Key Takeaways - FACTA Compliance
- FACTA (2003) amends the Fair Credit Reporting Act (FCRA) to help consumers fight identity theft.
- The Disposal Rule requires any business that uses consumer reports to adopt proper document destruction procedures.
- The Red Flags Rule requires financial institutions and creditors to implement identity theft prevention programs.
- FACTA applies broadly. From banks to landlords, employers, debt collectors and even individuals who pull credit reports.
- Three acceptable disposal methods. Physical destruction, electronic erasure, or outsourced destruction contracts.
- Enforced by the FTC, federal banking agencies and NCUA. Non-compliance carries statutory penalties.
"Dumpster Diving"Disposal of Personally Identifiable Information (PII)
The practice known as “dumpster diving” provides identity thieves with a treasure trove of personal data. Irresponsible information disposal by businesses has been cited in numerous instances of fraud. Under FACTA provisions, consumer reporting agencies and any business that uses a consumer report must adopt procedures for proper document disposal.
The Federal Trade Commission (FTC), the Federal banking agencies, and the National Credit Union Administration (NCUA) have published final regulations to implement the new FACTA Disposal Rule. The FTC's disposal rule applies to consumer reporting agencies as well as individuals and any sized business that uses consumer reports. The FTC lists the following as among those that must comply with the rule:
Lenders
Insurers
Individuals who obtain a credit report on prospective nannies, contractors, or tenants
Employers
Landlords
Government agencies
Mortgage brokers
Automobile dealers
Attorneys and private investigators
Debt collectors
Entities that maintain information in consumer reports as part of their role as service providers
Lenders
The definition of “reasonable measures," in reference to the FACTA Disposal Rule, specifies three possible ways to comply:
1. Burning, pulverizing, or shredding of physical documents
2. Erasure or destruction of all electronic media
3. Outsourcing contract with a third-party engaged in the business of information destruction
FACTA "Red Flag" GuidelinesWhat Updated With The FACTA Mandate?
Updates to FACTA mandate that financial institutions and creditors must comply with the identity theft “Red Flag” provisions by November 1, 2008. The ruling issued by the Federal Trade Commission (FTC) and 5 Federal bank regulatory agencies applies specifically to Section 114 of FACTA and addresses an array of accounts, organizations, and consumers, including:
- Retail and business customers
- Existing and new accounts
- Financial institutions and creditors
The FACTA rules and guidelines implemented in Section 114 of FACTA specify several categories of Red Flags which illustrate the types of activities that need to be identified:
- Alerts, notifications or warnings from a Consumer Reporting Agency
- Suspicious documents
- Suspicious personal identifying information
- Unusual use of, or suspicious activity related to, the covered account
Common QuestionsFrequently-Asked Questions
Here are answers to common questions about FACTA and the Red Flags Rule:
How does the FACTA Disposal Rule require consumer information to be destroyed?
The Disposal Rule requires anyone who maintains consumer information for a business purpose to dispose of it by taking reasonable measures to protect against unauthorized access or use. The FTC's examples include burning, pulverizing or shredding papers so they cannot be read or reconstructed, destroying or erasing electronic media so the data cannot practically be recovered, and hiring a record destruction company after due diligence on its practices. The rule also treats selling, donating or transferring storage media as disposal.
What is the focus of the Red Flags Rule?
The Red Flags Rule focuses on preventing identity theft in covered accounts. Issued in 2007 under Section 114 of FACTA, it requires financial institutions and creditors that offer or maintain covered accounts to implement a written Identity Theft Prevention Program. The program must identify relevant red flags, detect them, respond appropriately, and be updated periodically as risks change. The board of directors or a board committee must approve the initial program, and staff must be trained as necessary.
Does FACTA apply to employers and landlords?
Yes, when they use consumer reports. The FTC states that the Disposal Rule applies to people and to both large and small organizations that use consumer reports, including employers, landlords, lenders, insurers, mortgage brokers, automobile dealers, debt collectors, government agencies, and individuals who obtain credit reports on prospective nannies, contractors or tenants. The separate Red Flags Rule is narrower and applies to financial institutions and creditors that have covered accounts.
What does FACTA require on credit card receipts?
FACTA added a receipt truncation rule to the Fair Credit Reporting Act. Under 15 U.S.C. 1681c(g), a business that accepts credit or debit cards may not print more than the last 5 digits of the card number, or the expiration date, on a receipt given to the cardholder at the point of sale. The rule applies only to electronically printed receipts, not to transactions recorded solely by handwriting or by an imprint or copy of the card.
What is a FACTA disclosure in mortgage lending?
A FACTA disclosure in mortgage lending usually means the credit score notice given to home loan applicants. Section 212 of FACTA added Fair Credit Reporting Act section 609(g), effective December 1, 2004. A person who uses a credit score for a loan secured by 1 to 4 units of residential real property must disclose the score, the range of possible scores, up to 4 key factors that adversely affected it, the date it was created, and who provided it, along with a "Notice to the Home Loan Applicant."
