The FTC's latest FACTA rule requires any business "that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose" to "properly dispose of such information or compilation." FACTA and the new rule are supposed to cut down on the incidences of identity theft by restricting the ability of thieves to go "dumpster diving" for consumer information contained in casually discarded business records.

A key term in the new FACTA rule is “consumer information”:  any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report.

Any company that copies, uses or incorporates any information from a consumer credit report or employee background report, whether created internally or obtained from an outside agency, is subject to FACTA disposal rules.

The safest policy for businesses to adopt is to consider all their records containing consumer information to be part of their safe storage and disposal policy, even if not all their records technically fall under the definition of consumer information as defined by FACTA.

Acceptable FACTA Disposal Methods

Another key to FACTA compliance is to understand what constitutes "disposal" of any consumer information covered by FACTA.  The FACTA rule does not mandate specific disposal measures, rather it relies upon a reasonableness clause as it pertains to business operations and resources.

FACTA does indicate that "reasonable measures are very likely to require elements such as the establishment of policies and procedures governing disposal, as well as appropriate employee training."

FACTA Liability

To insure compliance, FACTA provides for a range of civil liabilities and penalties for noncompliance.  In addition to regulatory penalties of $2500 per incident,  business that fails to comply with the FACTA rules can be liable for actual damages in a civil lawsuit brought by anyone whose identity is stolen as a result.  The new rule also allows the elevation of civil suits to class action status.

Contracting for Disposal Services

If a business decides to outsource the disposal, then the FACTA rule requires the business to "take reasonable steps to select and retain a service provider that is capable of properly disposing of the consumer information at issue; notify the service provider such information is consumer information; and enter into a contract that requires the service provider to dispose of such information in accordance with the Rule."

Business Review

By June 1, 2005 every business that may fall under the new FACTA rule should address the following issues:

1. Does my business create or handle consumer information that is covered under the FACTA rule?
2. Do my current record retention and disposal policies properly address the new FACTA requirements?
3. What policy and procedural changes are necessary to comply with the new FACTA rule?
4. Have I determined that my choice of destruction methods meets the reasonableness requirement?
5. If I choose to outsource the destruction, have I complied with the contractual and contractor requirements in FACTA?

The Disposal Problem for Companies

Organizations that routinely process volumes of credit and consumer information in multiple locations faces the expense of contracting and managing one or more vendors with a service call charge to each location.

Additional cost arises from having to implement a regular service schedule without the flexibility of servicing according to periods of high or low demand.  For example during quarterly “purges” the bin will overflow, requiring a phone call to the company to make an additional service call.

A company could opt to purchase and service a legion of paper shredders.  The equipment cost added to the hourly employee expense to shred paper is significant.  More importantly, no record exists to document the actual destruction being done on a regular basis, opening the possibility to liability under the FACTA rule.