The Fact Act's Document Disposal Rule

What it means to the credit professional and consumer

The Fair and Accurate Credit Transaction Act of 2003, or commonly referred to as the Fact Act, amended the Fair Credit Reporting Act. The Fact Act was signed into law by President George W. Bush on December 4, 2003.

The Fact Act is primarily aimed at providing consumers with more options to protect and monitor their credit. The Fact Act spills over to businesses obtaining, storing, using and now disposing of consumer credit reports. We shall scrutinize how the recently effective disposal rule of the Fact Act impacts individuals and businesses.

Overview of the Fact Act

The Fact Act was passed because consumer reporting agencies have assumed a vital role in assembling and evaluating consumer credit information. Congress recognized a need to make sure that consumer reporting agencies exercise their responsibilities with fairness, impartiality, and respect a consumer’s right to privacy by safeguarding private financial information. The Fact Act is available at www.ftc.gov/ os/2004/11/041118disposalfn.pdf.

The Disposal Rule is one of several new requirements intended to combat consumer fraud and identity theft and protect privacy. Proper destruction of confidential consumer data makes good economic sense for both consumers and businesses. In a study released by the FTC, nearly 10 million Americans were the victims of identity theft in 2002 alone. The study also found that United States businesses lost $47 billion and consumers lost approximately $5 billion as a result of identity theft during 2002.

The Fact Act’s Document Disposal Rule

The Fact Act’s disposal rule is one of the key provisions in the Fact Act. As of June 1, 2005, businesses and individuals must be in compliance by both adopting and implementing their own document destruction policy or contract with an approved document destruction company.

1. What Are Consumer Reports and Other Key Terms

Before scrutinizing the Fact Act’s disposal rule there are a few key terms which must be defined. First, the disposal rule applies to consumer reports or the sensitive information derived from consumer reports; but what are “Consumer Reports?”

The Fact Act defines a Consumer Report as information obtained from a consumer reporting company that is used or expected to be used in establishing a consumer’s eligibility for credit, employment or insurance. Consumer Reports include credit reports, credit scores, asset searches, check writing history, residential or tenant history and even medical history. The Disposal Rule attempts to protect information on the Consumer Report such as social security numbers, birth dates, addresses, and phone numbers.

Another term which must be defined is disposal. The FTC defines disposal as the discarding or abandonment of Consumer Reports, and the sale, donation or transfer of any medium including computer equipment on which Consumer Reports are stored.

2. Who Must Comply With The Disposal Rule

The Disposal Rule applies to the government, individuals, large and small organizations; basically any person or entity which uses a Consumer Report. Entities which use Consumer Report for example are consumer reporting companies, lawyers, mortgage brokers, landlords, government agencies, car dealers, private investigators, credit card companies, banks and debt collectors. The FTC recommends that those who use any records containing a consumer’s personal or financial information to take similar protective measures.

3. Requirements and Procedures

The Disposal Rule requires disposal methods that are designed to prevent the unauthorized access to the information contained in the Consumer Report. The Disposal Rule’s standards for the proper disposal of Consumer Reports are flexible. This allows for individuals and organizations to determine the most cost effective manner in which to dispose of the Consumer Reports. The Disposal Rule applies to electronic data storage devices as well.

Options for the disposal of Consumer Reports include burning, redacting, pulverizing and shredding. The FTC recommends those who shred documents use shredders which result in chips, and not strips. Traditional strip shredders create 15 pieces that can be reassembled. While it is time consuming to find each strip and then put the document back together again, it does happen. Traditional strip shredders may not be a method which prevents the unauthorized access to information contained on the Consumer Report.

If an individual or entity hires a document disposal company, they must obtain references for the disposal company, proper certification from a trade association and conduct an independent audit of the disposal companies operations.

4. Penalties for Violation of the Disposal Rule

The FTC and state attorney generals may sue and win penalties for violating the Disposal Rule including actual damages, statutory damages up to $1,000 punitive damages per violation, attorney’s fees, and civil penalties up to $2,500.

What Does the Disposal Rule Mean to Credit Professionals

Credit professionals evaluating whether to sell goods on credit to sole proprietors, partnerships and limited liability companies usually obtain the personal credit and asset reports of the individual owners of these entities. These reports are Consumer Reports; as of June 1, 2005, the disposal of these Consumer Reports is governed by the Fact Act’s Disposal Rule. Credit Professionals must implement a disposal plan which ensures the information contained in the Consumer Reports is destroyed properly.

Conclusion

The Fact Act's Disposal Rule not only makes good economic sense for both consumers and businesses, but it will help to combat the growing crime of identity theft. No individual or company desires to be the source of another's personal information falling into the wrong hands. Identity theft costs all of us money in the long run. Hopefully the Fact Act's Disposal Rule will close a long used avenue for unscrupulous individuals to obtain the private information of consumers.