Document Destruction Rule Effective in June

The Federal Trade Commission recently announced the final rule addressing the proper disposal of consumer reports or any record derived from a consumer report. The Disposal Rule, as it is named, is a provision of the Fair and Accurate Credit Transactions Act of 2003 that was designed to help reduce identity theft.

The new rule is similar to the proposed rule the FTC issued in April 2004 and will become effective on June 1, 2005.

“This requirement will help to ensure that sensitive consumer information, including Social Security numbers, is not simply left in a trash dumpster, for instance, once a business no longer needs the information,” said FTC director Howard Beales in a written statement.

The Disposal Rule applies to any person who, for business purposes, possesses or maintains consumer report information. “Any person” includes mortgage brokers, employers, insurers or any other business regardless of industry or size that performs such activity, according to text of the Federal Register notice where the final rule was published.

“Disposal” is defined as “the discarding or abandonment of consumer information, or the sale, donation, or transfer of any medium, including computer equipment, upon which consumer information is stored,” the text read.

FACTA amends the Fair Credit Reporting Act and directs the FTC, the Federal Reserve Board, the Office of the Comptroller of the Currency, the FDIC, the Office of Thrift Supervision, the National Credit Union Administration, and the SEC to coordinate with one another to adopt comparable and consistent rules regarding the disposal of sensitive consumer report information, the announcement said.

While the Disposal Rule does not impose any specific reporting, recordkeeping, or disclosure requirements, it does require that covered entities “take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” The standard for disposal is flexible to allow entities of varying nature and size to determine what measures are reasonable based on the sensitivity of the information, the costs and benefits of different disposal methods, and relevant changes in technology over time.

Examples the FTC provided of “reasonable measures” were: Implementing policies and procedures that require the burning, pulverizing, or shredding of papers, or destruction or erasure of electronic media, containing consumer information so that the information cannot practicably be read or reconstructed; entering into and monitoring compliance with a contract with a business of record destruction to dispose of material, specifically identified as consumer information, in a manner consistent with this rule.

The FTC said that while some business will need to educate and train their employees on proper disposal, it “believes many businesses may already be following industry best practices, which may include disposing of documents through shredders, using waste disposal companies, or other confidential disposal methods; and continuing to do so would not impose additional costs on such businesses.”

For small companies not already subject to the Safeguards Rule of the Gramm-Leach Biley Act of 1999, compliance costs may be greater.

Mortgage companies subject to the Safeguards Rule are already required to develop and implement policies for proper disposal of customers’ nonpublic personal information, and requires employee training programs and mechanisms to update its information security program on a periodic basis, according to the text. The Safeguards Rule specifically applies to financial institutions and covers the proper disposal of mortgage applications as they are not a consumer report and are not derived from one, FTC attorney Ellen Finn said.