Businesses Will Be Required To Properly Dispose of Sensitive Consumer Information
Washington, D.C. – November, 2004 – The Federal Trade Commission (FTC) has issued a new rule that will require local Washington businesses to properly dispose of and destroy sensitive consumer data. The rule is one of several new requirements intended to combat consumer fraud and identity theft and protect privacy required by the federal Fair and Accurate Credit Transactions Act (FACT Act) which was enacted in December 2003.
The new FACT Act Disposal Rule, issued on Thursday, broadly covers “any record about an individual, whether in paper, electronic, or other form that is a consumer report (also known as a credit report) or is derived from a consumer report.” It requires any person or company that possesses or maintains such information to take “reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.”
“There is no reason that a stack of customer files containing credit reports should be sitting in a dumpster in the Washington Metro area, easily accessible to just about anyone,” said Jennifer Pratt of Coast2Coast Shredding. “This rule will force banks, retailers, auto dealers and any other business throughout our region that obtain credit reports, or related personal information, to shred those documents before throwing them away.”
According to a study released by the FTC in September 2003, nearly 10 million Americans were the victims of identity theft in the previous year alone. The study also found that U.S. businesses lost $47 billion and consumers lost approximately $5 billion as a result of identity theft during the same period.
“This new rule is an important step forward in the fight against consumer fraud and identity theft. Shredding documents and properly destroying computer files and hard drives will help ensure that records containing sensitive personal and financial information don’t fall into the wrong hands,” said Robert Johnson, executive director of the National Association for Information Destruction (NAID). “It’s important for the business community to understand that this law applies to nearly every business and private employer in the U.S.”
The new rule provides examples of how to comply with the new requirements, including:
- mplementing and monitoring compliance with policies and procedures that require shredding or other forms of destruction of documents and electronic media containing consumer information; and
- Contracting with a third party to properly dispose of consumer information and monitoring their performance.
The FACT Act Disposal Rule applies to virtually every business and private employer in the U.S. The rule requires these businesses to come into compliance by June 1, 2005 by both adopting and implementing their own document destruction policies or by contracting with a document shredding company or other data destruction company to do so. Penalties for violating the rule include actual damages, statutory damages up to $1,000 punitive damages per violation (with no cap on class action damages), attorneys’ fees, and civil penalties up to $2,500. Click here (Insert link – http://www.ftc.gov/) for more information about the rule and business compliance requirements.
Click here for:
FTC FACTA Disposal Rule Analysis
A comprehensive analysis of the FTC’s re FACTA Disposal Rule which will become law on June 1, 2005.
The National Association for Information Destruction (NAID) is the international trade association for companies providing information destruction services. Suppliers of products, equipment and services to destruction companies are also eligible for membership. NAID’s mission is to promote the information destruction industry and the standards and ethics of its member companies.