From trash to trouble: a year since it took effect, the FTC's disposal rule, aimed at curbing identity theft, remains largely unknown--or unheeded.

Crumpling up a consumer report and tossing it in the trash is a violation of federal law. This isn't news--it's the point of the Federal Trade Commission's (FTC) "disposal rule," and it has been on the books for a year.

The rule, which went into effect June 1, 2005, is meant to govern the way to dispose of consumer reports and any information derived from them. A "consumer report" is a document with information obtained from a company that compiles such reports that are used--or expected to be used--to establish a person's eligibility for certain purposes, most notably credit, employment, insurance or tenancy.

Apartment owners and management companies use consumer reports--including credit reports, credit scores, employment background checks and rental histories--to evaluate prospects, residents and potential employees.

Authorized by the Fair and Accurate Credit Transactions Act of 2003 (FACT Act), and part of a regulatory campaign to curb identity theft, the disposal rule applies to individuals and businesses of all sizes and in all industries. Although there are signs of industry compliance, it is believed that many apartment owners and management companies still aren't aware of the rule or the fact that it applies to them.

Why the Rule?

The maxim, "One man's trash is another man's treasure," proves frighteningly true when it comes to identity theft. According to national studies by Gartner Research and Harris Interactive, 7 million people fell victim to identity theft in the 12-month period before June 2003, the year the Fair Credit Reporting Act (FCRA) took effect. And in 2005, the year the disposal rule took effect, the FTC reported that identity theft continued to top its list of consumer complaints, representing 37 percent of the 686,683 complaints filed.

"Dumpster divers," as identity thieves have been termed, swim through waves of banana peels and pizza boxes--whatever it takes--to seize their catch of the day: an improperly discarded consumer report. To many, a report is a worthless piece of paper. But to the identity thief, finding a report can lead to greater riches than a stray piece of jewelry because of the information that the report contains.

With such sensitive information as a victim's Social Security number, driver's license number and bank account number, along with a name and address, a thief can go on a shopping spree and even take out loans, leaving an unsuspecting victim to take care of the bills.

What the Rule Requires

Compliance with the disposal rule prevents people from "having unauthorized access to or use of the information" in consumer reports after the reports have been discarded. Under the rule, individuals and businesses must take "reasonable measures" to ensure that the information can't be read or reconstructed, based on its sensitivity and considering the costs and benefits of different disposal methods and changes in technology. The rule is flexible and lists burning, pulverizing and shredding as examples of such reasonable methods.

"Shredding is probably the easiest and most practical compliance solution for many apartment owners," said Jay Harris, Vice President of Business Services for First Advantage Safe-Rent. A basic shredder can cost as little as $25, with heavy-duty shredders retailing for $150 to $350. Larger, more powerful models can demand more than $1,000. In contrast, a single violation of the disposal rule could cost a company a $2,500 federal civil penalty, a $1,000 state civil penalty, actual and punitive damages and attorney's fees.

The disposal rule also applies to consumer information that is stored electronically on a computer's hard drive or on a portable storage device, such as a disc, CD or DVD.

"Deleting a file may not be enough to comply with the rule if it means that thieves with data recovery skills can reconstruct the file," Harris said. In its comments to the rule, the FTC suggested that using a low- or no-cost computer utility to "wipe" a hard drive or storage device before disposing of it so that the information can't be reconstructed could be a reasonable method of complying.

It's also important to keep in mind that even deleting a file normally requires two steps. The first step just moves the file to the computer's recycle bin (Windows) or trash can (Macintosh), where the file remains completely readable to anyone who looks for it there. The second step, which many users don't take on a regular basis, requires emptying the recycle bin or trash can. Of course, if a company has no use for old hard drives or storage devices that may have sensitive consumer information on it, there's always a hammer.

Finally, the rule says that a reasonable measure may involve hiring a document disposal company after conducting due diligence. According to the rule, due diligence could include: reviewing an independent audit of a disposal company's operations and compliance with the rule; getting information about the company from several references; requiring that the company be certified by a recognized trade association; and reviewing and evaluating the company's policies and procedures for disposing documents that contain sensitive information.

Importance of Setting Procedure

Although the disposal rule is flexible and compliance may not require much money or effort, "it's essential that every office set its own compliance procedure to make sure that consumer reports are discarded properly," Harris said. When setting a procedure, Harris recommended taking the extra step of communicating the rule's purpose to all employees. "If people realize that the rule is aimed at curbing identity theft and that just one violation can lead to problems, they're more likely to follow a procedure consistently," he said.

