FACTA amended the Fair Credit Reporting Act to fight identity theft. For most businesses, its most important piece is the FTC's Disposal Rule, in effect since 2005, which governs how consumer credit information must be thrown away.

Who it applies to

Any person or business that uses a consumer report for a business purpose. That's a much wider group than lenders:

• Landlords and property managers who screen tenants
• Employers who run background or credit checks
• Car dealers, furniture stores and anyone offering financing
• Insurance agents
• Mortgage brokers, lenders and debt collectors
• Attorneys, accountants and anyone who receives a credit report from a client

What the Disposal Rule requires

Take "reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." The rule's own examples of reasonable measures include burning, pulverizing or shredding papers so the information cannot practicably be read or reconstructed — and, notably, hiring a document destruction contractor after doing due diligence on them.

The rule applies to the report itself and anything derived from it: an application with a credit score written on it, a note in a file, a printout.

The Red Flags Rule

FACTA also created the Red Flags Rule, which requires creditors and financial institutions to have a written identity-theft prevention program. Secure disposal of customer files is a standard element of those programs.

What non-compliance costs

The FTC enforces the Disposal Rule with civil penalties and consent orders that typically require a formal security program and years of independent audits. Consumers can also sue for actual damages plus punitive damages. A Nevada mortgage broker was fined personally and audited for ten years over 40 boxes in a dumpster — see the case studies.

This page is a plain-English summary for business owners, not legal advice. Talk to your attorney or compliance officer about how the law applies to you.