FACTA to affect disposal of consumer credit informationStacey DiPiazza FACTA, consumer fraud, identity theft, compliance
By Wednesday, June 1, every company that deals with consumer
credit information will have to change the way it does business.
This is the day that the Fair and Accurate Credit Transaction Act
(FACTA) goes into effect. The new federal law was designed to
reduce the risk of consumer fraud and identity theft that is
created by the improper disposal of consumer information. Its
impact will be felt by any business that has access to consumers'
credit information. The rule requires that these companies destroy
all consumer information before it is discarded. Businesses that
fail to properly destroy this information will face severe
penalties, which could include civil liabilities, the threat of
class action suits, and state and federal enforcement actions.
Although all businesses will feel the impact of the new rule, it
especially singles out consumer reporting agencies, lenders,
insurers, employers, landlords, government agencies, mortgage
brokers, auto dealers and other users of consumer reports. FACTA
applies to anybody who maintains consumer information and any
business that is regulated by the Federal Trade Commission.
It is important to remember that FACTA covers more than paper.
The rule covers any medium that contains personal information,
whether it is paper, compact discs or even hard drives. For
example, Infoshred LLC, a document destruction company in South
Windsor, Conn., has been asked by many companies to destroy hard
drives, even though the companies have already removed the
information from the drives. They want to be absolutely sure that
no information can be retrieved from these hard drives, so
Infoshred physically destroys and disposes of them.
What does FACTA mean to your business?
FACTA mandates that you must monitor and implement policies and
procedures for the destruction of information. For example, in the
past, a business may have thrown old credit reports into the trash
or recycling bin. Now, this information must be destroyed. Throwing
it away or placing it in a recycling bin will not satisfy the new
FACTA rules. The information must be disposed of in a confidential
waste program where it is securely destroyed. In the past, such
businesses would recycle office paper, but that won't satisfy the
new requirements. Most companies recycle their paper through an
outside vendor that picks up the paper and transports it to their
facility in an unsecured vehicle. Employees who handle it usually
aren't background-checked and they often bring the paper to an
unsecured recycling facility, where it is dumped on the floor and
pushed with pay-loaders into a baler that compacts the paper into
bales. The bales are then picked up by mills and recycled. The
problem is that throughout the process, the paper is intact. It can
be read by anyone who finds it. Shredding sensitive documents will
satisfy FACTA's requirements. When you use a professional shredding
service, discarded paper goes into what is called a 'closed system'
that safeguards the documents from the time they are discarded to
the time they are destroyed and disposed of.
Security is the key to making sure your business satisfies
FACTA. Professional shredding services supply their clients with
locked containers, and the employees who handle the containers are
background-checked for security purposes. Such companies often
offer the option of either shredding the documents onsite or
transporting them in an alarmed, locked truck to their facility for
destruction. Some document destruction companies such as Infoshred
even track their trucks by satellite along their route to the
secured facility as an extra precaution. When the documents reach
the facility, they are shredded within 24 hours. Once the material
is shredded, it is baled, re-pulped and reprocessed into recycled
goods.
Some businesses facing the new FACTA requirements may consider
buying their own shredders. This is a decision that should be
weighed carefully. Do you really want your employees to take the
time to shred every document as well as maintain the shredders?
Infoshred has been called in by panicky customers who face a
deadline and are overwhelmed by the amount of material they are
trying to feed into a small office shredder. Also, keep in mind
that if you fill up your dumpsters with fluffy shredded paper,
chances are your disposal costs will increase.
What should businesses affected by FACTA do before the
June 1 deadline?
•Establish internal policies and procedures for handling
confidential information.
These guidelines should include defining confidential information,
explaining how it will be handled and setting deadlines for
destruction. The idea is to clearly establish how sensitive
information will be handled and to develop a logistical flow for
the paper that contains it.
•Decide how you are going to handle material other
than paper.
Many times, people forget that things like compact discs, diskettes
and even hard drives contain personal data that must be destroyed
under the new laws. So, when you are upgrading your computers, you
must decide what you are going to do with the old ones to safeguard
the consumer information they contain.
•Utilize a qualified destruction vendor.
If youve never worked with this kind of outside resource, there are
a few things to keep in mind. It is important to look at a firm's
security, policies and procedures, insurance coverage, references
and certifications. Make sure that the vendor is certified by the
National Association for Information Destruction, which dictates
the standards of the industry. Also, look into their methods of
employee screening and security. Both the trucks and the company
facilities need to be secure. Trucks should be tracked from your
business to the processing facility, and the facility should be
monitored 24 hours a day. You should also feel welcome to visit the
facility at any time and the company should be more than agreeable
if you want to witness the destruction of your material. Lastly, I
urge you to pick a company that is experienced in document
destruction, not just waste management. There is a difference.
There is no doubt that companies will need to adopt new ways of
doing business to meet the requirements of FACTA. Both businesses
and their employees must change the way they handle consumer credit
information. Most companies will need to re-examine how they do
business to protect that information. FACTA will take effect on
Wednesday, June 1, and companies will only have the next few months
to bring their operations into compliance.
Stacey DiPiazza is the owner of Infoshred LLC, a document
destruction and record storage company based in South Windsor,
Conn. For more information, call (888) 800-1552 or visit
www.infoshred.com.
