Federal Trade Commission: Destroy consumer credit information or be

Daily Journal of Commerce (Portland, OR), May 2, 2005 by Kennedy Smith

Identity theft is the new breaking and entering, or so say the statistics. According to the Federal Trade Commission, the Portland- Vancouver-Beaverton area ranks 15th in the nation for identity theft- related complaints, with more than 3,000 victims reporting crimes last year. Of those complaints, credit card fraud ranks second after bank fraud as the most-reported type of identity theft.

In an effort to thwart this trend toward information stealing, the FTC has ruled that all businesses will be required to destroy any consumer credit information they have obtained from credit reports.

Taking effect on June 1, the FTC's Fair and Accurate Credit Transaction Act disposal rule mandates that any person who maintains or otherwise possesses consumer information for a business purpose must properly destroy the discarded information. An organization must dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.

Although the deadline to adhere to FACTA is fast approaching, not many businesses know about it - except for document destruction providers, which see this rule as a new market opportunity.

Businesses are slow to get these things rolling because they think they won't get into trouble, but once the trouble hits, we'll see a surge in business, said Joshua Hughes, sales manager at AM Document Destruction Co. in Portland.

Steve Trujillo, general manager of Shred-It, agrees. People don't really believe that this rule affects them, he said. Major corporations do understand the consequences, but small- and medium- sized companies aren't catching on. What they don't know is that if their employees aren't shredding, they can be held liable.

There are undoubtedly small- and medium-sized businesses, or even large firms, all over the country that are simply not aware of the FACTA requirements and are dependent upon diligent counsel to make them aware of their responsibilities, said Dennis Kiker, a Richmond, Va., attorney who counsels businesses on document management programs with Moran Kiker Brown.

Most points of FACTA legislation were incorporated during the last year and received some publicity, including the right for consumers to obtain an annual credit report for free, explained Rob Griffith, former bank examiner and attorney with Portland's Garvey Schubert Barer.

The FTC is not the only regulator with enforcement authority, but it is the default regulator for those businesses that are not otherwise regulated, such as financial institutions, he said.

Companies that should pay attention to this rule include insurance companies, property managers, law firms, retailers, automotive dealerships and any other business that collects customer information from credit reports. Hughes said several retail businesses have also called his company to inquire about document destruction because they acquire large amounts of credit card receipts.

The rule permits businesses to decide what method of destroying consumer information best meets their needs. Reasonable measures, as defined by FACTA, are burning, pulverizing or shredding of papers containing consumer information or entering into a contract with another party engaged in the business of record destruction to dispose of material, specifically identified as consumer information, in a manner consistent with this rule.

The FACTA rule does not apply to attorneys who learn consumer credit information directly from their clients and not from credit reports, but experts stress it's better to destroy more documents that fewer, because businesses can be held liable even if information they weren't aware they had derived from credit reports leads to identity theft.

My advice would be, when in doubt, companies should dispose of information as soon as there is no longer a business need for it, said Kiker.

Failure to comply with the FACTA rule can result in civil liability. Victims are entitled to recover their actual damages sustained as a result of a disposal rule violation and may also seek statutory damages of up to $1,000 per instance. Additionally, federal and state authorities could bring legal enforcement actions for each violation of the rule.

Businesses that aren't worried about getting in trouble with the FTC should think about how information theft could hurt their credibility with the public, offered Trujillo. If it gets out to the customer base that (a business's) information isn't safe, their customers lose trust, he said. These business owners have to understand that this could easily be their downfall.