reglab/statecodes huggingface dataset:
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 1. Breach of Security Involving Personal Information. › Sec. 45.48.050. Exception for employees and agents.

In AS 45.48.010 - 45.48.090, the good faith acquisition of personal information by an employee or agent of an information collector for a legitimate purpose of the information collector is not a breach of the security of the information system if the employee or agent does not use the personal information for a purpose unrelated to a legitimate purpose of the information collector and does not make further unauthorized disclosure of the personal information.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 1. Breach of Security Involving Personal Information. › Sec. 45.48.070. Treatment of certain breaches.

(a) If a breach of the security of the information system containing personal information on a state resident that is maintained by an information recipient occurs, the information recipient is not required to comply with AS 45.48.010 - 45.48.030. However, immediately after the information recipient discovers the breach, the information recipient shall notify the information distributor who owns the personal information or who licensed the use of the personal information to the information recipient about the breach and cooperate with the information distributor as necessary to allow the information distributor to comply with (b) of this section. In this subsection, “cooperate” means sharing with the information distributor information relevant to the breach, except for confidential business information or trade secrets.
(b) If an information recipient notifies an information distributor of a breach under (a) of this section, the information distributor shall comply with AS 45.48.010 - 45.48.030 as if the breach occurred to the information system maintained by the information distributor.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 1. Breach of Security Involving Personal Information. › Sec. 45.48.080. Violations.

(a) If an information collector who is a governmental agency violates AS 45.48.010 - 45.48.090 with regard to the personal information of a state resident, the information collector
(1) is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS 45.48.010 - 45.48.090, but the total civil penalty may not exceed $50,000; and
(2) may be enjoined from further violations.
(b) If an information collector who is not a governmental agency violates AS 45.48.010 - 45.48.090 with regard to the personal information of a state resident, the violation is an unfair or deceptive act or practice under AS 45.50.471 - 45.50.561. However,
(1) the information collector is not subject to the civil penalties imposed under AS 45.50.551 but is liable to the state for a civil penalty of up to $500 for each state resident who was not notified under AS 45.48.010 - 45.48.090, except that the total civil penalty may not exceed $50,000; and
(2) damages that may be awarded against the information collector under
(A) AS 45.50.531 are limited to actual economic damages that do not exceed $500; and
(B) AS 45.50.537 are limited to actual economic damages.
(c) The Department of Administration may enforce (a) of this section against a governmental agency. The procedure for review of an order or action of the department under this subsection is the same as the procedure provided by AS 44.62 (Administrative Procedure Act), except that the office of administrative hearings (AS 44.64.010) shall conduct the hearings in contested cases and the decision may be appealed under AS 44.64.030(c).
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 1. Breach of Security Involving Personal Information. › Sec. 45.48.090. Definitions.

In AS 45.48.010 - 45.48.090,
(1) “breach of the security” means unauthorized acquisition, or reasonable belief of unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the personal information maintained by the information collector; in this paragraph, “acquisition” includes acquisition by
(A) photocopying, facsimile, or other paper-based method;
(B) a device, including a computer, that can read, write, or store information that is represented in numerical form; or
(C) a method not identified by (A) or (B) of this paragraph;
(2) “covered person” means a
(A) person doing business;
(B) governmental agency; or
(C) person with more than 10 employees;
(3) “governmental agency” means a state or local governmental agency, except for an agency of the judicial branch;
(4) “information collector” means a covered person who owns or licenses personal information in any form if the personal information includes personal information on a state resident;
(5) “information distributor” means a person who is an information collector and who owns or licenses personal information to an information recipient;
(6) “information recipient” means a person who is an information collector but who does not own or have the right to license to another information collector the personal information received by the person from an information distributor;
(7) “personal information” means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of
(A) an individual's name; in this subparagraph, “individual's name” means a combination of an individual's
(i) first name or first initial; and
(ii) last name; and
(B) one or more of the following information elements:
(i) the individual's social security number;
(ii) the individual's driver's license number or state identification card number;
(iii) except as provided in (iv) of this subparagraph, the individual's account number, credit card number, or debit card number;
(iv) if an account can only be accessed with a personal code, the number in (iii) of this subparagraph and the personal code; in this sub-subparagraph, “personal code” means a security code, an access code, a personal identification number, or a password;
(v) passwords, personal identification numbers, or other access codes for financial accounts.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.110. Placement of security freeze.

