where that condition is met. Subsection (c) adds an unusual cooperative duty: a covered business "shall make reasonable efforts to cooperate, through systems testing and other means, to ensure that the requirements of this Article are implemented."

The Exceptions

Subsection (b) removes seven situations from subsection (a). They cover inclusion of the number in applications or enrollment documents, or to establish, amend or terminate an account, contract or policy, or to confirm its accuracy for obtaining a credit report; collection, use or release "for internal verification or administrative purposes"; opening an account or providing or paying for a product or service the individual authorized; use to investigate or prevent fraud, conduct background checks, conduct social or scientific research, collect a debt, obtain or furnish consumer report data under the Fair Credit Reporting Act, undertake a Gramm-Leach-Bliley permissible purpose, or locate a missing person, lost relative or person due a benefit; acting under a court order, warrant or subpoena or when otherwise required by law; providing the number to a federal, state or local government entity; and a number that has been redacted.

The exception for application and enrollment documents carries its own limit, set out in subdivision (b)(1), on how a number that may lawfully be mailed is presented. Such a number "may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened." That sentence reaches partial display, "in whole or in part," which subsection (a)(5) does not address in terms.

Records Disposal Under GS 75-64

Section 75-64(a) applies to any business that conducts business in North Carolina and to any business that "maintains or otherwise possesses personal information of a resident of North Carolina." Those businesses must take reasonable measures "to protect against unauthorized access to or use of the information in connection with or after its disposal." Section 75-61(7) reaches further than the discarding of paper: disposal includes the "sale, donation, discarding, or transfer of any medium, including computer equipment or computer media," that holds records of personal information.

Subsection (b) states what the measures must include, so the phrase "reasonable measures" has a fixed floor rather than turning only on circumstances:

• Implementing and monitoring compliance with policies and procedures requiring "the burning, pulverizing, or shredding of papers" so that information cannot be practicably read or reconstructed
• Implementing and monitoring compliance with policies and procedures requiring destruction or erasure of electronic and other non-paper media, with the same result
• Describing the procedures for adequate destruction or proper disposal of personal records "as official policy in the writings of the business entity"

Subsection (c) permits outsourcing. A business may, after due diligence, contract in writing with a party in the record destruction business and monitor its compliance. The statute says due diligence "should ordinarily include one or more of the following": reviewing an independent audit of the disposal business; obtaining information from several references or other reliable sources together with requiring certification by a recognized trade association or similar third party; or reviewing and evaluating its information security policies or taking other measures to determine competency and integrity. Subsection (d) places a separate duty on the disposal business itself, covering collection and transportation as well as disposal.

Subsection (e) exempts a bank or financial institution "subject to and in compliance with" the Gramm-Leach-Bliley privacy and security provisions, a health insurer or health care facility subject to and in compliance with the HIPAA privacy and security standards, and a consumer reporting agency subject to and in compliance with the Fair Credit Reporting Act. Each exemption depends on compliance, not on status alone, and the exemptions are limited to this section; 75-62 contains no parallel carve-out, although its subsection (b)(4) mentions Gramm-Leach-Bliley permissible purposes.

The Attorney General's business guidance addresses disposal in more specific terms than the statute, stating that old documents containing personal information should at a minimum be destroyed with a cross-cut paper shredder and describing the sanitizing of old hard drives. That guidance is the agency's advice, and neither 75-64 nor its definitions name a shredder type.

Security Freezes and the Rest of Article 2A

G.S. 75-63 is the security freeze section, directed at consumer reporting agencies rather than businesses generally. A consumer may place a freeze by first-class mail, telephone, or a secure website or email connection, and the agency has three business days after a written request by mail, or 24 hours after an electronic or telephone request, to place it. Subsection (a1) has a nationwide agency notify the consumer that the freeze is placed only with that agency and to give contact information for the others and for the Attorney General's Office. Subsection (l) lists thirteen uses to which a freeze does not apply, including prescreening, employment screening and property and casualty underwriting. Subsection (q) makes a violation a violation of G.S. 75-1.1.

G.S. 75-63.1 adds a protected consumer freeze for those under 16 or incapacitated. G.S. 75-66, added in 2007, is a different kind of provision: it reaches any person who knowingly broadcasts or publishes another's personal information "with actual knowledge that the person whose personal information is disclosed has previously objected to any such disclosure," and it routes civil claims to G.S. 1-539.2C rather than to Chapter 75.

Public Agencies Under GS 132-1.10

Government sits outside the "business" definition, so G.S. 132-1.10 in the Public Records Act covers agencies separately. Subsections (b)(5) through (b)(9) track much of 75-62(a), but the section begins earlier in the data's life: no agency may collect a Social Security number unless authorized by law or "otherwise imperative for the performance of that agency's duties," the need must be "clearly documented," and the number must be segregated so it can be redacted from a public records response. Subsection (d) goes beyond agencies: a person preparing or filing a document for the register of deeds, the Secretary of State or the courts may not include listed numbers unless required by law or court order, adopted by the State Registrar for vital records, or redacted, with a fine of up to $500 per violation. Subsection (c1) sends an agency that experiences a security breach to G.S. 75-65.

Remedies

Sections 75-62(d) and 75-64(f) each state that a violation is a violation of G.S. 75-1.1, the unfair or deceptive practices statute, and the remedies come from that connection. G.S. 75-16 gives an injured person a right of action and judgment for "treble the amount fixed by the verdict." G.S. 75-16.1 allows the presiding judge, in the judge's discretion, to award fees on a finding of willfulness and an unwarranted refusal to resolve the matter, or against a plaintiff who knew or should have known the action was frivolous and malicious. In a suit by the Attorney General, G.S. 75-15.2 allows a civil penalty of up to $5,000 for each violation where the acts were, when committed, knowingly violative of a statute.

The two sections are not worded the same, and the differences change how the remedies work. Section 75-64(f) adds that "any damages assessed against a business because of the acts or omissions of its nonmanagerial employees shall not be trebled as provided in G.S. 75-16 unless the business was negligent in the training, supervision, or monitoring of those employees." It also provides that no private right of action may be brought by an individual "unless such individual is injured as a result of the violation." Section 75-62(d) contains neither sentence, stating only the link to G.S. 75-1.1, so the non-managerial limit on trebling is written into the disposal section alone. Section 75-65(i), on breach notice, carries the same injury sentence as 75-64(f), and 75-65(j) provides that causes of action arising under the Article may not be assigned.

No Attorney General enforcement action citing 75-62 or 75-64 was located in the Department of Justice materials retrieved for this article. Published multistate data breach settlements such as the 2020 Anthem assurance cite North Carolina's Act generally, as N.C.G.S. 75-60 et seq., in a list defined as state data breach notification laws, and do not identify either section. The record here is zero located; the penalty provisions above describe what the statutes authorize, not what the State has done.

Frequently Asked Questions