As we reported, there are a number of signs pointing to a significant tightening of regulation and increased enforcement of data security mandates. Following efforts in New Jersey, New York and Oregon, Indiana Attorney General Greg Zoeller announced his office is seeking legislation that would better protect the online personal and financial information of Indiana residents. Indiana State Sen. Jim Merritt plans to sponsor the legislation during the 2015 session of the Indiana General Assembly.

The Attorney General proposes a three-pronged approach to increasing security – (i) stricter requirements for the safe storage of sensitive data, (ii) reducing harm to consumers following a data breach, and (iii) increasing transparency of online privacy policies. In proposing stricter requirements for storing sensitive data, Attorney General Zoeller’s approach would include a requirement to delete and not retain the data beyond what is necessary for business purposes. Effective and efficient record retention and destruction policies and procedures present significant challenges for businesses, but as new laws like this emerge, companies will need to get better about keeping only what they need, and making sure what is deleted is really deleted.  The proposal also includes requirements for businesses to share or sell information only when authorized by law or when consumers are informed in advance, and to inform consumers by conspicuous notice when data must be collected and how long it will be stored.

The Hoosier state already has a data breach notification law, however, the Attorney General wants to make notice under the law more timely and informative. Additionally, his proposal would extend the notification mandate to breaches of paper and handwritten records. Like the breach notification laws in many other states, the Indiana law applies only to electronically generated or computerized records.

If the third item in the proposal becomes law, Indiana would join California in requiring website operators and online entities that collect personal or financial information from state residents to conspicuously post their privacy policies online. The policies would need to identify what personal information the site collects from site visitors and whether the operator of the site shares or sells any of that information, and with whom.

We will be following this and other developments of this kind in the year ahead. However, we recommend businesses be more proactive in taking steps to safeguard and management personal information. These steps should go beyond the IT department and include administrative and physical safeguards to protect data in all forms, including paper documents. Additionally, data security is only one of a number of important reasons for a rigorous record retention and destruction policy. These include the development of more efficient data management practices, keeping data storage costs down, and controlling e-discovery costs.