(a) To place a security freeze, a consumer shall make the request to the consumer credit reporting agency
(1) by mail to the address designated by the consumer credit reporting agency to receive security freeze requests; or
(2) as allowed by (b) of this section.
(b) A consumer may make a request under (a) of this section by telephone or by facsimile, the Internet, or other electronic media if the consumer credit reporting agency has developed procedures for using the telephone or an electronic medium to receive and process the request in an expedited manner.
(c) A consumer credit reporting agency shall place a security freeze within five business days after receiving a request under (a) or (b) of this section and proper identification from the consumer.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.120. Confirmation of security freeze.

(a) Within 10 business days after a consumer makes the request under AS 45.48.110, a consumer credit reporting agency shall send a written confirmation of the placement of the security freeze to the consumer. The confirmation must also inform the consumer that the consumer credit reporting agency may charge, as allowed by AS 45.48.160, a fee for third-party access during the security freeze.
(b) At the same time that the consumer credit reporting agency sends a confirmation under (a) of this section, the consumer credit reporting agency shall provide the consumer with a unique personal identification number, password, or similar device to be used by the consumer when the consumer authorizes the release of the consumer's credit report or credit score under AS 45.48.130.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.140. Removal of security freeze.

(a) Except as provided by AS 45.48.130, a consumer credit reporting agency may not remove a security freeze unless
(1) the consumer requests that the consumer credit reporting agency remove the security freeze under (b) of this section; or
(2) the consumer made a material misrepresentation of fact to the consumer credit reporting agency when the consumer requested the security freeze under AS 45.48.110; if a consumer credit reporting agency intends to remove a security freeze on a consumer's credit report under this paragraph, the consumer credit reporting agency shall notify the consumer in writing before removing the security freeze.
(b) A consumer credit reporting agency shall remove a security freeze within three business days after receiving a request for removal from the consumer who requested the security freeze.
(c) To make a request under (b) of this section, the consumer shall contact the consumer credit reporting agency by mail or as allowed by (d) of this section, authorize the consumer credit reporting agency to remove the security freeze, and provide the consumer credit reporting agency with
(1) proper identification to verify the consumer's identity; and
(2) the unique personal identification number, password, or similar device provided under AS 45.48.120(b).
(d) In addition to mail, a consumer may make a request under (b) of this section by telephone or by facsimile, the Internet, or other electronic media if the consumer credit reporting agency has developed procedures for using the telephone or an electronic medium to receive and process the request in an expedited manner.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.160. Charges.

(a) Except as provided by (b), (c), or (d) of this section, a consumer credit reporting agency may not charge a consumer to place or remove a security freeze, to provide access under AS 45.48.130, or to take any other action, including the issuance of a personal identification number, password, or similar device under AS 45.48.120, that is related to the placement of, removal of, or allowing access to a credit report or credit score on which a security freeze has been placed.
(b) A consumer credit reporting agency may charge a consumer $5 for placing a security freeze.
(c) A consumer credit reporting agency may charge the consumer $2 for each access request made by the consumer. In this subsection, “access request” means a request made by the consumer under AS 45.48.130 to allow third-party access to the consumer's credit report or credit score on which a security freeze has been placed.
(d) If a consumer fails to retain a personal identification number, password, or similar device issued under AS 45.48.120, a consumer credit reporting agency may charge the consumer up to $5 for each time after the first time that the consumer credit reporting agency issues the consumer another personal identification number, password, or similar device because the consumer failed to retain the personal identification number, password, or similar device.
(e) A consumer credit reporting agency may not charge a consumer a fee under (b) or (c) of this section if the consumer has been a victim of identity theft and provides the consumer credit reporting agency with a complaint filed by the consumer with a law enforcement agency.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.180. Notification after violation.

If a consumer credit reporting agency violates a security freeze by releasing a consumer's credit report or credit score, the consumer credit reporting agency shall notify the consumer within five business days after discovering or being notified of the release, and the information in the notice must include an identification of the information released and of the third party who received the information.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.200. Violations and penalties.

