FACT Act Rules for Disposing of Consumer Report Information

The Fair and Accurate Credit Transactions Act of 2003 (FACT Act) requires individuals and businesses that possess or maintain consumer report information for a business purpose to dispose of it properly. The Federal Trade Commission (FTC) final rule takes effect on June 1, 2005, and the federal banking agency rules take effect on July 1, 2005 (or later if you have a contract with a third party to dispose of the information). The following Qs&As will help you understand the new requirements.

Do these FACT Act disposal rules apply to all consumer/client information?

No. The FACT Act disposal requirements only apply if you maintain or possess consumer information from a consumer report for a business purpose. The term “consumer report” is from the Fair Credit Reporting Act and generally means any report on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living prepared by or obtained from an agency that collects such information. For real estate professionals, an individual’s credit report and record of insurance claims are two examples of a consumer report.

Am I subject to the rules?

The disposal requirements primarily affect REALTORS® acting as commercial real estate brokers, mortgage brokers, property managers, or landlords, but any REALTOR® with consumer information covered by the rule must have procedures covering the disposal of that information.

What do I have to do to comply with the FTC rule?

If you are subject to the FACT Act disposal requirements, you should review the applicable rule and establish policies and procedures for the proper disposal of consumer information by “taking reasonable measures to protect against unauthorized access” to it.
The requirements should not significantly change your business operations because you should already protect all sensitive consumer information—not just consumer report information—as a matter of good business practice.

Do the rules require you to dispose of consumer information on a regular basis?

No. The rules only apply when you dispose of the information. They do not require you to dispose of the information.

The FTC rule applies to everyone that possesses or maintains consumer report information for a business purpose. Are you also subject to the federal banking agency disposal rule?

Very rarely. Relatively few NAR members are covered by the FBA rules. If you are affiliated with a FDIC-insured savings association or a state bank, you may be subject to both the FTC and one of the FBA rules, and you should review both.

What are examples of reasonable measures under the FTC rule?

The FTC rule lists examples of the kinds of reasonable measures you may use when disposing of consumer information. The main thing to remember is that the measures you choose should protect against anyone having unauthorized access to or use of the information. Here is the non-exclusive list of the FTC examples of ways to protect consumer information:

• Burn, pulverize, or shred papers so the information can’t practically be read or reconstructed. [Note: For shredding, cross-cut shredders may be the best choice.]
• Destroy or erase electronic media—such as computer hard drives and floppy disks—so the information can’t practically be read or reconstructed. [Note: As you know, just deleting the files is not sufficient, since programs exist to recover the information.]
• Hire a third party to dispose of consumer information, after taking steps to assure yourself they are reliable. For example, you should review a third-party audit of its operations, get references from several sources, require trade association certification, or take other steps specified in the rule.
• If you are also subject to a rule of an FBA, incorporate the proper disposal requirements of the FTC rule into the required security program.

Where can I find the rules?

The FTC final rule was published in the Federal Register on November 24, 2004 (69 FR 68690).
The FBA final rules were published on December 28, 2004 (69 FR 77610).

Who can I call for more information?

The FTC Bureau of Consumer Protection, Division of Financial Practices, can be reached at 202/326-3224. You may also call Jeff Lischer, Manager, Financial Services, at NAR’s office in Washington on 202.383.1117.