If your New York business uses consumer reports — including credit reports, background checks, or employment screening data — you are subject to the FACTA shredding rule, a federal requirement that mandates secure disposal of consumer report information. Enacted as part of the Fair and Accurate Credit Transactions Act (FACTA) in 2003, the Disposal Rule applies to a remarkably broad range of businesses, from financial institutions and retailers to landlords and healthcare providers. Understanding and complying with the FACTA shredding rule is essential for any organization that touches consumer data.
Many New York business owners are surprised to learn they are covered entities under the FACTA disposal rule simply because they ran a background check on a job applicant or pulled a credit report before entering a lease agreement. The rule makes no distinction between large corporations and small businesses — if you obtained information from a consumer reporting agency and you are disposing of it, you must do so in compliance with federal law.
What Is the FACTA Disposal Rule?
The FACTA Disposal Rule (16 CFR Part 682) requires that businesses and individuals that possess consumer information derived from a consumer report must properly dispose of it by taking reasonable measures to protect against unauthorized access or use. This rule was promulgated by the Federal Trade Commission (FTC) and applies to both paper records and electronic media.
The rule is notable for its broad definition of “consumer information,” which includes:
- Any record about an individual — whether in paper, electronic, or other form — that is a consumer report or is derived from a consumer report
- Credit reports obtained from credit bureaus (Equifax, Experian, TransUnion)
- Background check reports used for employment screening
- Tenant screening reports used in rental applications
- Medical information obtained from consumer reporting agencies
- Any compilation, summary, or excerpt of a consumer report
Importantly, the Disposal Rule applies to the information itself, not just the original report. If an HR manager makes handwritten notes from a background check, those notes are also covered. Explore how our compliance shredding solutions address FACTA requirements.
Who Must Comply with the FACTA Shredding Rule?
FACTA compliance shredding obligations extend to any person or entity that maintains or otherwise possesses consumer information for a business purpose. This encompasses an extraordinarily wide range of organizations, including:
- Financial institutions, banks, credit unions, and mortgage companies
- Retailers and e-commerce businesses that offer credit or financing
- Landlords and property management companies that screen tenants
- Employers and HR departments that conduct background checks
- Insurance companies that use consumer reports in underwriting
- Healthcare providers and insurers that obtain consumer reports
- Debt collectors and collection agencies
- Auto dealers and lenders
If you are uncertain whether your New York business is covered under the FCRA FACT Act shredding requirements, the safest assumption is that you are — and the appropriate response is to implement a secure disposal process immediately. Contact us to discuss your specific compliance needs.
What Does “Proper Disposal” Mean Under FACTA?
The FACTA Disposal Rule requires businesses to take “reasonable measures” to protect against unauthorized access or use of consumer information during disposal. While the rule does not mandate a specific method, the FTC has identified the following as examples of reasonable measures:
- Burning, pulverizing, or shredding paper documents so that consumer information cannot be read or reconstructed
- Destroying or erasing electronic media so that the information cannot be read or reconstructed
- Entering into a contract with another party engaged in the business of record destruction to dispose of consumer information in a manner that is consistent with the rule
In practice, contracting with a NAID-certified professional shredding company is widely recognized as the most defensible method of compliance under the consumer information disposal rule. A certified shredding partner provides documented proof of destruction through a Certificate of Destruction, which serves as your compliance evidence in the event of an FTC investigation or lawsuit.
Penalties for Violating the FACTA Disposal Rule
The consequences of non-compliance with FACTA compliance shredding requirements are substantial. The FTC and state attorneys general actively enforce the Disposal Rule, and violations can result in:
- Civil penalties of up to $2,500 per violation under federal law
- Class action lawsuits from affected consumers seeking actual and statutory damages
- State-level enforcement actions under New York’s data protection laws
- Mandatory compliance monitoring and corrective action plans
- Reputational damage and loss of customer trust
The FTC has demonstrated its willingness to pursue enforcement actions against businesses of all sizes. In cases where consumer data has been found in dumpsters or improperly recycled, the resulting investigations have led to substantial settlements and years of compliance monitoring. New York businesses face particular scrutiny given the state’s strong consumer protection laws and active enforcement by the Attorney General’s office.
Building a FACTA-Compliant Document Disposal Program
Establishing ongoing compliance with the FACTA shredding rule requires more than simply shredding documents occasionally. A comprehensive disposal program should include:
- Inventory assessment — Identify all locations in your office where consumer report information is stored, used, or processed
- Secure collection containers — Deploy locked shred bins throughout the office to collect consumer information before it is destroyed
- Scheduled destruction — Establish a regular shredding schedule appropriate to your volume and risk level
- Vendor verification — Confirm your shredding vendor is NAID AAA certified and carries appropriate insurance
- Documentation — Retain Certificates of Destruction as proof of compliance for at least three years
- Employee training — Ensure all employees who handle consumer information understand the disposal requirements
Our professional shredding services include all of these elements and are specifically designed to meet FACTA compliance requirements for businesses throughout New York City and the surrounding region.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.