(a) A consumer who suffers damages as a result of a person's violation of AS 45.48.100 - 45.48.290 may bring an action in court against the person and recover, in the case of a violation where the person acted
(1) negligently, actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees;
(2) knowingly,
(A) damages as described in (1) of this subsection;
(B) punitive damages that are not less than $100 or more than $5,000 for each violation as the court determines to be appropriate; and
(C) other relief that the court determines to be appropriate.
(b) A consumer may bring an action in court against a person for a violation or threatened violation of AS 45.48.100 - 45.48.290 for injunctive relief, whether or not the consumer seeks another remedy under this section.
(c) Notwithstanding (a)(2) of this section, a person who knowingly violates AS 45.48.100 - 45.48.290 is liable in a class action for an amount that the court allows. When determining the amount of an award in a class action under this subsection, the court shall consider, among the relevant factors, the amount of any actual damages awarded, the frequency of the violations, the resources of the violator, and the number of consumers adversely affected.
(d) In this section, “knowingly” has the meaning given in AS 11.81.900.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.210. Exemptions.

(a) The provisions of AS 45.48.100 - 45.48.290 do not apply to the use of a credit report by
(1) a person, the person's subsidiary, affiliate, or agent, or the person's assignee with whom a consumer has or, before the assignment, had an account, contract, or debtor-creditor relationship if the purpose of the use is to review the consumer's account or to collect a financial obligation owing on the account, contract, or debt;
(2) a subsidiary, an affiliate, an agent, an assignee, or a prospective assignee of a person to whom access has been granted under AS 45.48.130 if the purpose of the use is to facilitate the extension of credit or another permissible use;
(3) a person acting under a court order, warrant, or subpoena;
(4) an agency of a state or municipality that administers a program for establishing and enforcing child support obligations;
(5) the Department of Health, its agents, or its assigns when investigating fraud;
(6) the Department of Revenue, its agents, or its assigns when investigating or collecting delinquent taxes or unpaid court orders or when implementing its other statutory responsibilities;
(7) a person if the purpose of the use is prescreening allowed under 15 U.S.C. 1681b(c) (Fair Credit Reporting Act);
(8) a person administering a credit file monitoring subscription service to which the consumer has subscribed;
(9) a person providing a consumer with a copy of the consumer's credit report or credit score at the consumer's request;
(10) a person if the database or file of the consumer credit reporting agency consists entirely of information concerning and used solely for one or more of the following purposes:
(A) criminal record information;
(B) personal loss history information;
(C) fraud prevention or detection;
(D) tenant screening; or
(E) employment screening; or
(11) a person for use for insurance purposes in setting a rate, adjusting a rate, adjusting a claim, or underwriting, except that this paragraph may not be interpreted to authorize an insurance practice that is prohibited by other law; this paragraph may not be interpreted to affect AS 21.36.460 or AS 21.39.035.
(b) Except as provided by AS 45.48.190, the provisions of AS 45.48.100 - 45.48.290 do not apply to a person when acting only as a reseller of consumer information.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.220. Request by parent or legal guardian.

A parent, legal guardian, or conservator of a minor, incapacitated person, or protected person may make a request under AS 45.48.100 - 45.48.290 on behalf of a consumer who is the minor, incapacitated person, or protected person under the supervision of that parent, legal guardian, or conservator. If a consumer credit report does not exist at the time of a request under this section, the consumer credit reporting agency shall generate a consumer credit report for the purpose of placing a security freeze. In this section,
(1) “conservator” means a person appointed or qualified by a court to manage the property of an individual or a person legally authorized to perform substantially the same functions;
(2) “incapacitated person” has the meaning given in AS 47.24.900;
(3) “minor” means a child under 18 years of age who has not had the disabilities of a minor removed as described in AS 09.55.590;
(4) “protected person” has the meaning given in AS 13.27.490.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 2. Credit Report and Credit Score Security Freeze. › Sec. 45.48.290. Definitions.

In AS 45.48.100 - 45.48.290,
(1) “account review” means activities related to account maintenance, account monitoring, credit line increases, and account upgrades and enhancements;
(2) “consumer” means an individual who is the subject of a credit report or credit score;
(3) “consumer credit reporting agency” has the meaning given in AS 45.48.990, but does not include a person who issues reports
(A) on incidents of fraud or authorizations for the purpose of approving or processing negotiable instruments, electronic funds transfers, or similar methods of payments; or
(B) regarding account closures because of fraud, substantial overdrafts, automated teller machine abuse, or similar negative information regarding a consumer to inquiring banks or other financial institutions for use only in reviewing consumer requests for deposit accounts at the inquiring banks or financial institutions;
(4) “reseller of consumer information” means a person who assembles and merges information contained in the databases of consumer credit reporting agencies and does not maintain a permanent database of consumer information from which new consumer credit reports are produced;
(5) “security freeze” means a prohibition against a consumer credit reporting agency's releasing a consumer's credit report or credit score without the express authorization of the consumer;
(6) “third party” means a person who is not
(A) the consumer who is the subject of the consumer's credit report or credit score; or
(B) the consumer credit reporting agency that is holding the consumer's credit report or credit score.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.400. Use of social security number.

