Articles

Disposal Regulation Now in Effect

On June 1, 2005, the new federal “Disposal Regulation” went into effect.  This regulation requires any person or business that maintains or possesses information on a person which is derived from a “consumer report” to take appropriate measures to protect against the unauthorized access to or use of the information in connection with its disposal.  The purpose of this regulation is to reduce the risk of consumer fraud and identity theft created by the improper disposal of consumer information.  A “consumer report” is a report which contains information about a consumer’s personal and credit character, general reputation, and/or lifestyle.

To illustrate how to comply with the new Disposal Regulation, consider the following example.  An employer has an agency run a background check on an applicant which includes a credit report.  After the employer has reviewed the credit report and it is no longer needed, under the new regulation, the employer may not simply throw the credit report in the garbage.  The employer must destroy the information so that another person cannot read or reconstruct the information.  The regulation gives several examples of how to destroy the information, which includes burning, pulverizing, and shredding.

The Disposal Regulation also applies to electronic media.  To continue our example, if the employer transfers information it learned from the consumer report onto an electronic database (or the consumer report was given to the employer as an electronic file), once that information is no longer needed, the employer must dispose of the information so that the information cannot be read or reconstructed by an unauthorized individual.  The disposal methods recommended include the physical destruction of the electronic media, erasing the electronic media, or both.

For larger businesses or employers that utilize outside sources to store and dispose of documents, the business may continue to utilize such outside sources.  However, the business now must actively monitor the outside source.  This monitoring may include independent audits, requiring certification, checking references and reviewing and evaluating the outside source’s security policies and procedures to ensure that the consumer information is disposed of properly.

If you have questions or concerns about the Disposal Regulation and how it may affect you or your business, please contact us.