New FTC rule requires businesses to destroy consumer credit info

Daily Record and the Kansas City Daily News-Press, Apr 20, 2005 by Reni Gertner

(This article originally ran in Missouri Lawyers Weekly, St. Louis, MO, another Dolan Media publication.)

All businesses, including law firms, will soon be required to destroy any consumer credit information they have obtained from credit reports, under a new rule issued by the Federal Trade Commission.

The disposal rule - which was issued pursuant to the Fair and Accurate Credit Transaction Act - goes into effect on June 1. Businesses then have six months to come into compliance or face a range of possible penalties. The rule applies not only to paper records but also to information found on computers and other electronic media, such as CD-ROMs and floppy disks.

According to Dennis Kiker, a Richmond, Va., attorney who counsels businesses on document management programs, The point of this rule is to [stop] people from old-fashioned dumpster divers who are stealing paper to sophisticated folks who are mining information from computers and close a loophole for consumer identifying information getting out into the public. Experts said the rule sweeps broadly and will apply to a whole range of businesses as well as a whole range of attorneys.

Mari Frank, a solo practitioner in Laguna Niguel, Calif., who has written the Identity Theft Survival Kit, said the types of law firms most likely to be affected include debt collection attorneys, family attorneys, bankruptcy attorneys, real estate lawyers, health care attorneys and employment lawyers. Many affected businesses and firms may be unaware of the new rule.

According to Tena Friery, research director of the Privacy Rights Clearinghouse in San Diego, 80 percent of employers do background checks when they hire people - something that involves accessing consumer credit reports.

There are undoubtedly small and medium-sized businesses, or even large firms, all over the country that are simply not aware of the FACTA requirements and are dependent upon diligent counsel to make them aware of their responsibilities, said Kiker, a partner with Moran Kiker Brown. Frank agreed.

Everybody is going to have to be on notice that even the smallest firms are going to have to have shredders and make sure information is completely destroyed, she said.

The disposal rule provides that: Any person who maintains or otherwise possesses consumer information for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. Under the rule, a person is defined as someone who maintains . . . consumer information for a business purpose. According to the FTC, Entities across almost every industry could potentially be subject to the rule.

In addition to the more obvious entities that obtain consumer credit information, such as consumer reporting agencies and lenders, the FTC had said that employers, insurers, landlords, mortgage brokers, automobile dealers and utility companies might also be affected.

Disposal and records management companies also fall under the rule, the FTC said. Along with the individual or business that maintains the record, disposers bear responsibility for proper disposal of consumer information they maintain or otherwise possess.

Technically, the breadth of the rule means that an individual who has one at-home employee such as a nanny or gardener would be covered.

But realistically, said Kiker, I don't think individuals are very likely to run into problems. The sort of consumer information that must be destroyed includes any record about an individual, whether in paper, electronic or other form, that is a consumer report or is derived from a consumer report. The FTC said the rule doesn't cover information unless it mentions particular consumers and contains personal identifiers, such as Social Security numbers. The rule also applies to compilations of consumer information.

But Kiker noted that the definition of consumer information has been left flexible because depending on the circumstances, data elements that are not inherently identifying can, in combination, identify particular individuals, according to the rule.

The rule technically doesn't apply to consumer credit information attorneys learn directly from their clients, not from consumer credit reports. But experts stress that it's better to destroy more documents rather than fewer because businesses can be held liable even if information that they didn't know they had derived from credit reports leads to identity theft.

My advice would be, when in doubt, companies should dispose of information as soon as there is no longer a business need for it, said Kiker. A good way to have clear standards for what to keep and when to discard is to develop a document retention policy, said Charlene Brownlee, who is in the new document retention practice group of Fulbright & Jaworksi in Austin, Texas.

In doing so, she said, it's important to ensure that documents related to reasonably anticipated litigation or government investigation are not destroyed.