(a) A person may not
(1) intentionally communicate or otherwise make available to the general public an individual's social security number;
(2) print an individual's social security number on a card required for the individual to access products or services provided by the person;
(3) require an individual to transmit the individual's social security number over the Internet unless the Internet connection is secure or the social security number is encrypted;
(4) require an individual to use the individual's social security number to access an Internet website unless a password, a unique personal identification number, or another authentication device is also required to access the website; or
(5) print an individual's social security number on material that is mailed to the individual unless
(A) local, state, or federal law, including a regulation adopted under AS 45.48.470, expressly authorizes placement of the social security number on the material; or
(B) the social security number is included on an application or other form, including a document sent as a part of an application process or an enrollment process, sent by mail to establish, amend, or terminate an account, a contract, or a policy, or to confirm the accuracy of the social security number; however, a social security number allowed to be mailed under this subparagraph may not be printed, in whole or in part, on a postcard or other mailer that does not require an envelope, or in a manner that makes the social security number visible on the envelope or without the envelope's being opened.
(b) The prohibitions in (a) of this section do not apply if the person is engaging in the business of government and
(1) is authorized by law to communicate or otherwise make available to the general public the individual's social security number; or
(2) the communicating or otherwise making available of the individual's social security number is required for the performance of the person's duties or responsibilities as provided by law.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.410. Request and collection.

(a) A person who does business in the state, including the business of government, may not request or collect from an individual the individual's social security number. This subsection does not prohibit a person from asking for another form of identification from the individual.
(b) The prohibition in (a) of this section does not apply
(1) if the person is authorized by local, state, or federal law, including a regulation adopted under AS 45.48.470, to demand proof of the individual's social security number, to request or collect the individual's social security number, or to submit the individual's social security number to the local, state, or federal government;
(2) if the person is engaging in the business of government and
(A) is authorized by law to request or collect the individual's social security number; or
(B) the request or collection of the individual's social security number is required for the performance of the person's duties or responsibilities as provided by law;
(3) to a person subject to or a transaction regulated by the Gramm-Leach-Bliley Financial Modernization Act for a purpose authorized by the Gramm-Leach-Bliley Financial Modernization Act;
(4) to a person subject to or a transaction regulated by the Fair Credit Reporting Act for a purpose authorized by the Fair Credit Reporting Act;
(5) if the request or collection is for a background check on the individual, for fraud prevention, for medical treatment, for law enforcement or other government purposes, for the individual's employment, including employment benefits, or for verification of the individual's age;
(6) if the request or collection does not have independent economic value, is incidental to a larger transaction or a larger anticipated transaction, and is necessary to verify the identity of the individual;
(7) to an insurer regulated by AS 21; in this paragraph, “insurer” has the meaning given in AS 21.97.900; or
(8) to a hospital service corporation or a medical service corporation regulated under AS 21.87; in this paragraph, “hospital service corporation” and “medical service corporation” have the meanings given in AS 21.87.330.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.420. Sale, lease, loan, trade, or rental.

(a) A person may not sell, lease, loan, trade, or rent an individual's social security number to a third party.
(b) The prohibition in (a) of this section does not apply if the sale, lease, loan, trade, or rental is
(1) authorized by local, state, or federal law, including a regulation adopted under AS 45.48.470;
(2) by a person subject to or for a transaction regulated by the Gramm-Leach-Bliley Financial Modernization Act for a purpose authorized by the Gramm-Leach-Bliley Financial Modernization Act;
(3) by a person subject to or for a transaction regulated by the Fair Credit Reporting Act for a purpose authorized by the Fair Credit Reporting Act; or
(4) part of a report prepared by a consumer credit reporting agency in response to a request by a person and the person submits the social security number as part of the request to the consumer credit reporting agency for the preparation of the report.
(c) Nothing in this section prevents a business from transferring social security numbers to another person if the transfer is part of the sale or other transfer of the business to the other person.
(d) A transfer of an individual's social security number for the sole purpose of identifying a person about whom a report or database check is ordered, received, or provided is not a sale, lease, loan, trade, or rental of a social security number under this section.
(e) A person who knowingly violates (a) of this section is guilty of a class A misdemeanor. In this subsection, “knowingly” has the meaning given in AS 11.81.900.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.430. Disclosure.

