Businesses, banks must protect consumer records, U.S. says.

• Author: Swartz, Nikki
• Position: News, Trends & Analysis

The U.S. Federal Trade Commission (FTC) has issued its final rule on the proper disposal of consumer report information and records under the Fair and Accurate Credit Transactions Act of 2003 (FACTA) and the Fair Credit Reporting Act (FCRA).

FACTA, which was enacted on December 4, 2003, amends the FCRA and directs the FTC, the Federal Reserve Board, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corp., the Office of Thrift Supervision, the National Credit Union Administration, and the Securities and Exchange Commission (SEC) to cooperate to adopt comparable and consistent rules regarding the disposal of sensitive consumer report information. The purpose of these rules is to reduce the risk of identity theft and other consumer harm resulting from improper disposal of consumer reports or any records derived from them. The FTC's Disposal Rule applies to people or entities under FTC jurisdiction that maintain or otherwise possess consumer report information for business purposes.

The rule requires that covered entities "take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." The standard for disposal is flexible to allow entities to determine what measures are reasonable based on the sensitivity of the information, the costs and benefits of different disposal methods, and relevant changes in technology...