The FTC's Disposal Rule Requires Businesses and Employers to Properly Dispose of Consumer and Employee Records

Effective June 1, 2005, pursuant to the Federal Trade Commission's ("the FTC") Disposal Rule enacted under the federal Fair and Accurate Credit Transactions Act ("FACT Act"), businesses will be required to properly destroy or erase all consumer information that is derived from a consumer credit report before discarding it. The purpose of the Disposal Rule is to reduce the risk of identity theft and other consumer harm from improper disposal of such records. The federal Disposal Rule follows the trend set by statute in a number of states, such as California, that require businesses to shred or erase consumer information before disposing of it.

The Disposal Rule is broad in scope, and mandates the destruction of "any record about an individual, whether in paper, electronic, or other form that is a consumer report or is derived from a consumer report," which can identify a person individually. The Disposal Rule applies to any individual or business under FTC jurisdiction that maintains or otherwise possesses consumer report information for business purposes. These businesses must "take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal."

Accordingly, this also means that virtually all employers, ranging from individuals who hire extra help around the house to large multinational corporations, that perform credit checks on their employees, obtain personal information about their employees from various referral services, or otherwise obtain personal information derived from credit reports, must implement policies to adequately shred or erase employee information, or contract with third-party document shredding or data destruction companies to do so.

Although the Disposal Rule does not mandate a specific method to be used for the destruction of records, the FTC has provided examples of how businesses may comply with these new requirements, including, (a) implementing and monitoring compliance with policies and procedures that require shredding or burning of papers containing consumer information, and destroying or erasing electronic media containing consumer information, or (b) contracting with a third party to dispose of consumer information under the Disposal Rule and monitoring its performance.

Employers whose employees' identities are stolen may be subject to actual damages from their employees, statutory damages of up to $1,000 per employee, civil fines of up to $2,500 per employee, and class-action lawsuits.