(a) Definitions. — (1) “Personal identifying information” means an employee's first name or first initial and last name in combination with any 1 of the following data elements that relate to the employee, when either the name or the data elements are not encrypted:
(2) “Record” means information that is inscribed on a tangible medium, or that is stored in an electronic or other medium and is retrievable in perceivable form on which personal identifying information is recorded or preserved. “Record” does not include publicly available directories or sources containing information an employee has voluntarily consented to have publicly disseminated or listed or which is disseminated as provided for by applicable law or regulation, such as name, address, or telephone number, or other directories or sources as are derived solely from such directories or sources.
(b) In the event that an employer seeks permanently to dispose of records containing employees' personal identifying information within its custody and control, such employer shall take all reasonable steps to destroy or arrange for the destruction of each such record by shredding, erasing, or otherwise destroying or modifying the personal identifying information in those records to make it unreadable or indecipherable.
(c) An employee who incurs actual damages due to a reckless or intentional violation of this section may bring a civil action against the employer.