Sensitive Documents

​Any business or individual who uses a consumer report for a business purpose is subject to the requirements of the Disposal Rule.  

Credit Reports and Other Sensitive Documents
By Pierre Mouchette | Real Property Experts LLC

Any business or individual who uses a consumer report for a business purpose is subject to the requirements of the Disposal Rule.  The Rule requires the proper disposal of information in consumer reports and records to protect against ‘unauthorized access to or use of the information.’  The Federal Trade Commission, the nation’s consumer protection agency, enforces the Disposal Rule.

According to the FTC, the standard for the proper disposal of information derived from a consumer report is flexible.  It allows the organizations and individuals covered by the Rule to determine what measures are reasonable based on the sensitivity of the information, the costs and benefits of different disposal methods, and changes in technology.  Although the Disposal Rule applies to consumer reports and the information derived from consumer reports, the FTC encourages those who dispose of any records containing a consumer’s personal or financial information to take similar protective measures.
 
Who must comply? - The Disposal Rule applies to people, both large and small organizations, that use consumer reports.  Among those who must abide by the Rule are:

• Attorneys or private investigators
• Automobile dealers
• Consumer reporting companies
• Debt collectors
• Employers
• Government agencies
• Insurers
• Landlords
• Lenders
• Mortgage brokers
• Individuals who obtain a credit report on prospective nannies, contractors, or tenants.
• Entities that maintain information in consumer reports as part of their role as service providers to other organizations covered by the Rule.

 
What information does the Disposal Rule cover? - The Disposal Rule applies to consumer reports or information derived from consumer reports. The Fair Credit Reporting Act defines the term consumer report to include information obtained from a consumer reporting company used or expected to establish a consumer’s eligibility for credit, employment, or insurance, among other purposes.  Credit reports and credit scores are consumer reports.  So are reports businesses or individuals receive information relating to employment background, check-writing history, insurance claims, residential or tenant history, or medical history.

What is "proper" disposal? - The Disposal Rule requires disposal practices that are reasonable and appropriate to prevent unauthorized access to or use information in a consumer report.  Reasonable measures for disposing of consumer report information could include establishing and complying with policies to

• Burn, pulverize, or shred papers containing consumer report information so that the information cannot be read or reconstructed.
• Destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed.
• Conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule.

Due diligence could include:

• Reviewing an independent audit of a disposal company’s operations and its compliance with the Rule.
• Obtaining information about the disposal company from several references.
• Requiring that the disposal company be certified by a recognized trade association.
• Reviewing and evaluating the disposal company’s information security policies or procedures.

 
The Fair and Accurate Credit Transactions Act was enacted in 2003.  It directed the FTC, the Federal Reserve Board, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, the National Credit Union Administration, and the Securities and Exchange Commission to adopt comparable and consistent rules regarding the disposal of sensitive consumer report information. The FTC’s Disposal Rule became effective June 1, 2005 and is available at ftc.gov/os/2004/11/041118disposalfrn.pdf.