A new federal law suggests you might.
Effective June 1, 2005, nearly every United States business must come into compliance with a new rule enacted under the federal Fair and Accurate Credit Transactions Act. Under the new rule, businesses are required to properly destroy all consumer information derived from a consumer credit report in order to reduce the risk of identity theft and other related harms. The rule applies to entities that possess or maintain consumer information for a business purpose, such as consumer reporting agencies, lenders, insurers, employers, landlords, government agencies, mortgage brokers, automobile dealers, and other users of consumer reports.
Consumer reports are not limited to reports about an individual’s credit history. Consumer reports are prepared by a third-party agency and can contain virtually any data about an applicant or employee, including criminal records, motor vehicle driving records, employment history, verification of residences, education records, verification of professional licenses and certifications and reference checks. “Consumer information” is defined as any record about an individual, whether in paper or electronic form, that is a consumer report or is derived from a consumer report.
The new rule requires businesses to take “reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” There is not a specific method required to dispose of the records, but the Federal Trade Commission has suggested some methods of compliance, including:
-
Implementing and monitoring compliance with policies and procedures that require the burning, pulverizing or shredding of papers containing consumer information;
-
Implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media containing consumer information; or
-
Contracting with a third party to dispose of consumer information under the disposal rule and monitoring its performance.
It is important to note that this new rule technically only deals with the disposal of information derived from a consumer report, not the retention or maintenance of such records.
Businesses that fail to comply with the new rules are subject to fines up to $2,500 per employee. Further, if an applicant or employee becomes the victim of identity theft as a result of a business’s failure to properly dispose of information, the individual may sue for all actual damages stemming from the identity theft, plus statutory damages up to $1,000. If you have any questions regarding this new rule or how to get into compliance, contact Winthrop & Weinstine’s Employment Advising Department, Laura A. Pfeiffer at (612) 604-6685 (lpfeiffer@winthrop.com), Mark A. Pihart at (612) 604-6623 (mpihart@winthrop.com) or Anton J Moch at (612) 604-6671 (amoch@winthrop.com ).