The Fair and Accurate Credit Transaction Act�s (FACTA) disposal provisions went into effect on June 1st. The purpose of the rules is to prevent workplace identity theft by requiring employers to properly dispose of records that contain �consumer information.� FACTA amends the Fair Credit Reporting Act (FCRA) and requires �any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation.�

Under the rule, �consumer information� means any record about an individual that is a consumer report or is derived from a consumer report as defined by the FCRA. The FCRA�s definition of a consumer report includes any written, oral, or other communication of any information by a consumer reporting agency regarding a consumer�s credit standing, credit capacity, character, reputation, personal characteristics, or mode of living which is used as a factor to establish the consumer�s eligibility for employment. Practically, the disposal rules come into play whenever a third-party is used to perform a credit check, run a credit report, conduct a background investigation, or perform a driving record check. Further, if information from any of these reports is made part of another document, such as a summary of the reports, these additional documents are also covered by FACTA. The rules are limited by the requirement that information must come from a third-party; information gathered by internal research or checking is not covered under FACTA.

The rules require proper disposal of consumer information contained within the reports covered by FACTA. The rules further require employers to take �reasonable measures� to protect against unauthorized access to information contained within reports covered by FACTA once the reports are disposed. The logical question is what are reasonable measures? The rule suggests shredding, burning, or pulverizing documents. Computer and electronic files must be erased. These rules only apply to the disposal of consumer information�they do not apply to the maintenance and/or storage of the information.