Today marks the end of one year of publication of this Back to Basics Series. In looking over our past blogs, it becomes obvious that the Federal Trade Commission (FTC) has so much to do with the various laws, rules and regulations that regulate the consumer finance industry today.
The FTC was tasked with regulating unfair and deceptive business practices under Section 5 of the FTC Act way back in 1914. At current count, the FTC has 67 trade regulation rules on the books. Thirty-four of them have a direct impact on consumer financial services; twenty-five have consequences for consumer finance companies and credit sellers.
Over the last eight years, industry has kept a watchful eye on the Consumer Financial Protection Bureau created by the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act. Much of the Bureau’s regulatory focus has emerged from its authority to regulate unfair, deceptive or abusive acts and practices. But, we should not lose sight of the FTC Rules.
We have blogged about many of the Rules already, particularly the Holder In-Due-Course Rule, the Fair Credit Reporting Rules, the Credit Practices Rule, and the Safeguards Rule. Today I want to talk about an FTC Rule that is sometimes overlooked: The Disposal of Consumer Report Information and Records (the “Disposal Rule”).
The Disposal Rule is a rule that comes about as a result of the Fair and Accurate Credit Transactions Act of 2003, an amendment to the Fair Credit Reporting Act. This law was designed to reduce the risk of consumer fraud and related harms such as identity theft created by the improper disposal of consumer information.
The Rule is pretty basic, requiring any person who possesses consumer information to implement a program to properly dispose of such information. Examples of proper methods of disposal include burning, pulverizing or shredding of papers containing consumer information, or erasure of electronic media so that the information cannot practicably be read or reconstructed.
Then, there is the monitoring component, to make certain that the destruction effort is actually followed. Due diligence is required to make certain that the destruction of records and disposal of materials is accomplished in a manner consistent with the Rule.
Finally, there is a parting shot from the FTC. All persons subject to the Gramm-Leach-Bliley Act and the FTC Safeguarding Customer Information Rule (“Safeguards Rule”) are required to incorporate the proper disposal of consumer information into the “information security program” required by the Safeguards Rule. And, by “all persons,” the FTC is talking about YOU!
Practice Pointer: Take time to review your records retention and disposal practices to make sure that they are effectively doing the job required by the Disposal Rule.
Please note: This is the fifty-second blog in a series of Back to Basics blogs, in which relevant and resourceful information can be easily accessed by clicking here.