Newsletters 

New "Disposal Rule" covers nearly everyone in possession of consumer information for a business purpose

In an effort to curb identity theft, the FTC has issued the "Disposal Rule" effective June 1, 2005. Employees and consumer information must now be destroyed prior to disposal.

Who is subject to the Disposal Rule?

Practically every person or entity that possess employee or consumer information for a business purpose including most:

·        Employers

·        Lenders

·        Landlords

·        Insurers

·        Retailers who collect client information

What steps must I take to comply?

No particular steps are mandated. Instead you are required to take "reasonable measures" to ensure that document disposal protects against unauthorized access to consumer information. The FTC does include examples of reasonable disposal methods including:

·        Paper records may be destroyed beyond recognition by:

o       Shredding

o       Burning

o       Pulverizing

·        Computer disks and hard drives may be erased by:

o       "Simply smashing material with a hammer"

o       Overwriting or "wiping" data

What is the cost for non-compliance?

Failure to meet the disposal rule could result in significant costs including:

·        Penalties for rule violation

·        Damages owed to consumers or employees

How can I protect myself from potential liability?

It is recommended that you take the following steps to comply with the "Disposal Rule":

·        Develop, document and adhere to policies and procedures governing disposal of employee and consumer information

·        Educate employees on proper disposal procedures and practices

·        If you use an outside company, select with care and document review of company's credentials

·        Closely monitor compliance (internally and by outside company) and make necessary changes to procedures