|
Legislative Update:
1) FACTA and the Disposal Rule: At-A-Glance
What is the Fair and Accurate Credit Transactions Act?
In December, 2003, the federal government passed the Fair and Accurate Credit Transactions Act of 2003 (FACTA), an expansive new law that affects various aspects of consumer credit.
The
Under FACTA, certain federal agencies were required to create regulations designed to minimize the risk of identity theft and consumer fraud by enforcing the proper destruction of consumer information. One of the resulting regulations, known as the Disposal Rule, was issued by the Federal Trade Commission in November 2004. Identical rules adopted by the federal banking agencies and the Securities and Exchange Commission now apply to organizations regulated under their authority.
Effective June 1, 2005, the Disposal Rule states that "any person who maintains or otherwise possesses consumer information* for a business purpose" is required to properly dispose of the information, whether in electronic or paper form, by "taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal."
Reasonable measures include:
(1) Paper records - Implementing and monitoring compliance with policies and procedures that requires the shredding, burning, pulverizing of papers containing consumer information so that the information cannot be easily read or reconstructed.
(2) Electronic records - Implementing and monitoring compliance with policies and procedures that requires the destruction or erasure of electronic media containing consumer information so that the information cannot be easily read or reconstructed.
(3) Due Diligence & Contracts - After due diligence, entering into and monitoring compliance with a written contract with another party engaged in the business of record destruction to dispose of consumer information in a manner consistent with this rule.
The Cost of Non-Compliance
Violation claims can be brought within two years from discovery of the violation or five years from the actual violation. In addition to the severe penalties and fines that federal or state agencies can levy upon violators, companies charged with FACTA Disposal Rule non-compliance run the risk of negative publicity and irreparable damage to their corporate reputation.
To educate businesses about the new requirements of the Disposal Rule, the FTC has issued a new publication, “New Rule Seeks to Protect Privacy by Requiring Proper Disposal of Sensitive Consumer Information,” available at: www.ftc.gov/bcp/conline/pubs/alerts/disposalalrt.htm.
The FTC's Disposal Rule was published in the Federal Register on November 24, 2004 [69 Fed Reg 68690. A copy of the final Rule is available for review at: www.ftc.gov/os/2004/11/041118disposalfrn.pdf.
*"Consumer information" is defined as any record about an individual that is a consumer report, or is derived from a consumer report, including compilations of such records.
The Destination - Risk Mitigation and Cost Effective Compliance
If you design, implement and enforce a Compliant Records Management program that fully incorporates disposal, your program will:
Demonstrate compliance with the FACTA disposal rule through:
- Good faith efforts
- Consistent policies, procedures and practices
- Management accountability
- Employee adoption
Ensure:
- Secure, certified destruction of confidential consumer records
- Lowest disposal Total Cost of Ownership
- Reduced regulatory, legal and operational risks due to mismanagement of consumer information
- The protection of your corporation's reputation
2) The Identity Theft Protection Act
CHARLOTTE, N.C. – A new law that went into effect within the last few months will make it more difficult for identity thieves to operate.
The Identity Theft Protection Act, signed last fall by Gov. Mike Easley, will allow consumers to put a security freeze on their credit reports to prevent identity thieves from opening accounts and generating credit using stolen information.
Businesses will now be required to notify customers when there's been a security breach and to destroy or shred records that contain personal information before throwing them out.
Businesses also can be sued for damages by a consumer if they break the law.
About 300,000 North Carolina residents have their identities stolen annually, with each victim on average spending $800 and 175 hours over a nearly two-year period to clean up the damage.
"We're fighting this fast-growing crime by giving people more ways to protect themselves from identity theft, and by making it harder for criminals to get their hands on your information in the first place," said Attorney General Roy Cooper.
Contact FileVault to review your shredding program. info@filevaultusa.com
|
