A Matter of Trust

There’s no question that the world is deep within the Information Age. Information is everywhere and readily available like never before—a fact that millions of Americans are aware of all too well.

According to a survey conducted by the Privacy Rights Clearinghouse in San Diego, more than 9 million people were the victims of identity theft in 2005 in the United States. The threat of this growing crime that includes a wide range of information fraud has spurred the creation of a number of laws to try to combat it at both the state and federal levels. Among the regulations is the Fair and Accurate Credit Transactions Act, or FACTA, a federal statute that went into effect in June 2005.

FACTA covers a wide range of information security topics, but it is the disposal rule that has many paper and electronics recyclers paying special attention.

GETTING IN THE ACT. The language of the act states that "any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose properly dispose of any such information or compilation." This language has raised more than a few eyebrows among paper and electronics recyclers, both those who have secure destruction arms of their operations and those who don’t.

Can recyclers be held legally responsible if what FACTA determines as consumer report information finds its way into their material streams and then falls into the wrong hands? What happens if the recyclers didn’t know they had the material in the first place? These are questions still on the minds of many recyclers as the industry comes to terms with FACTA and its potential legal implications.

"Recyclers could be liable if they know they possess consumer report information and they do not dispose of it properly," says Katherine Armstrong, an attorney in the division of finance for the Federal Trade Commission (FTC), which is responsible for FACTA.

By "consumer report information," FACTA is referring to information that is obtained from a consumer reporting company for the purposes of applying for credit, employment or insurance, among other things, says Armstrong. This could or could not include bits of information like Social Security numbers, bank account numbers and many other pieces of information, depending on the circumstances, which contributes to some of the confusion surrounding the regulation.

Technically, the disposal rule covers any person who maintains consumer report information and that can include recyclers, who are grouped in with "service providers" in the language of the rule. In issuing the final rule, the FTC stated that, "under the final rule, service providers continue to be covered, and therefore, along with the record owner, bear responsibility for the proper disposal of consumer information that they maintain or otherwise possess." While this language seems to make recyclers liable for consumer information that may be contained in the paper or electronic material they process, it continues, "in evaluating a service provider’s compliance with this rule, however, a record owner’s failure to provide notice or contract for disposal in accordance with the requirements of the rule will be strongly considered."

This means that the liability of recyclers hinges on their awareness of whether the materials being processed contain consumer information—an awareness that comes from the material generator, or the recycler’s client, says Scott Horne, general counsel for the Institute of Scrap Recycling Industries Inc. (ISRI). "There is a lot of misinformation being disseminated out there," Horne says. "The law would require recyclers to take certain actions if they are in fact aware of the fact that they are receiving information that is covered by FACTA. However, a recycler cannot be conned into being covered by the law."

Neither Horne nor Armstrong is aware of any cases that have been brought against recyclers holding them liable in a case of identity theft. But if such a case were to occur, Armstrong says a number of factors would come into play in determining the party responsible, and while a recycler could be held liable under FACTA, there’s no blanket guarantee under the regulations that say the company will be. "Clearly, if a record holder is trying to shirk [liability] off on the recycler, any fact-checker would look at the actions of the record keeper, as well as the actions of the recycler " says Armstrong.

CLEAR COMMUNICATION. Horne says the relationship between recycler and client is key because legal responsibility in the FACTA regulation hinges on a clear communication between the two of exactly what kind of material is being handled and processed.

Joel Litman of Texas Recycling/Surplus in Dallas agrees and says that the customer, as the first step in the recycling process, has the biggest responsibility when it comes to FACTA compliance. "The customers have to be compliant and there are certain steps they have to follow—we are just one component of that process," he says.

Litman runs a paper recycling operation at Texas Recycling/Surplus, but he also has a secure document destruction arm of his operation—ActionShred. Between the two operations, he says several million pounds of scrap paper are processed each month. The volume of material alone makes it essential to rely on the customer—to trust that the material generator is being responsible and making sure any FACTA-covered information is bound for some kind of secure document destruction first, he says. "Paper comes from so many different sources," Litman says. "You can’t go through each piece."

Peter Bennison of Waste Management & Recycling Products Inc., an electronics recycling operation in Schenectady, N.Y., also says that solid communication is the best way to ensure a recycling operation stays on the good side of FACTA.

"You have to communicate with your customers effectively to make sure they understand how important it is," he says. "Whether it’s cell phones or computers, when people get rid of this stuff, are they doing the right thing?"

Bennison says secure information turns up by mistake at his facility on a pretty regular basis. He recalls one instance where a customer had sent in a few obsolete printers—one still containing transparency film filled with personal information. "One of our employees noticed it, and we hand-delivered it back to the customer," Bennison says.

Such internal safeguards are helpful in avoiding any potential culpability if secure information was to fall into the wrong hands, Bennison says. "We educate our employees," he says. "If you come across something you feel a customer would feel is confidential, we take it back to them."

Last year, Waste Management & Recycling Products installed a large shredder capable of destroying hard drives and other electronics so secure information can be destroyed on site. Customers also have the option of destroying the information themselves or of storing it. "We look at is as, ‘Let’s make sure our customers are educated as to what their options are so we can help them,’" Bennison says.

A COOPERATIVE EFFORT. Recyclers could possibly find themselves in a legally sticky situation if they notice FACTA-covered information somewhere in the material stream that a customer hasn’t contracted with them to be destroyed properly. "They can’t avoid it, or turn a blind eye to it," Armstrong says.

However, the rule was not designed to make a recycler’s job more difficult, she says, rather to "prevent the kind of fraud that can occur when consumer report information is improperly disposed of."

Therefore, "Knowledge is power," as the saying goes, and it’s also an important weapon in defending oneself against FACTA’s legal consequences. That knowledge is something recyclers hope can come from within the industry itself.

"The one thing that our industry doesn’t want is more legislation," Litman says. "There’s a trust level there, a good faith level there between customer and recycler—just like any other customer/client relationship,"

He and others in the industry hope that material generators and recyclers can cooperate to help each other stay FACTA compliant and out of legal liability crosshairs.

The author is associate editor of Recycling Today magazine and can be reached at jgubeno@gie.net.