(a) A person doing business, including the business of government, may not disclose an individual's social security number to a third party.
(b) The prohibition in (a) of this section does not apply if
(1) the disclosure is authorized by local, state, or federal law, including a regulation adopted under AS 45.48.470;
(2) the person is engaging in the business of government and
(A) is authorized by law to disclose the individual's social security number; or
(B) the disclosure of the individual's social security number is required for the performance of the person's duties or responsibilities as provided by law;
(3) the disclosure is to a person subject to or for a transaction regulated by the Gramm-Leach-Bliley Financial Modernization Act, and the disclosure is for a purpose authorized by the Gramm-Leach-Bliley Financial Modernization Act or to facilitate a transaction of the individual;
(4) the disclosure is to a person subject to or for a transaction regulated by the Fair Credit Reporting Act, and the disclosure is for a purpose authorized by the Fair Credit Reporting Act;
(5) the disclosure is part of a report prepared by a consumer credit reporting agency in response to a request by a person and the person submits the social security number as part of the request to the consumer credit reporting agency for the preparation of the report; or
(6) the disclosure is for a background check on the individual, identity verification, fraud prevention, medical treatment, law enforcement or other government purposes, or the individual's employment, including employment benefits.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.440. Interagency disclosure.

Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, a state or local governmental agency may disclose an individual's social security number to another state or local governmental agency or to an agency of the federal government if the disclosure is required in order for the agency to carry out the agency's duties and responsibilities.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.450. Exception for employees, agents, and independent contractors.

(a) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, a person may disclose an individual's social security number to an employee or agent of the person for a legitimate purpose established by and as directed by the person, but the employee or agent may not use the social security number for another purpose or make an unauthorized disclosure of the individual's personal information.
(b) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, and except as provided for an agent under (a) of this section, a person may disclose an individual's social security number to an independent contractor of the person to facilitate the purpose or transaction for which the individual initially provided the social security number to the person, but the independent contractor may not use the social security number for another purpose or make an unauthorized disclosure of the individual's personal information. In this subsection, “independent contractor” includes a debt collector.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.460. Employment-related exception.

The provisions of AS 45.48.400 - 45.48.480 may not be construed to restrict a person's use or exchange of an individual's social security number
(1) in the course of the administration of a claim, benefit, or procedure related to the individual's employment by the person, including the individual's termination from employment, retirement from employment, and injury suffered during the course of employment; or
(2) to check on an unemployment insurance claim of the individual.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.470. Agency regulations.

If regulations are necessary in order for a state agency to carry out the state agency's duties and responsibilities, a state agency may adopt regulations under AS 44.62 (Administrative Procedure Act) to establish when the state agency or a person regulated by the state agency may
(1) print an individual's social security number on material that is mailed to the individual;
(2) demand proof from an individual of the individual's social security number, collect from an individual the individual's social security number, or submit an individual's social security number to a local, state, or federal agency;
(3) ask an individual to provide the state agency with the individual's social security number;
(4) disclose an individual's social security number to a third party;
(5) sell, lease, loan, trade, or rent an individual's social security number to a third party.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 3. Protection of Social Security Number. › Sec. 45.48.480. Penalties.

(a) A person who knowingly violates AS 45.48.400 - 45.48.430 is liable to the state for a civil penalty not to exceed $3,000.
(b) An individual may bring a civil action in court against a person who knowingly violates AS 45.48.400 - 45.48.430 and may recover actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees.
(c) In this section, “knowingly” has the meaning given in AS 11.81.900.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.500. Disposal of records.

(a) When disposing of records that contain personal information, a business and a governmental agency shall take all reasonable measures necessary to protect against unauthorized access to or use of the records.
(b) Notwithstanding (a) of this section, if a business or governmental agency has otherwise complied with the provisions of AS 45.48.500 - 45.48.590 in the selection of a third party engaged in the business of record destruction, the business or governmental agency is not liable for the disposal of records under AS 45.48.500 - 45.48.590 after the business or governmental agency has relinquished control of the records to the third party for the destruction of the records.
(c) A business or governmental agency is not liable for the disposal of records under AS 45.48.500 - 45.48.590 after the business or governmental agency has relinquished control of the records to the individual to whom the records pertain.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.510. Measures to protect access.

