Credit Trans

Fair and Accurate Credit Transactions Act

A largely ignored provision of the 2003 Fair and Accurate Credit Transactions Act (FACT Act) requires car dealers to dispose of consumer report and credit information "properly."

Beginning June 1, 2005, any person who maintains or possesses "consumer information" must be prepared to dispose of these records in a way that ensures that the information will not be improperly accessed or used.

This requirement is one of many provisions in FACTA intended to protect consumer privacy and to prevent identity theft.

So, dealers who pull a credit report or any other investigative report regarding a credit applicant or employee should have a plan to dispose of that information in the future.

The FACT Act adds an additional obligation to the Fair Credit Reporting Act ordering the Federal Trade Commission (FTC) to issue regulations to require "any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation." Without much fanfare, the FTC issued a final rule on November 24, 2004, addressing the disposal of consumer report information and records.

The new rule is designed "to reduce the risk of consumer fraud and related harms, including identify theft, created by improper disposal of consumer information."

It applies to any person over whom the FTC has jurisdiction and who maintains or possesses consumer information for business purposes.

Accordingly, car dealers that collect consumer information are covered.

The rule requires the proper disposal of consumer information.

Specifically, you now must take "reasonable measures" to protect against unauthorized access to, or use of, the information when you dispose of it.

The rule provides several examples of "reasonable measures" to prevent unauthorized access or use of the information when it is disposed.

The examples are not intended to be all-inclusive, but they do illustrate how you can comply with the standard.

  1. Implement and monitor policies that require your employees to burn, pulverize, or shred papers containing consumer information so that the information cannot practicably be read or reconstructed.
  2. Implement and monitor policies that require your employees to destroy or erase electronic media containing consumer information so that the information cannot practicably be read or reconstructed.
  3. Enter into a contract with another party engaged in the business of record destruction to dispose of the material properly.

You also must use "due diligence" to ensure that the third party complies with FACT Act and identifies which material is consumer information.