Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: FTC seeks comment on rule governing disposal of consumer report records, (Sep 12, 2016)
As part of the FTC’s overall effort to systematically review its rules and guides, the agency is requesting public comment on its "Disposal of Consumer Report Information and Records" regulation (12 CFR Part 682). In addition to evaluating the economic and technological impact of the Disposal Rule, the FTC is particularly interested in ascertaining whether the rule’s definition of "consumer information" should be expanded to include "aggregate information or information that can be reasonably linked to an individual." The FTC’s notice on the Disposal Rule indicates that comments must be received by November 21.
The Disposal Rule implements part of the Fair and Accurate Credit Transactions Act of 2003—which amended the Fair Credit Reporting Act.
Rule’s objective. As observed by the FTC’s press release, the Disposal Rule requires those persons who possess consumer report information for a business purpose to properly dispose of the information by taking reasonable measures to protect it from unauthorized access. The rule pertains to both print and electronic records.
Commenting on the Disposal Rule, a recent FTC blog post emphasizes that, after a credit or employment decision has been made, companies and their personnel must keep the sensitive information "out of the hands of hackers, dumpster divers, and data thieves—and thereby reduce the risk of fraud and identity theft."
Comment request. To elicit comment and facilitate feedback about the Disposal Rule, the FTC poses several specific questions in its notice. For instance, the FTC asks whether the rule should be modified to:
include more specific and prescriptive requirements for disposing of consumer information;
remove any existing examples, or include additional examples, to illustrate the "proper methods" for disposing of consumer information;
reference or incorporate any other information destruction standards or frameworks, and, if so, whether these standards should be considered "safe harbors" for compliance;
include, under the "consumer information" definition, information that can be "reasonably linked to an individual in light of changes in relevant technology or market practices"; or
add a definition addressing "aggregate information" or "blind data."
News: ConsumerProtection FederalTradeCommissionNews