Every year, millions of employers across the United States run background checks, credit reports, and consumer reports as part of their hiring process. Under the Fair and Accurate Credit Transactions Act (FACTA), businesses that use these consumer reports have a legal obligation to dispose of them properly when they are no longer needed. The FACTA disposal rule for employers applies whether your business is a large corporation with a formal HR department or a small business in New York City that ran a single background check on a prospective employee. Getting disposal wrong can result in regulatory penalties and civil litigation — including class action lawsuits.
For employers in the New York metropolitan area — across Manhattan, Brooklyn, Queens, the Bronx, Staten Island, Long Island, and Westchester — understanding FACTA’s disposal requirements is an essential part of responsible HR and records management. Background check reports, credit reports obtained from consumer reporting agencies, and related documentation contain highly sensitive personal information: Social Security numbers, date of birth, financial history, criminal records, and more. When these documents are discarded improperly, they create serious privacy and identity theft risks for the individuals involved — and serious legal exposure for the employer.
What Is the FACTA Disposal Rule?
The FACTA Disposal Rule is a regulation issued by the Federal Trade Commission under the Fair and Accurate Credit Transactions Act of 2003. The rule became effective in 2005 and requires any person or business that maintains or possesses consumer information derived from a consumer report for a business purpose to take appropriate measures to protect against unauthorized access to or use of that information in connection with disposal.
The rule applies broadly — not just to credit bureaus or financial institutions, but to any employer that:
- Runs background checks on job applicants using a consumer reporting agency (CRA)
- Obtains credit reports to make employment decisions under the FCRA
- Receives tenant screening reports containing consumer information
- Uses any third-party consumer report for a business purpose
Even if the employer only ran one background check, and even if the candidate was not hired, the resulting report must be disposed of properly. The FACTA Disposal Rule is separate from (though related to) the FCRA’s requirements around how consumer reports may be used — it specifically governs what happens at the end of a report’s lifecycle.
What Does “Proper Disposal” Mean Under FACTA?
The FACTA Disposal Rule requires that consumer information be disposed of in a manner that protects against unauthorized access. For paper records, this means physically destroying the documents so that the consumer information cannot be read or reconstructed. The FTC has identified several methods that satisfy the rule’s requirements:
- Shredding: Cross-cut or micro-cut shredding of paper documents is the most common and reliable method. Simple strip-cut shredding is generally not considered sufficient because the strips can potentially be reassembled.
- Burning or pulverizing: Alternative physical destruction methods that render the information unreadable.
- Using a third-party destruction service: Contracting with a certified disposal company that takes reasonable steps to protect the consumer information and destroy it in compliance with the rule.
Placing background check reports in the general recycling bin, leaving them in unlocked filing cabinets, or simply deleting digital copies without destroying paper originals does not satisfy the FACTA Disposal Rule. The FTC has emphasized that employers must take affirmative steps to protect consumer information at disposal, not merely avoid obviously improper practices.
For New York employers, the certified shredding services provided by professional document destruction companies are the simplest and most defensible way to comply with the FACTA Disposal Rule.
Which Documents Are Covered?
The FACTA Disposal Rule covers “consumer information” derived from consumer reports. For employers, this typically includes:
- Background check reports obtained from CRAs (criminal history, employment verification, education verification)
- Credit reports obtained for employment purposes under the FCRA
- Printouts or copies of such reports maintained in applicant or employee files
- Notes made by HR personnel that transcribe information from consumer reports
- Any document that contains information derived from a consumer report
If your HR department keeps physical applicant files that include background check reports — even for candidates who were not hired — those files must be disposed of properly when they are no longer needed. New York employers should also be aware that the New York City Human Rights Law and the New York State Fair Credit Reporting Act have additional requirements around criminal background checks that may affect how long certain records must be retained before they can be destroyed.
FACTA and FCRA Retention Requirements for Employers
Before destroying consumer reports, employers must ensure that the applicable retention period has passed. Under the FCRA, employers must retain certain documentation related to adverse employment actions based on a consumer report — including the notice provided to the applicant and their opportunity to dispute inaccurate information. These records should generally be retained for a period consistent with applicable employment law requirements (typically one to three years, depending on the record type and applicable law).
Working with your employment attorney to establish a written retention schedule for consumer reports and related HR records is a good practice. Once the retention period expires, those records should be moved to a secure destruction queue and shredded on a scheduled basis. A recurring shredding program can automate this process, ensuring records are destroyed on schedule without requiring HR staff to make individual disposal decisions.
Consequences of Non-Compliance with the FACTA Disposal Rule
Employers that violate the FACTA Disposal Rule face regulatory and civil consequences. The FTC has authority to investigate and bring enforcement actions for violations, with civil penalties that can reach thousands of dollars per violation. But the more significant risk for many employers comes from private lawsuits brought by individuals whose consumer information was improperly disposed of.
Under the FCRA (which FACTA amended), individuals may bring civil actions for willful or negligent non-compliance, seeking:
- Actual damages suffered as a result of the violation
- Statutory damages of $100 to $1,000 per violation for willful violations
- Punitive damages for willful violations
- Attorney’s fees and costs
Class action lawsuits alleging FCRA/FACTA violations have resulted in substantial settlements for employers who failed to properly handle consumer reports. Proper disposal through a certified shredding vendor, combined with documentation via a Certificate of Destruction, is a straightforward and cost-effective way to protect your business from this exposure. Explore our service areas to see if we cover your New York location.
Practical Compliance Tips for Employers Using Background Checks
Building a FACTA-compliant background check and disposal program does not have to be complicated. For most New York employers, the following practical steps will address the core disposal requirements and significantly reduce legal risk. First, designate a specific person or team responsible for managing consumer report records. This ensures that background check reports do not drift into general filing systems where disposal decisions may be overlooked or inconsistent.
Second, establish a physical separation between consumer report records and other personnel file materials if your retention schedules differ. This makes it easier to identify records that are eligible for destruction without having to review the entire personnel file. Third, implement a locked shredding console in your HR or administrative area specifically for consumer report materials. Train staff that these documents must go into the locked console rather than a standard trash or recycling bin.
Finally, establish a quarterly or semiannual schedule for reviewing the consumer report file and identifying records past their retention period. Work with your shredding vendor to ensure that collection and destruction occurs promptly after the review. For New York employers with multiple locations across the city, island, or county, coordinating pickup across all offices with a single shredding vendor simplifies administration considerably. Check our service coverage to confirm we can reach all your locations.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.