Good as Gold

Even Americans slow to learn about the perils of identify theft have long considered their financial information to be strictly between themselves and their chosen lenders and financial planners.

It can be embarrassing for any company to be caught by an auditor or inspector—or worse yet a local investigative reporter—with sensitive information in its trash Dumpster. But that embarrassment is especially acute for banking, finance and insurance firms, which have several laws and rules in place with which to comply.

Clearly, when an information destruction firm takes on banking, lending and other financial industry clients, it is being trusted as a close and thorough ally by those institutions.

The single greatest weapon in the criminal arsenal for the growing crime of identity theft is financial information that contains an individual’s name, address and bank or credit card account numbers. (A Social Security number can provide additional firepower.)

Without question, it is up to individual customers to guard such information regarding their own accounts, but a tremendous onus also lies on financial institutions that store, distribute and dispose of volumes of paper (and electronic storage media) that contain names and account numbers.

If one national estimate is right, and more than 20 million Americans have been victims of identity theft in some way, then the Gramm-Leach-Bliley Act of 1999 (GLBA) and its financial privacy provisions have become a measured government response to the problem.

GLBA covers a number of privacy issues, including setting guidelines as to what extent financial institutions can share contact and account information with other businesses that may wish to solicit these contacts for sales reasons.

But placing information destruction requirements on covered institutions is also part of GLBA. Section 501 of the act, as described by the law firm of Fried, Frank, Harris, Shiver and Jacobson, New York, on its Web site, requires lenders, "to ensure the security and confidentiality of customer records and information; to protect against any anticipated threats or hazards to the security or integrity of such records; and to protect against any unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any consumer."

As outlined in an edition of the Federal Register in August of 2001, GLBA’s Safeguards Rule includes guidelines for lenders and their suppliers to"develop, implement and maintain a comprehensive written information security program" that could mean they should "select and retain appropriate service providers."

Such guidelines handed down from the federal government provide nice selling points for information destruction firms proposing to do business with companies in the financial segment.

GLBA may have helped spur banks and other lenders from a compliance viewpoint, but liability from suits filed by identity theft victims also spurred banks into action.

One Seattle area identity theft victim ended up filing 16 civil suits against lenders and credit reporting agencies after she spent two months in mental health facilities because of the trauma she says she suffered trying to rebuild her life after becoming a victim of identity theft.

Such civil suits multiplied by the potential pool of victims helped provide a quick wake-up call to the importance of information management to most lenders. If that was not enough, "Dumpster diving" segments by local TV news investigative reporters a few years ago became another way of rousing lenders into action.

Mike Tingle, president of Tri-R Shredding, Denver, (See cover story, "Beyond Shredding," ) says such tactics helped his mobile shredding company land a key client in the financial sector.

"We pitched one large bank in the 1990s and had met with a senior VP who said that they didn’t see the need for document shredding," Tingle recalls. "Shortly after that, my business partner at the time and I drove a mobile shredding truck we had purchased back from Canada over the course of a weekend. When we got back, a phone message from the bank was waiting. They wanted our service right away. Why the change? Because a TV news reporter ‘Dumpster dived’ the bank and found statement and credit reports with home addresses, account numbers, and other information."

Convincing banks that they need a shredding service is now much less of a challenge, says Tingle. "They now understand the regulations like GLBA and understand the need for the service."

The multi-branch nature of banks, however, can mean they merit special consideration when routing and possibly the purchase of additional equipment to serve them properly.

When a Midwest regional bank was looking for a shredding service provider who would need to operate in several states, Willie Geiser of Allshred Services, Toledo, Ohio, formulated a bid jointly with two other regional shredding companies to cover the geographic area necessary. As of last year, Geiser reported that the additional business helped prompt his company’s decision to invest in a larger facility and to acquire additional trucks and containers, as well as to add personnel.

Serving banks can require placing a variety of storage bins—from small collection bins near each teller station to large, metal outdoor containers that can be collected during off hours.

Once the routing and equipment logistics are worked out, though, Tingle says banks can be a pleasure to work with. "It’s easy to serve them on routes because they understand security and they understand confidentiality."

Banks generally also yield a good grade of recyclable paper, as what is placed into the locked bins consists almost exclusively of office-grade paper, much of it white. And, increasingly, they understand the critical importance of having an alliance with a secure destruction firm that can help them meet their regulatory mandates and protect them from potential lawsuits from identity theft victims.

The author is editor of Secure Destruction Business and can be reached via e-mail at btaylor@gie.net.