FCRA Disposal Rule for Consumer Reports

The Fair Credit Reporting Act (FCRA) is one of the foundational federal consumer protection laws governing how consumer reports — credit reports, background checks, tenant screening reports, and similar documents — may be obtained, used, and ultimately disposed of. The FCRA’s Disposal Rule, established under the Fair and Accurate Credit Transactions Act (FACTA), places specific obligations on businesses that receive consumer reports, requiring that these documents be disposed of securely to protect consumers from identity theft. For New York businesses — from the city’s financial services sector to its vast real estate industry, healthcare systems, and retail employers — FCRA disposal rule compliance is a legal requirement with real enforcement consequences.

New York City is home to one of the densest concentrations of consumer report users in the country. Property managers conducting tenant screenings, employers running background checks, lenders reviewing credit applications, and insurers assessing applicants all receive consumer reports that trigger FCRA disposal obligations. Understanding these requirements — and building a practical program to meet them — is essential for any New York business that uses consumer reports in its operations.

What the FCRA Disposal Rule Requires

The FCRA Disposal Rule (16 CFR Part 682) applies to any person who maintains or otherwise possesses consumer information derived from a consumer report for a business purpose. The rule requires that covered businesses take reasonable measures to protect against unauthorized access to or use of such information in connection with its disposal.

The Disposal Rule does not prescribe a specific destruction method, but lists examples of reasonable measures, which include:

• Burning, pulverizing, or shredding papers containing consumer information so the information cannot be read or reconstructed
• Destroying or erasing electronic files or media so the information cannot be read or reconstructed
• Contracting with a company engaged in the business of record destruction to dispose of material in a manner consistent with the rule

For paper-based consumer reports — printed credit reports, background check summaries, tenant screening results, employment verification documents — cross-cut shredding by a certified vendor is the standard approach that satisfies the Disposal Rule’s reasonableness requirement. Using a professional shredding service also provides documentation of the destruction event through a certificate of destruction, which helps demonstrate compliance in the event of an FTC or state attorney general investigation. Learn more about our compliance shredding services.

Who Is Subject to the FCRA Disposal Rule?

The FCRA Disposal Rule applies broadly to any entity that maintains consumer information derived from a consumer report. This includes:

• Employers: Any New York employer that conducts background checks on job applicants or employees — which includes most mid-to-large employers in the city — must dispose of those background check reports securely under the Disposal Rule.
• Landlords and property managers: Real estate companies, co-op boards, and individual landlords throughout New York City that pull tenant credit reports must follow FCRA disposal requirements when those reports are no longer needed.
• Financial institutions: Banks, credit unions, mortgage companies, and other lenders that obtain credit reports as part of loan underwriting are subject to the Disposal Rule for printed copies of those reports.
• Insurance companies: Insurers that use consumer reports to underwrite policies must dispose of those reports securely.
• Debt collectors: Businesses that purchase or use consumer report information in the debt collection process are covered by the Disposal Rule.
• Retailers offering credit: Any retailer that facilitates credit applications by collecting consumer report information must address disposal under FCRA.

Small businesses are not exempt. A single-location restaurant in Brooklyn that runs background checks on employees, or a small landlord in Queens with a handful of rental units, must comply with the FCRA Disposal Rule for any consumer reports they obtain. Visit our services page to explore shredding options suitable for businesses of all sizes.

FCRA Enforcement and Penalties

FCRA violations, including Disposal Rule violations, can result in significant penalties. The Federal Trade Commission (FTC) enforces the Disposal Rule and has imposed multi-million dollar settlements on businesses that failed to properly protect consumer information during disposal. State attorneys general — including the New York Attorney General’s Office — may also bring FCRA enforcement actions.

Penalties for willful Fcra violations include:

• Actual damages sustained by the consumer
• Statutory damages of $100 to $1,000 per violation
• Punitive damages (for willful noncompliance)
• Attorney’s fees and costs

Class action lawsuits under the FCRA are common and can aggregate statutory damages into multi-million dollar exposures. The FTC can also seek civil penalties of up to tens of thousands of dollars per violation in enforcement actions. Given these consequences, investing in a proper disposal program — including professional shredding with documented chain of custody — is clearly cost-effective risk management. Contact New York Shredding to discuss a program tailored to your consumer report disposal needs.

Building a FCRA-Compliant Consumer Report Disposal Program

A compliant consumer report disposal program for a New York business involves several practical steps:

1. Identify all consumer report users. Survey your organization to identify every department or function that obtains consumer reports — HR (for background checks), real estate (for tenant screening), finance (for credit reviews), and any others.
2. Create a records retention schedule for consumer reports. Consumer reports should not be retained longer than necessary for the purpose for which they were obtained. Define retention periods for each use case (e.g., keep job applicant background checks for three years after the application date to address potential employment discrimination claims).
3. Implement secure storage during retention. Consumer reports must be stored securely during their retention period. Locked file cabinets, access-controlled storage rooms, and clear “do not copy or email” policies for paper reports reduce the risk of unauthorized access.
4. Use certified shredding at disposal. When consumer reports reach the end of their retention period, destroy them using a certified shredding service. Collect and file the certificate of destruction.
5. Train employees on disposal requirements. Ensure that every employee who handles consumer reports understands the FCRA Disposal Rule and knows how to follow your organization’s disposal procedures. Document training completion.

New York Real Estate and Tenant Screening: A High-Volume Use Case

New York City’s rental market generates enormous volumes of tenant screening consumer reports. Property managers in Manhattan, Brooklyn, Queens, the Bronx, and Staten Island — as well as in suburban markets throughout Nassau, Suffolk, and Westchester Counties — routinely review credit reports, rental history reports, and background checks for prospective tenants. When a unit is rented or an application is rejected, the consumer reports that were reviewed must be disposed of securely.

For property management companies managing hundreds of units, the volume of consumer reports can be substantial. New York Shredding’s scheduled shredding service provides a regular pickup cadence and secure collection bins that make it easy to manage consumer report disposal in a high-volume real estate operation. Our service areas cover all five boroughs and extend throughout Long Island and Westchester, making us the right partner for property managers with a broad New York footprint.

Why New York Businesses Choose New York Shredding

For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.

Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.

Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services to ensure FCRA disposal rule compliance for your New York business.