Scrutinizing FACTA

While FACTA covers a gamut of credit transactions, the section dedicated to proper disposal aims to coordinate a host of organizations to adopt comparable and consistent rules regarding the disposal of sensitive consumer credit report information.

While HIPAA (Health Insurance Portability and Accountability Act) targets the health care industry, and the Sarbanes-Oxley and Gramm-Leach-Bliley legislation address financial disclosure, FACTA aims to further reduce the potential for identity theft by protecting consumers from the risk that their confidential documents could be used by unauthorized people or for criminal acts.

Nate Segall, vice president of AccuShred LLC, a Toledo, Ohio, document destruction and recycling company, is upbeat concerning the impact FACTA will have on the shredding business. He says the legislation mandates that more companies will need to have some form of destruction policy in place.

While the section on document destruction is only a small part of FACTA’s overall regulation, Segall notes that the FTC worked very closely with the shredding industry to help ensure that the policy would be effective.

"The FTC came to NAID (the National Association for Information Destruction Inc., Phoenix) for assistance and requested NAID’s input during the comment period," he adds.

While document destruction companies are upbeat about the possibility of a boost in their business thanks to FACTA, they also have some concerns regarding the legislation. For one, some legitimate shredding companies worry that while the business opportunities created by the legislation could be significant, FACTA does not state the need for background checks for shredding companies or their employees.

Several comments from secure shredding companies and organizations representing the information destruction industry to the FTC have addressed the importance of not only properly shredding relevant documents but of ensuring that the company doing the shredding is above suspicion.

In comments submitted to the FTC last year, one secure shredding company officer mentioned that a competing company that has been offering shredding services has a fairly extensive criminal record. Some in the industry are worried that FACTA could potentially create a new avenue for less-than-reputable operators to access private documents, which could cast suspicion on many of the legitimate operators.

Segall adds that while FTC’s moves are good, he feels that there should be some flexibility to allow for individual states to pass stronger legislation. One major step in this direction would be allowing individual states to come up with harsher penalties for companies failing to properly destroy confidential documents.

Statements regarding FACTA from the Association for Information Management Professionals, Lenexa, Kan., read that to ensure that proper disposal is achieved by various businesses, "disposal procedures should be incorporated into an organization’s formal, written information retention and disposition program."

Although NAID has taken the lead in ensuring that companies are acclimated to the changes in business operations required by FACTA, misconceptions and misunderstandings on what FACTA covers continue.

While NAID and the document destruction industry have embraced FACTA legislation for its shredding aspects, the reality is that while the document itself is fairly substantial in scope, only a small section deals with document destruction. The rest of the document addresses such issues as identity theft and fair and accurate credit reporting.

The FTC has issued a report to Congress containing studies on credit report accuracy and completeness required by FACTA. The law, which was enacted in December 2003 and amends the Fair Credit Reporting Act (FCRA), requires the FTC to conduct an ongoing study of the accuracy and completeness of consumer credit reports and to report on four specific topics related to credit report accuracy.

The studies address proposals in Section 318 of FACTA and analyze the following: (1) the effects of requiring the nationwide consumer credit reporting agencies (CRAs) to match more points of consumers’ personal identifying information, such as a consumer’s name, Social Security number or address, to ensure that the correct consumer is matched with the correct credit file; (2) the effects of requiring that a consumer who has been denied credit based on information in his or her credit report receive a copy of the same credit report on which the creditor based the adverse action; (3) the effects of requiring that consumers be notified when negative information has been added to their credit reports; and (4) whether there are any common financial transactions not generally reported to the CRAs that would provide useful information in determining a consumer’s credit rating. The FTC also is conducting an ongoing, 11-year study of the accuracy and completeness of consumer report information as required by Section 319 of FACTA. This report will include the first of several interim reports on the ongoing study.

Bob Johnson, NAID’s executive director, says he feels that FACTA is a great start. He says that confidentiality has become emphasized within the medical and financial community with HIPAA and Sarbanes-Oxley, among other legislative drivers. It makes sense to continue expanding the coverage to this area.

While FACTA itself should be a boon to the shredding industry, a fair amount of publicity work will undoubtedly be needed. Segall says that the next year will likely be a year of education. "It will be interesting to see how it all plays out; how our industry handles it."

To help on the education front, NAID has put together a brochure that aims to explain to customers and prospects what the FACTA policy represents. The association says it hopes the brochure will clarify the current policies.

While the brochures printed by NAID have been very popular, Johnson feels that as more companies get a sense of the penalties and repercussions from failing to comply, there will be even greater interest.

Stanley Bond, with IndyShred, an Indiana-based shredding operator, says that while the FACTA legislation isn’t a perfect document, "it is a step in the right direction." And with identity theft burgeoning, the step is what many are clamoring for, he adds.

While agreeing with most of the FACTA regulation, during the comment period leading up to the issuance of the regulation, NAID mentioned the importance of clarifying several points.

"The rule should clarify that it is never reasonable for record owners to use standard garbage disposal methods when they have reason to know that consumer information is contained within their records, even when they possess only a small amount of this information. Given the tenacity of some dumpster divers, it is critical that the rule cover all consumer information," NAID’s comments read in part.

While the final ruling does not explicitly state that disposal means shredding, Johnson is comfortable that the FTC did recommend shredding as one of the most welcome methods of disposal.

NAID’s comments continue, adding that the disposal of documents should not hinge on the volume of the material. "From the perspective of consumers, the point is that sensitive financial information should be destroyed in a manner that prevents identity theft, regardless of whether a small company or a large company possesses that information."

While enforcement is still months away, shredding operators feel that educating clients now will be significant first step. This will give companies providing disposal services six months to get their customers acclimated to the requirements.

While the FTC has worked to develop FACTA, in essence, the organization has only minimal enforcement policies.

According to Beth Givens, director of the Privacy Rights Clearinghouse, a non-profit consumer protection agency based in San Diego, the FTC doesn’t have a sizable enough staff to do rigorous investigation. However, the agency may opt to make an example out of a particularly egregious violation, essentially shaming other companies into abiding by the new regulations.

In any case, the FTC may have to rely on concerned customers who use the agency’s hotline to report violations.

Johnson, however, feels that FTC has spelled out some substantial fines and options for violations.

Although the FACTA legislation alone helps to move the document destruction industry further along, NAID’s Johnson sees the regulation as another step in the United States’ continuing evolution as it becomes more acutely aware of the importance of reducing the possibility and opportunity for identity theft.

While compliance with FACTA is now law, companies affected by the new regulations will show growing interest in the law’s regulations during the next six months before enforcement kicks in.