Jon
Yarbrough's
"Employment
Law Corner"
courtesy of the
Asheville Citizen-Times
The
Employment Law Corner is the property
of the Asheville
Citizen-Times to whom we extend our thanks for allowing us to
republish the article.
August 8, 2005:
"Get Those Paper
Shredders Ready;
Consumer Information Disposal Rule
is in Effect"
By Jonathan
W. Yarbrough
The "FACT Act" Disposal Rule - requiring employers to destroy or
erase consumer information before discarding documents and equipment
that contain the information - took effect June 1.
The rule, promulgated by the Federal Trade Commission on Nov. 24,
requires "persons" (using the term loosely to include individuals and
businesses) who maintain or possess consumer information for business
purposes properly dispose of such information.
It is important to note the rule does not require that any
particular record be kept or disposed of - it says only that, if and
when records containing consumer information are disposed of, they
must be disposed of in a manner set forth in the rule.
"Consumer information" is any record about an individual,
regardless of form, that is a "consumer report" or "derived from a
consumer report" as that term is used in the Fair Credit Reporting
Act. This would include individually identifiable information obtained
in a background or credit check.
"Proper disposal" means "taking reasonable measures to protect
against unauthorized access to or use of the information in connection
with its disposal." For example, an employee's credit report should
not be tossed in the wastebasket, and an old computer containing
consumer information should not be sold or donated to charity unless
the hard drive has been purged.
The rule does not require any specific method of destruction, but
it requires some method that results in information "that cannot
practicably be read or reconstructed" and provides some examples:
Implementing (if not already in place) a policy of burning,
pulverizing, shredding or otherwise obliterating paper records, as
well as a policy of obliterating such records that are maintained
electronically.
Monitoring compliance with such policies.
Entering into a contractual relationship with a third-party
document- or data-destruction company, and monitoring its compliance.
Document and data destruction companies likewise should comply with
the rule with respect to any consumer information that they obtain in
performing their services.
It is also important to note "disposal" includes, not only "the
discarding or abandonment of consumer information," but also "the
sale, donation or transfer of any medium, including computer
equipment, upon which consumer information is stored."
As a practical matter, this rule will cover most employers,
provided they obtain consumer information on applicants and employees.
The rule defines "consumer information" as "any record about an
individual ... that is a consumer report or is derived from a consumer
report."
It does not include aggregate or other data that does not contain
individually identifiable information.
The rule was implemented to protect individuals against identity
theft and related misuse of consumer information. Several states,
including California, already have similar rules in place.
Persons already covered by the Gramm-Leach-Bliley Act (generally,
providers of financial services) and the FTC's Standards for
Safeguarding Customer Information will have relatively minimal
additional compliance obligations.
Jonathan W. Yarbrough is a member of the law firm of Constangy,
Brooks & Smith LLC, which is dedicated to representing management
exclusively in all aspects of the employment relationship. Contact
Yarbrough at 277-5137 or
jyarbrough@constangy.com.
The Western North Carolina Human
Resources Association makes no warranties as to the accuracy of the
contents of the information provided in this site and the
corresponding links. The content is for informational purposes only.
Visitors are strongly encouraged to consult legal counsel on
any specific issues.
