Buying commercial real estate at foreclosure can be an exciting investment opportunity—but it can also come with unexpected legal responsibilities. One of the most overlooked risks? Finding personal or sensitive records left behind by the previous business owner.
It’s not uncommon to walk into a foreclosed commercial property and discover boxes of old customer files, employee documents, or financial records. Names, Social Security numbers, driver’s license copies, banking details—you name it.
So what do you do with them?
If you think you can just rent a dumpster and toss them out, think again.
Under Massachusetts law, improper disposal of personal information can result in civil penalties of up to $50,000 per incident, and potential lawsuits if that data is compromised.
Let’s break down what the law says, what your responsibilities are, and how to protect yourself after taking over a property that contains sensitive records.
Why This Matters: Real Case, Real Risk
A recent client of mine purchased a foreclosed commercial property. While inspecting the building, he found multiple boxes of customer records—complete with full names, Social Security numbers, and even bank account information.
His first instinct? “Let’s just get a dumpster.”
Had he done that, he could have been hit with substantial fines—and worse, liability for any identity theft that occurred as a result.
Instead, we followed the law, hired a professional shredding company, and documented everything. No fines. No exposure.
What the Law Requires in Massachusetts
- Massachusetts General Laws Chapter 93I: The Disposal of Records Statute
Chapter 93I requires that any person who has custody or control of records containing personal information must destroy them in a manner that ensures the data cannot be read or reconstructed.
Acceptable methods include:
- Shredding
- Pulverizing
- Incinerating
- Secure erasure of digital media
Importantly, the law applies regardless of whether you created the records or used them in the course of your own business. If you have them, you’re responsible for destroying them properly.
Violating Chapter 93I can result in civil penalties of up to $100 per person affected, capped at $50,000 per incident. The Attorney General can bring legal action, and victims of identity theft may pursue negligence claims.
- 201 CMR 17.00: Standards for the Protection of Personal Information
This regulation requires any person who “owns or licenses” personal information about Massachusetts residents to maintain a comprehensive written information security program (WISP).
The definition of “owning or licensing” is broad and includes anyone who:
- Receives
- Stores
- Maintains
- Processes
- Or otherwise has access to personal data
Even if the data was left behind by a prior tenant or owner, the moment you take possession, you may fall under this regulation’s scope.
Best Practices for Handling Sensitive Records After Foreclosure
If you take over a property and discover personal records, follow these steps immediately:
- Secure the Records
Place the documents in a locked room or filing cabinet. Only allow access to trusted individuals. This protects you from unauthorized disclosure and limits potential liability.
- Contact a Certified Document-Destruction Vendor
Hire a reputable shredding company. Ideally, they should:
- Shred the documents on-site under your supervision, or
- Transport them under seal with a documented chain of custody
- Obtain a Certificate of Destruction
This is your proof that you handled the disposal properly. It should include:
- The date of destruction
- Method used
- Volume of material destroyed
Keep the certificate in your permanent records along with any correspondence or legal guidance you received.
Why You Can’t Just “Dump It”
Improper disposal of personal records isn’t just sloppy—it’s a legal risk. Dumpster-diving and data theft are real concerns, and regulators take data breaches seriously.
Even if you didn’t create the records, Massachusetts law says you’re now in control of them. That means you are on the hook if anything goes wrong.
Final Thoughts
Buying a foreclosed property can unlock a great investment—but it also comes with hidden legal obligations.
If you discover sensitive documents at the site, the best course of action is to treat them as your own: secure them, destroy them properly, and document the process.
Don’t assume that because you didn’t create the records, you have no responsibility. Massachusetts law disagrees.
Have questions about your obligations as a property owner or landlord? Our firm regularly helps clients navigate real estate purchases, data privacy laws, and post-foreclosure cleanouts.
Contact Cote Law Group today to make sure you’re protected.
Disclaimer:
This article is for informational purposes only and does not constitute legal advice. To discuss how these laws apply to your specific situation, please consult directly with an attorney.