The Federal Trade Commission regulates and oversees, among other things, the Fair Credit Reporting Act, which encompasses CRA’s, employers, information sources, as well as establishing rights for consumers themselves. Background screening reports (Consumer Reports) must comply with all aspects of the FCRA that apply to the acquisition of information on a consumer. Previously, the FTC published “Opinion Letters” that are not law but are very helpful when interpreting the FCRA.

FCRA Document Destruction Rules
The Federal Trade Commission has promulgated regulations effective June 1, 2005 for the proper destruction of “consumer information.” The rules do not require that documents be destroyed; they merely set up parameters should a decision be made to destroy documents. Because these FTC regulations are limited to requiring the proper disposal of “consumer information,” they have been referred to as “the Disposal Rule.” Consumer information includes (a) consumer reports and (b) information derived from consumer reports, provided that the information is individually identifiable. As applied to the employment context, “consumer information” would include not only a background screen report obtained from a Consumer Reporting Agency but also, for example, notes prepared by a supervisor or human resources manager based upon information contained in the report. “Consumer information” encompasses information in both paper and electronic form.

The regulations require employers to take reasonable steps to prevent unauthorized use of, or access to, consumer information during the disposal process. While the regulations do not require any specific disposal methods, the regulations provide examples of the types of disposal processes that would be reasonable. Paper documents containing consumer information, for example, could be placed in locked trash bins while awaiting disposal and then shredded or burned. The regulations suggest that for consumer information stored on electronic media (hardware, floppy disks, CD’s, etc.) it would be reasonable for an employer to develop procedures to render the information irretrievable before disposal. While not specifically required by the regulations, the FTC suggests that businesses relying on third parties for the disposal of records containing consumer information should engage in due diligence before selecting, or continuing to use, a disposal company.