Ed Safran, Chief Financial Officer of RentGrow Inc., a nationwide resident and employment screening company, shares this philosophy. On the day the disposal rule took effect, Safran made sure his customers knew about the rule with a notice, which he included in their next invoice.

In his notice, Safran explained the rule's purpose and outlined its requirements. He then advised his customers to adopt a procedure that involves shredding consumer reports to "ensure that the information is destroyed in a manner so that [it] cannot practicably be read or reconstructed." Safran followed up by responding to customers who called him with questions about the alert, and some months later he published an article in his company's e-newsletter to remind his customers of the rule and stress the importance of continuing compliance.

What the Rule Doesn't Require

The rule makes clear that it doesn't require businesses or individuals "to maintain or destroy any record pertaining to a consumer that is not imposed under other law." Owners' and management companies' attorneys often advise their clients to keep files (that include consumer reports) to support their reasons for rejecting prospects, at least until after the statute of limitations for a discrimination or other lawsuit has passed.

Many companies also keep consumer reports as part of an effort to comply with an affordable housing program's recordretention provision. "Compliance with the disposal rule doesn't mean rushing to throw away reports that you or your attorney believe should be kept for a valid business reason," Harris said.

Is the Industry Complying?

Generally, the disposal rule has "garnered a huge amount of interest," according to Katherine Armstrong, an attorney in the FTC's Bureau of Consumer Protection, Division of Privacy and Identity Protection, who personally has handled hundreds of phone calls from people with compliance questions. And a January 2006 survey by Javelin Strategy & Research found that a heartening "69 percent of consumers shred documents containing personal information prior to disposal."

As for how many apartment professionals are complying, it is difficult to know for sure, given the lack of an industry-specific survey.

"Owners and management companies that have a dedicated privacy officer are no doubt aware of the rule," Harris said.

Housing consultant A.J. Johnson, who has brought many companies up to speed on the rule after noting that they weren't aware of it, agrees. "Companies that have a structure in place for relaying information

from senior-level staff down to the property level are more likely to be complying with the disposal rule," Johnson said. "Most noncompliance is happening at less sophisticated companies without good top-to-bottom coordination or other means of keeping them up to date."

Sample Corporate Policy on Compliance With the FTC's Disposal Rule

Following is the policy written by a REIT, referred to as "the Company," on the FTC's Disposal Rule.

Privacy Policy

In response to the growing concern over the increasing threat of identity theft and to ensure we are in compliance with federal laws. [the Company] has adopted the Privacy Policy described below. As with all Company policies, it is every employee's responsibility to carefully read the policy and to comply with the Procedures set forth therein.

It is imperative that thiS policy be strictly followed. The failure to do so could subject [the Company] to civil liabilities financial penalties and potentially costly litigation.

Company Privacy Policy

[The Company] is committed to respecting the information that has been placed in our trust. This means caring for sensitive information--our customers' our employees' and our company's--throughout its life cycle. Every employee is responsible for ensuring that the consumer information [the Company] creates processes, stores and discards is kept secure. Documents containing consumer information ShOUld always be disposed of properly by placing them in the shredding bins. where they will be securely destroyed and recycled Preventing information theft is part of every employee's job. If you believe information in [the Company's] possession has been compromised, immediately notify the Director of Compliance.

Disposal Procedures

Federal law requires that [the Company] take reasonable measures to protect against unauthorized access to or use of consumer information. The documents that must be shredded for disposal include, but are not limited to guest cards containing consumer information lease applications, copies of drivers' licenses, credit reports, employment applications, etc. Essentially, any document that includes an individual's date of birth. Social Security number, address, driver's license number. credit and/or banking information or credit card and/or any other consumer information must be destroyed by shredding. NOTE: This policy also applies to consumer data and information stored electronically.

The proper disposal method of paper documents to ensure compliance is shredding, by use of secure shredding bins that have been obtained through a third-party vendor who will shred the documents.

In the event you are unsure if a document should be shredded, err on the side of caution and shred it.

Remember these documents need to be shredded only if they are being disposed of in compliance with [the Company's] Records Retention Policy located on the [the Company's] Intranet site.

Ron Leshnower is an attorney and freelance writer based in Syosset, N.Y. He can be reached at [e-mail].