FTC Alert

On June 1, 2005, new FTC regulations became effective which outline the duties of persons and companies when disposing of consumer credit reports and information derived from consumer credit reports. Although the new regulations stem from the Fair and Accurate Credit Transactions Act (FACTA), the ramifications are broader because the regulations apply beyond credit reporting agencies and lenders traditionally covered by FACTA, and require that virtually any business that uses consumer credit information take more rigorous measures in handling that information.

The language of the regulations is surprisingly straightforward. The disposal regulations apply to “consumer information,” which is defined as “any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report.” This would include any company that uses credit reports for background checks in hiring decisions, credit checks on customers or vendors, or other business investigations which utilize consumer reports. Any person or entity that maintains this consumer information must properly dispose of it by taking “reasonable measures” to protect against unauthorized access or use of the information. Examples given are burning, pulverizing or shredding such information, and destroying or erasing electronic media containing such information. Given the prevalence of identity theft and the prominence of identity theft in the media, aggressive FTC enforcement is likely. In addition, and perhaps more importantly, private civil liability is a potential danger for violations. Although it is not clear whether a private consumer harmed by identity theft could sue directly for a violation of the new regulations, state laws, such as California's unfair business practices law, allow private consumers to “piggyback” on other laws, even laws that do not justify individual lawsuits. It is therefore in the best interest of any company that uses credit information to take a close look at the new regulations and develop a compliance program.