The measures that may be taken to comply with AS 45.48.500 include
(1) implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of paper documents containing personal information so that the personal information cannot practicably be read or reconstructed;
(2) implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the personal information cannot practicably be read or reconstructed;
(3) after due diligence, entering into a written contract with a third party engaged in the business of record destruction to dispose of records containing personal information in a manner consistent with AS 45.48.500 - 45.48.590.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.520. Due diligence.

In AS 45.48.510(3), due diligence ordinarily includes performing one or more of the following:
(1) reviewing an independent audit of the third party's operations and its compliance with AS 45.48.500 - 45.48.590;
(2) obtaining information about the third party from several references or other reliable sources and requiring that the third party be certified by a recognized trade association or similar organization with a reputation for high standards of quality review; or
(3) reviewing and evaluating the third party's information security policies and procedures, or taking other appropriate measures to determine the competency and integrity of the third party.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.540. Exemptions.

(a) A business or a governmental agency is not required to comply with AS 45.48.500 - 45.48.530 if federal law requires that the business or governmental agency act in a way that does not comply with AS 45.48.500 - 45.48.530.
(b) A business is not required to comply with AS 45.48.500 - 45.48.530 if
(1) the business is subject to and in compliance with the Gramm-Leach-Bliley Financial Modernization Act; or
(2) the manner of the disposal of the records of the business is subject to 15 U.S.C. 1681w (Fair Credit Reporting Act) and the business is complying with 15 U.S.C. 1681w.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.550. Civil penalty.

(a) An individual, a business, or a governmental agency that knowingly violates AS 45.48.500 - 45.48.590 is liable to the state for a civil penalty not to exceed $3,000.
(b) In this section, “knowingly” has the meaning given in AS 11.81.900.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.560. Court action.

An individual who is damaged by a violation of AS 45.48.500 - 45.48.590 may bring a civil action in court to enjoin further violations and to recover for the violation actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 4. Disposal of Records. › Sec. 45.48.590. Definitions.

In AS 45.48.500 - 45.48.590,
(1) “business” means a person who conducts business in the state or a person who conducts business and maintains or otherwise possesses personal information on state residents; in this paragraph,
(A) “conducts business” includes engaging in activities as a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this state, another state, the United States, or another country;
(B) “possesses” includes possession for the purpose of destruction;
(2) “dispose” means
(A) the discarding or abandonment of records containing personal information;
(B) the sale, donation, discarding, or transfer of
(i) any medium, including computer equipment or computer media, that contains records of personal information;
(ii) nonpaper media, other than that identified under (i) of this subparagraph, on which records of personal information are stored; and
(iii) equipment for nonpaper storage of information;
(3) “governmental agency” means a state or local governmental agency, except for an agency of the judicial branch;
(4) “personal information” means
(A) an individual's passport number, driver's license number, state identification number, bank account number, credit card number, debit card number, other payment card number, financial account information, or information from a financial application; or
(B) a combination of an individual's
(i) name; and
(ii) medical information, insurance policy number, employment information, or employment history;
(5) “records” means material on which information that is written, drawn, spoken, visual, or electromagnetic is recorded or preserved, regardless of physical form or characteristics, but does not include publicly available information containing names, addresses, telephone numbers, or other information an individual has voluntarily consented to have publicly disseminated or listed.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.600. Factual declaration of innocence after identity theft.

(a) A victim of identity theft may petition the superior court for a determination that the victim is factually innocent of a crime if
(1) the perpetrator of the identity theft was arrested for, cited for, or convicted of the crime using the victim's identity;
(2) a criminal complaint was filed against the perpetrator of the identity theft; and
(3) the victim's identity was mistakenly associated with a record of a conviction for a crime.
(b) In addition to a petition by a victim under (a) of this section, the department may petition the superior court for a determination under (a) of this section, or the superior court may, on its own motion, make a determination under (a) of this section.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.610. Basis for determination.

A determination of factual innocence under AS 45.48.600 may be heard and made on declarations, affidavits, police reports, or other material, relevant, and reliable information submitted by the parties or ordered to be made a part of the record by the court.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.620. Criteria for determination; court order.

