Can I use third-party cloud storage services that collect personal information in North Carolina? What are the requirements?

Third-Party Cloud Storage Services and Personal Information in North Carolina

Yes, you can use third-party cloud storage services that collect personal information in North Carolina, but you must ensure that the service provider takes reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal, as required by NCGS 75-64[a].

The reasonable measures must include implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the information cannot practicably be read or reconstructed, as well as describing procedures relating to the adequate destruction or proper disposal of personal records as official policy in the writings of the business entity, as required by NCGS 75-64[b][2-3].

Additionally, a disposal business that conducts business in North Carolina or disposes of personal information of residents of North Carolina must take all reasonable measures to dispose of records containing personal information by implementing and monitoring compliance with policies and procedures that protect against unauthorized access to or use of personal information during or after the collection and transportation and disposing of such information, as required by NCGS 75-64[d].

If you are considering using a third-party cloud storage service, you may enter into a written contract with, and monitor compliance by, another party engaged in the business of record destruction to destroy personal information in a manner consistent with NCGS 75-64, after due diligence, which should ordinarily include reviewing an independent audit of the disposal business’s operations or its compliance with this statute or its equivalent, obtaining information about the disposal business from several references or other reliable sources and requiring that the disposal business be certified by a recognized trade association or similar third party with a reputation for high standards of quality review, or reviewing and evaluating the disposal business’s information security policies or procedures or taking other appropriate measures to determine the competency and integrity of the disposal business, as required by NCGS 75-64[c].

Publication of Personal Information

It is a violation of NCGS 75-66 for any person to knowingly broadcast or publish to the public on radio, television, cable television, in a writing of any kind, or on the Internet, the personal information of another with actual knowledge that the person whose personal information is disclosed has previously objected to any such disclosure. Personal information includes a person’s first name or first initial and last name in combination with any of the following information: social security or employer taxpayer identification numbers, drivers license, state identification card, or passport numbers, checking account numbers, savings account numbers, credit card numbers, debit card numbers, personal identification (PIN) code, digital signatures, any other numbers or information that can be used to access a person’s financial resources, biometric data, fingerprints, and passwords.

Conclusion

In summary, you can use third-party cloud storage services that collect personal information in North Carolina, but you must ensure that the service provider takes reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal, as required by NCGS 75-64[a]. You may also enter into a written contract with a disposal business to destroy personal information in a manner consistent with NCGS 75-64, after due diligence, as required by NCGS 75-64[c]. It is a violation of NCGS 75-66 to knowingly broadcast or publish personal information of another with actual knowledge that the person whose personal information is disclosed has previously objected to any such disclosure.

Jurisdiction

North Carolina

• Privacy