Sec. 1. 10 MRSA c. 228 is enacted to read:

CHAPTER 228

CONSUMER RECORDS

§1500-G.__Disposal

1.__Definitions.__As used in this chapter, unless the context otherwise indicates, the following terms have the following meanings.

A.__"Destroy" means to shred, erase or otherwise modify information or records to make the information or records unreadable or undecipherable by reasonable means.

B.__"Entity" means a sole proprietor, partnership, corporation, limited liability company, trust, association, financial institution, government unit or any other individual or group.

C.__"Person" means a natural person, or if that person is under legal guardianship, the parent or duly appointed guardian of that person.

D.__"Personal information" means information that identifies a person and that is commonly used for financial or health care purposes, including account numbers, access codes, passwords, credit card numbers or information gathered for security purposes, account access, transaction initiation or medical history or status.

E.__"Personal identification number" means an identification number issued by a government unit that is protected and not available to the public and includes a tax identification number, social security number, driver's license or permit number and professional or business license number.

F.__"Record" means any material in any physical form on which information is recorded or preserved by any means, including written, spoken, graphically depicted, printed or electronically stored or transmitted material. "Record" does not include a publicly available document or directory containing information that a person has voluntarily consented to have publicly disseminated.

2.__Disposal.__An entity must destroy or arrange for the destruction of__personal information and a personal