How should consumer information be disposed of?

The Federal Trade Commission's (FTC) "Disposal Rule" took effect on June 1, 2005 and is intended to reduce the risk of harms that can result from improper disposal of a consumer report or any record derived therefrom. The rule requires employers to take reasonable measures to protect against unauthorized access to or use of information contained in consumer reports and records.

For purposes of the rule, "consumer information" includes paper or electronic information used by an employer to determine eligibility for employment. Specifically, it will include not only a background check report obtained from a consumer reporting agency, but also, for example, notes prepared by a supervisor or human resources manager based upon information contained in the report.

The standard for complying with the Disposal Rule is flexible and allows individual organizations to determine what measures are reasonable and appropriate. Factors to consider include: the sensitivity of the information; the costs and benefits of different disposal methods; and relevant technological changes over time.

Although the FTC does not define "proper disposal" in the regulations, it does point to the following "reasonable measures" as being acceptable:

• Burning, pulverizing, or shredding papers such the the information cannot be read or reconstructed;

• Destroying or erasing electronic files so that the information cannot be read or reconstructed;

• Using due diligence when hiring a document destruction contractor who can be trusted to dispose of the information in a manner that is consistent with the Disposal Rule.