FACTA: Fair and Accurate Credit Transactions Act.     Business Compliance Issues - Special Report

For business compliance with the FACTA rules the FTC indicates that "reasonable measures are very likely to require elements such as the establishment of policies and procedures governing disposal, as well as appropriate employee training."

There is a strong message here that every business that may be subject to the new FACTA rules should develop its own internal policy regarding proper record keeping and disposal of sensitive information or documents.

Included in the policies and procedures that could be covered are the following areas:

1. Certification and Documentation of Destruction.
Businesses will need to be able to prove that they have destroyed sensitive documents or information to be FACTA compliant. This requires documentation that would include what was destroyed and when it was destroyed.

2. Written Policies and Procedures for Document and Data Destruction.
Businesses should have a written program outlining how to maintain and shred documents or destroy other data. This means that there is a well defined, step by step procedure for various types of data and documents, including procedures for collecting and protecting the documents and data until the time that it is destroyed. For example, there might be provisions for secured, locked bins to collect data and documents etc. until they are properly disposed of.

3. Schedules for Data and Document Disposal.
Regularly scheduled paper shredding and data disposal is recommended to prevent the liability from storing excess records with personal information. Again, a documented procedure and schedule will show consistency in action and intent. Every business should have retention schedules that mandate when their records need to be securely destroyed.

4. Employee Training.
Storage and shredding must be covered in your company handbook. Businesses should have regular training sessions for all employees. It is recommended that an overall attitude be reinforced in training that "if in doubt, shred".

Here is an excerpt from FTC Press Release of June 1st, 2005:

"The Rule requires disposal practices that are reasonable and appropriate to prevent the unauthorized access to - or use of - information in a consumer report. For example, reasonable measures for disposing of consumer report information could include establishing and complying with policies to: burn, pulverize, or shred papers containing consumer report information so that the information cannot be read or reconstructed; destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed; or conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule."

FACTA Outsourced Disposal Issues