134.97(2) Disposal of records containing personal information. –
A financial institution, medical business or tax preparation business may not dispose of a record containing personal information unless the financial institution, medical business, tax preparation business or other person under contract with the financial institution, medical business or tax preparation business does any of the following:
(a) Shreds the record before the disposal of the record.
(b) Erases the personal information contained in the record before the disposal of the record.
(c) Modifies the record to make the personal information unreadable before the disposal of the record.
(d) Takes actions that it reasonably believes will ensure that no unauthorized person will have access to the personal information contained in the record for the period between the record’s disposal and the record’s destruction.