What is the Fair and Accurate Credit Transactions Act?
In December 2003, the federal government passed the Fair and Accurate Credit Transactions Act of 2003 (FACTA), an expansive new law that affects various aspects of consumer credit.
The FACTA Disposal Rule
Under FACTA, certain federal agencies were required to create regulations designed to minimize the risk of identity theft and consumer fraud by enforcing the proper destruction of consumer information. One of the resulting regulations, known as the Disposal Rule, was issued by the Federal Trade Commission in November 2004. Identical rules adopted by the federal banking agencies and the Securities and Exchange Commission now apply to organizations regulated under their authority.
Effective June 1, 2005, the Disposal Rule states that any person who maintains or otherwise possesses consumer information* for a business purpose is required to properly dispose of the information, whether in electronic or paper form, by "taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal."
Reasonable measures include:
(1) Paper records - Implementing and monitoring compliance with policies and procedures that requires the shredding, burning, pulverizing of papers containing consumer information so that the information cannot be easily read or reconstructed.
(2) Electronic records - Implementing and monitoring compliance with policies and procedures that requires the destruction or erasure of electronic media containing consumer information so that the information cannot be easily read or reconstructed.
(3) Due Diligence & Contracts - After due diligence, entering into and monitoring compliance with a written contract with another party engaged in the business of record destruction to dispose of consumer information in a manner consistent with this rule.
The Cost of Non-Compliance
Violation claims can be brought within two years from discovery of the violation or five years from the actual violation. In addition to the severe penalties and fines that federal or state agencies can levy upon violators, companies charged with FACTA Disposal Rule non-compliance run the risk of negative publicity and irreparable damage to their corporate reputation.
To educate businesses about the new requirements of the Disposal Rule, the FTC has issued a new publication, “New Rule Seeks to Protect Privacy by Requiring Proper Disposal of Sensitive Consumer Information,” available at: www.ftc.gov/bcp/conline/pubs/alerts/disposalalrt.htm
The FTC's Disposal Rule was published in the Federal Register on November 24, 2004 [69 Fed Reg 68690. A copy of the final Rule is available for review at: www.ftc.gov/os/2004/11/041118disposalfrn.pdf
*Consumer information is defined as any record about an individual that is a consumer report, or is derived from a consumer report, including compilations of such records.
|
