Just when you thought there was enough regulations constraining your business, here's another, lesser known (set of) Rule(s).

Any business or individual who uses a consumer report, or any derivative thereof, for any business purpose is subject to the requirements of the Disposal Rule. And, the FTC is strongly recommending that any record containing a consumer's personal or financial information (read, name, address & account number) follow the same procedures.

Who is subject to the rule?  Anyone obtaining or using a credit report or any derivative thereof. Do you check credit scores on prospective clients? Do you credit screen prospective employees? Do you take any credit information on prospective tenants?

What's covered?  Any credit reports or derivatives (including simply credit scores) or any reports businesses or individuals receive with information relating to employment background, check writing history, insurance claims, residential or tenant history, or medical history."

What's required?  The rule requires disposal practices that are reasonable and appropriate to prevent the unauthorized access to - or use of - information in a consumer report.

We couldn't find any clarifying documentation to discern who decided what is 'reasonable and appropriate' but if bureaucrats are involved, think onerous and work backwards.

They did mention the establishment of specific disposal policies and articulated a businesses' duty of due diligence when selecting your document destruction contractor including checking references, reviewing their independent compliance audit, and reviewing and evaluating their procedures.

Forget the cruise. Better tell your spouse that you want a heavy duty shredder for Christmas. And if I were you, I'd have an independent auditor verify delivery too!

For A Printable .PDF of the Rules, click here!