HOME Complying With the New Disposal Rule by Joshua H. Viau As most employers know, there are myriad federal and state laws and regulations governing how long various employment records must be maintained. Some employers, however, may not realize that to combat the problem of identify theft, there are now regulations dictating how employers may dispose of certain employee documents as well. Enter the “Disposal Rule.” Enacted as part of the federal Fair and Accurate Credit Transactions Act (“FACT Act”), which amended the Fair Credit Reporting Act (“FCRA”), the Disposal Rule dictates how employers must dispose of “consumer reports” (or other documents containing information obtained from such reports) as defined by the FCRA. Effective June 1, 2005, the Disposal Rule, which applies to all employers regardless of size or number of employees, requires that employers take reasonable steps to dispose of information obtained from consumer reports. If an employer’s negligence leads to the theft of an employee’s identity, the employer could be liable for the actual damages incurred, plus civil fines of up to $2500 per employee. The FCRA defines a “consumer report” as a report prepared by a consumer reporting agency, which is a third-party agency engaged in the business of providing such reports, that consists of any written, oral or other communications of any information bearing on an applicant or a employee’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used, expected to be used, or otherwise collected for employment purposes. The FCRA requires employers to obtain written authorization before obtaining a consumer report, and to provide information to the employee or applicant both before and after any employment decision is made relying on that information. The Disposal Rule requires that employers take “reasonable measures” to ensure the destruction of these reports and information obtained from them. Although the Disposal Rule does not define “reasonable measures,” it provides guidance on how employers can protect against the unauthorized use of consumer information at the disposal stage. At a minimum, employers should implement documentation retention policies or review existing policies and procedures to ensure that documents are retained in compliance with all applicable laws and that the documents covered by the Disposal Rule are disposed of in a way designed to protect against unauthorized access to or use of the information contained in consumer records. Employers should also maintain lists of categories of people with access to protected documents and provide training to ensure that employees responsible for disposing of the documents understand how long records should be retained, which records are covered by the Disposal Rule, and how those records should be destroyed. For more information, please contact the author at viau@elarbeethompson.com. [PRINTER FRIENDLY VERSION]