Fair and Accurate Credit Transactions Act (FACT Act)

Additional HR Resources Prevent ID Theft at Work Protect your organization's employees from identity theft Record-Keeping Dos/Don'ts Covering your legal bases for retrieving, keeping, and destroying records Background Checks Follow the rules, know the risks, reap the rewards Protecting Sensitive Information What HR must do to protect employees from ID theft What Information to Save Learn what personnel information you must save, and what you can shred Electronic Information How to limit liability caused by employee use and abuse of workplace technology Employment Law in Your State Where your state lawmakers and fellow employers stand Federal Employment Law Advanced warning on upcoming federal regulations and legislation

Identity theft is a really hot topic not only in Congress but also in state legislatures across the country. In December 2003, Congress passed the Fair and Accurate Credit Transactions Act (FACT Act), which, among other things, requires employers to protect consumer information that is being discarded or disposed of. Many states also have enacted laws specifying how businesses must properly dispose of consumer information and may include requirements and penalties not in the FACT Act.

Related articles on FACT Act
FACT Act tools for Employment Law Letter subscribers

In general, the law requires anyone who has or maintains consumer information for a “business purpose” – such as getting a credit report as part of a background check to help decide whether to hire a job applicant – to use reasonable measures to dispose of the information in such a way that no one can gain unauthorized access to it.

To date, the FACT Act is the only federal law that specifically requires employers to take reasonable measures to reduce the risk of identity theft to their employees. The law – which is part of the Fair Credit Reporting Act – includes measures that are designed to prevent identity theft and other harm from a business’ improper disposal of confidential records.

Basically, businesses are required to take “reasonable measures” to protect against unauthorized access to or use of information that’s covered by the Act. That usually means shredding documents or making computerized data unusable before disposing of it.

The Federal Trade Commission has issued regulations that explain the law’s requirements. Specifically, the regulations clarify what types of information are covered by FACTA’s disposal requirements, what types of activities are considered “disposal” of that information, and what methods businesses can use to meet the law’s disposal requirements.

View all HR topics

Related articles on the FACT Act featured in HR Hero Line, HR Hero White Papers, and the Employment Law Post

• Update on FCRA: New Court Decision, New FACTA Regs
  (Oklahoma Employment Law Letter, December 2008)
• Employees Hold the Key to Employers' Data Security
  (Colorado Employment Law Letter, February 2008)
• Who Should Conduct Internal Workplace Investigations?
  (New York Employment Law Letter, July 2007)

HR Tools for FACT Act

• Sample Policy - Confidential and Proprietary Information
• Sample Policy - Use of Company Property and Materials
• Sample Policy - Security and Loss Prevention
• Sample Policy - Employment Records