Identity theft is a growing concern, and employees and employers are by no means exempt from that concern. In an attempt to stem the tide of identity theft, Governor George Pataki of New York signed into law the Disposal of Personal Records Act ("the Act"). The Act will take effect in December 2006.

Under the Act, employers will be required to take special care when disposing of any employee records containing "personal information." It does not change employers' obligations with respect to retaining records in accordance with applicable laws and regulations. Personal information is defined in the Act as including any information that could be used to identify an individual, such as: name, Social Security number, driver's license number, identification card number, mother's maiden name, any financial account number or codes, or any other personal identification number.

Before disposing of any record that contains such personal information about an employee, employers must do one of four things: (1) shred the record; (2) destroy the personal information contained in the record; (3) modify the record to make the personal information unreadable; or (4) take other actions, consistent with accepted industry practices, that the employer reasonably believes will ensure that no unauthorized person will have access to the personal information. If an employer fails to take the required steps before disposing of employees' records containing personal information, the Act provides for injunctive relief and imposes a penalty of up to $5,000 per occurrence.

While the Act will only apply to New York employers, the standards it sets forth represent good business practices. As such, all employers would be well-served to review internal procedures for storage and disposal of personal information.