Tim asks:
What requirements are there for buildings, managers, and owners with regard to the Federal Trade Commission’s Fair and Accurate Credit Transactions Act of 2003 (FACTA)?
James Elledge replies ...
The main concern for facility professionals would be the disposal of records rules. Any organization that uses a consumer report for a business purpose is subject to the requirements of the Disposal Rule, a part of FACTA, which protects against “unauthorized access to or use of the information.”
FACTA defines the term consumer report to include information obtained from a company that is used—or expected to be used—in establishing a consumer’s eligibility for credit, employment, or insurance, among other purposes. The Disposal Rule requires practices that are reasonable and appropriate to prevent the unauthorized access to—or use of—information in a consumer report.
For example, reasonable measures could include establishing and complying with the following policies to prevent the material from being read or reconstructed:
- Burn, pulverize, or shred papers containing consumer report information;
- Destroy or erase electronic files or media containing consumer report information; or
- Conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule.
Due diligence could include:
- Reviewing an independent audit of a disposal company’s operations and/or its compliance with the Rule;
- Obtaining information about the disposal company from several references;
- Requiring the disposal company to be certified by a recognized trade association;
- Reviewing and evaluating the disposal company’s information security policies or procedures.
This final point may be used by office product dealers in their efforts to sell shredders “to comply with federal law.” While shredding is an acceptable form of disposal, your volume may require other methods.
Check out the FTC’s Disposal Rule, which became effective on June 1, 2005. It was published in the Federal Register on November 24, 2004 [69 Fed Reg 68690] and is available online at www.ftc.gov/os/2004/11/041118disposalfrn.pdf.
Thanks for your question, Jim Elledge.
