The FACTA Disposal Rule: What Businesses Must Do With Consumer Information

The FACTA Disposal Rule is a Federal Trade Commission regulation (16 CFR Part 682) that requires any person or business that uses consumer report information for a business purpose to dispose of it by taking “reasonable measures to protect against unauthorized access to or use of the information.” It came out of the Fair and Accurate Credit Transactions Act of 2003.

Who the Disposal Rule Covers

The rule is broad. It applies to anyone who has information from a consumer report, not just banks or credit bureaus. That includes:

• Employers that run background checks on job applicants or employees
• Landlords and property managers that screen tenants
• Car dealers, lenders, and mortgage brokers
• Insurance agencies
• Debt collectors
• Any company that uses a consumer report to make a decision about a person

What “Reasonable Measures” Means

The FTC gives examples of reasonable disposal practices. They include:

• Paper: burning, pulverizing, or shredding papers so the information cannot be read or put back together.
• Electronic media: destroying or erasing electronic files and drives so the information cannot be read or rebuilt.
• Using a disposal vendor: hiring a document destruction company after checking it out, for example by reviewing its references, audits, or certification by a trade association, and then monitoring its compliance.

Financial institutions covered by the Gramm-Leach-Bliley Act should also build proper disposal into their information security program under the FTC Safeguards Rule. See our shredding for financial institutions page.

How to Comply

1. Write a short policy saying how consumer information is stored and destroyed.
2. Place locked shredding containers where employees handle applications, reports, and files.
3. Destroy old hard drives and devices with a hard drive destruction service.
4. Choose a vetted vendor. Marshall Shredding is NAID AAA certified.
5. Keep each Certificate of Destruction on file.

This article is general information, not legal advice. Talk with your attorney about your obligations.

Frequently Asked Questions

What is the FACTA Disposal Rule?

It is an FTC rule (16 CFR Part 682) requiring anyone who uses consumer report information for a business purpose to dispose of it with reasonable measures that prevent unauthorized access.

Who must follow the Disposal Rule?

Any business or person that has consumer report information, including employers, landlords, lenders, car dealers, insurance agencies, and debt collectors.

Does shredding satisfy the FACTA Disposal Rule?

The FTC lists shredding papers so they cannot be read or reconstructed as an example of a reasonable disposal measure.

Can a business hire a shredding company to comply?

Yes. The FTC says hiring a document destruction company after doing due diligence, such as checking its certification, is a reasonable measure.

Does the Disposal Rule apply to electronic records?

Yes. Electronic files and storage media containing consumer information must also be destroyed or erased so the information cannot be read or reconstructed.

Get Secure Shredding From Marshall Shredding

Marshall Shredding has protected Texas businesses and homeowners for more than 25 years. Call (866) 487-4733 or request a free quote. Every service includes a Certificate of Destruction.