FTC Issues Document Destruction Rule to Combat Identity Theft and Protect Consumers’ Privacy

September 27 , 2004 in Press Releases

Businesses Will Be Required To Properly Dispose of Sensitive Consumer Information

So. Burlinton, VT – November 22, 2004 – The Federal Trade Commission (FTC) has issued a new rule that will require local Vermont businesses to properly dispose of and destroy sensitive consumer data. The rule is one of several new requirements intended to combat consumer fraud and identity theft and protect privacy required by the federal Fair and Accurate Credit Transactions Act (FACT Act) which was enacted in December 2003.

The new FACT Act Disposal Rule, issued on Thursday, broadly covers “any record about an individual, whether in paper, electronic, or other form that is a consumer report (also known as a credit report) or is derived from a consumer report.” It requires any person or company that possesses or maintains such information to take “reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.”

“There is no reason that a stack of customer files containing credit reports should be sitting in a dumpster in Vermont, easily accessible to just about anyone,” said Eric Flegenheimer of On-Site SecurShred in So. Burlington “This rule will force banks, retailers, auto dealers and any other business throughout our region that obtain credit reports, or related personal information, to shred those documents before throwing them away.”
According to a study released by the FTC in September 2003, nearly 10 million Americans were the victims of identity theft in the previous year alone. The study also found that U.S. businesses lost $47 billion and consumers lost approximately $5 billion as a result of identity theft during the same period.
Right here in Vermont, the state legislature is currently considering one of the most comprehensive identity theft bills in the nation. If passed, this bill would put Vermont at the forefront of identity theft protection. The Vermont Social Security Numbers Study Committee is also considering a legislation protecting privacy and security during disposal of documents containing sensitive information, including SSN’s. Vermont is one of only two states that do not have an identity theft law in place.
“This new rule is an important step forward in the fight against consumer fraud and identity theft. Shredding documents and properly destroying computer files and hard drives will help ensure that records containing sensitive personal and financial information don’t fall into the wrong hands,” said Robert Johnson, executive director of the National Association for Information Destruction (NAID). “It’s important for the business community to understand that this law applies to nearly every business and private employer in the U.S.”

The new rule provides examples of how to comply with the new requirements, including:

  • Implementing and monitoring compliance with policies and procedures that require shredding or other forms of destruction of documents and electronic media containing consumer information; and
  • Contracting with a third party to properly dispose of consumer information and monitoring their performance.

The FACT Act Disposal Rule applies to virtually every business and private employer in the U.S. The rule requires these businesses to come into compliance by June 1, 2005 by both adopting and implementing their own document destruction policies or by contracting with a document shredding company or other data destruction company to do so. Penalties for violating the rule include actual damages, statutory damages up to $1,000 punitive damages per violation (with no cap on class action damages), attorneys’ fees, and civil penalties up to $2,500. For more information about the rule and business compliance requirements, visit the FTC Website

About NAID

The National Association for Information Destruction(NAID) is the international trade association for companies providing information destruction services. Suppliers of products, equipment and services to destruction companies are also eligible for membership. NAID’s mission is to promote the information destruction industry and the standards and ethics of its member companies. For more information, visit the NAID Website
About On-Site SecurShred

On-Site SecurShred is a Vermont owned and operated document and electronic media destruction company based in So. Burlington, VT. The company has been AAA certified by the National Association of Information Destruction for both mobile and plant-based operation. The company currently services hundreds of companies throughout Vermont, Western New Hampshire, Western Massachusetts and Northeastern NY.

For more information, contact:
David Van Mullen

On-Site SecurShred
437 Lime Kiln Road
So. Burlington, VT 05403