(a) A court may determine that a petitioner under AS 45.48.600 is factually innocent of a crime if the court finds beyond a reasonable doubt that
(1) the petitioner is a victim of identity theft;
(2) the petitioner did not commit the offense for which the perpetrator of the identity theft was arrested, cited, or convicted;
(3) the petitioner filed a criminal complaint against the perpetrator of the identity theft; and
(4) the petitioner's identity was mistakenly associated with a record of conviction for the crime.
(b) If a court finds under this section that the victim is factually innocent of a crime, the court shall issue an order indicating this determination of factual innocence and shall provide the victim with a copy of the order.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.630. Orders regarding records.

After a court issues an order under AS 45.48.620, the court may order the name and associated personal information of the victim of identity theft that is contained in the files, indexes, and other records of the court that are accessible by the public labeled to show that the name and personal information of the victim of identity theft is incorrect.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.640. Vacation of determination.

A court that has issued an order under AS 45.48.620 may, at any time, vacate the order if the petition, or any information submitted in support of the petition, is found to contain a material misrepresentation, an omission, or false information.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.660. Database.

The department may establish and maintain a database of individuals who have been victims of identity theft and who have received an order under AS 45.48.620. The department shall provide a victim or the victim's authorized representative access to a database established under this section to establish that the individual has been a victim of identity theft. Access to the database established under this section is limited to criminal justice agencies, victims of identity theft, and individuals and agencies authorized by the victims.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.670. Toll-free telephone number.

The department may establish and maintain a toll-free telephone number to provide access to information in a database established under AS 45.48.660.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.680. Right to file police report regarding identity theft.

(a) Even if the local law enforcement agency does not have jurisdiction over the theft of an individual's identity, if an individual who has learned or reasonably suspects the individual has been the victim of identity theft contacts, for the purpose of filing a complaint, a local law enforcement agency that has jurisdiction over the individual's actual place of residence, the local law enforcement agency shall make a report of the matter and provide the individual with a copy of the report. The local law enforcement agency may refer the matter to a law enforcement agency in a different jurisdiction.
(b) This section is not intended to interfere with the discretion of a local law enforcement agency to allocate its resources to the investigation of crime. A local law enforcement agency is not required to count a complaint filed under (a) of this section as an open case for purposes that include compiling statistics on its open cases.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 5. Factual Declaration of Innocence after Identity Theft; Right to File Police Report Regarding Identity Theft. › Sec. 45.48.690. Definitions.

In AS 45.48.600 - 45.48.690,
(1) “crime” has the meaning given in AS 11.81.900;
(2) “department” means the Department of Law;
(3) “perpetrator” means the person who perpetrated the theft of an individual's identity;
(4) “victim” means an individual who is the victim of identity theft.
2023 Alaska Statutes › Title 45. Trade and Commerce › Chapter 48. Personal Information Protection Act › Article 6. Truncation of Card Information. › Sec. 45.48.750. Truncation of card information.

(a) A person who accepts credit cards or debit cards for the transaction of business may not print more than the last four digits of the card number or the expiration date on any receipt or other physical record of the transaction provided at the point of the sale or transaction.
(b) This section applies only to receipts that are electronically printed and does not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card.
(c) A person may not sell a device that electronically prints more than the last four digits of a credit card or debit card number or expiration date on a consumer receipt for a business transaction or on a copy retained by a business person for a business transaction.
(d) An individual may bring a civil action in court against a person who knowingly violates (a) of this section and may recover actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees.
(e) A person who knowingly violates this section is liable to the state for a civil penalty not to exceed $3,000.
(f) In this section,
(1) “credit” means the right granted by a creditor to a debtor to defer payment of debt, to incur debts and defer payment of the debt, or to purchase property or services and defer payment of the purchase; in this paragraph, “creditor” means a person who regularly extends, renews, or continues credit, a person who regularly arranges for the extension, renewal, or continuation of credit, or an assignee of an original creditor who participates in the decision to extend, renew, or continue credit;
(2) “credit card” means a card, plate, coupon book, or other credit device existing for the purpose of obtaining money, property, labor, or services on credit;
(3) “debit card” means a card issued by a financial institution to a consumer for use in initiating an electronic fund transfer from the account of the consumer at the financial institution for the purpose of transferring money between accounts or obtaining money, property, labor, or services;
(4) “knowingly” has the meaning given in AS 11.81.900.