FTC Issues Final Regulation on Consumer Information and Records Disposal

Following a public comment period, the Federal Trade Commission has issued its final rule regarding the proper disposal of consumer report information and records under the Fair and Accurate Credit Transactions Act of 2003 (FACTA) and the Fair Credit Reporting Act (FCRA). The final rule, which will be published in the Federal Register shortly, is similar to the proposed rule issued in April 2004 and will become effective on June 1, 2005. The Commission received more than 50 comments from industry trade organizations, businesses, consumer advocacy groups, Members of Congress, and consumers.

FACTA, which was enacted on December 4, 2003, amends the FCRA and directs the FTC, the Federal Reserve Board, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, the National Credit Union Administration, and the Securities and Exchange Commission to coordinate with one another to adopt comparable and consistent rules regarding the disposal of sensitive consumer report information. The purpose of these rules is to reduce the risk of identity theft and other consumer harm from improper disposal of a consumer report or any record derived from one. The FTC’s Disposal Rule applies to any person over which the FTC has jurisdiction that, for a business purpose, maintains or otherwise possesses such consumer report information.

The Rule requires that covered entities “take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” The standard for disposal is flexible to allow entities covered by the Rule to determine what measures are reasonable based on the sensitivity of the information, the costs and benefits of different disposal methods, and relevant changes in technology over time. The Rule’s flexibility should also facilitate compliance for smaller entities. Additionally, the Rule includes specific examples of appropriate measures that would satisfy its disposal standard.

The final Rule makes minor modifications to the proposed Rule, including clarification of the definitions of “consumer information” and “disposal.”

The Commission vote approving the final rule and the publication of the Federal Register notice was 5-0.

Copies of the Federal Register notice are available from the FTC’s Web site at http://www.ftc.gov and also from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, DC 20580. The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint, or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1 877-382-4357), or use the complaint form at http://www.ftc.gov. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

(FTC File No. R411007)