Identity theft: new era of info storage and disposal.

Identity theft is one of the fastest growing and most talked about crimes across the country. Recently, the media has reported several instances where security breaches at major corporations and financial institutions have put millions of consumers at risk. In one incident, 40 million credit card numbers were exposed when hackers illegally accessed a company's secure database.

While significant, this is not an isolated incident. In 2004, the Federal Trade Commission (FTC) estimated 246,570 reports of identity theft nationwide. The FTC also estimated in a 2003 report that identity theft costs consumers more than $5 billion. Consumers, however, are not the only victims--the same report estimated that the annual cost to businesses is a staggering $48 billion.

A major factor in this growing trend is the improper storage and disposal of individual's critical identification and financial information. A common misconception is that identity theft is limited to retail and consumer based sectors.

However, businesses in all sectors are vulnerable, and real estate, facilities management, mortgage lending and banking professionals must be vigilant because they access and maintain comprehensive employee, client, tenant, and customer files.

Federal lawmakers have taken action and issued new rules regarding the proper disposal of sensitive critical information. The FTC's Fair and Accurate Credit Transactions Act (FACTA) is one of several laws intended to combat consumer fraud, identity theft and protect privacy.

Issued this past January, FACTA broadly covers any individual's paper, electronic, or other form of personal or credit record. FACTA requires every person or company that possesses such information to take "reasonable measures" to protect against unauthorized access or use of the information.

Businesses can comply with FACTA by completely burning, pulverizing, or shredding any physical documents and completely erasing or destroying all electronic media. FACTA suggests businesses that are unable to perform these efforts in house, contract a service provider who specializes in information destruction.

While a number of businesses offer these services, companies must be vigilant in screening providers. Members of the National Association for Information Destruction (NAID) follow established guidelines for destruction of materials and many obtain industry certifications providing additional levels of protection. Some providers offer video monitoring of the destruction process, and all will give a certificate of destruction.

The penalties for violating the FACTA can include actual damages, statutory damages up to $1,000 punitive damages per violation (with no cap on class action damages), attorneys' fees, and civil penalties up to $2,500.

In addition to disposal laws, 10 state governments have passed legislation giving identity theft victims the power to freeze credit files and significantly affect how their critical information is accessed. A formidable issue victims face is undoing the damage to their credit report when thieves open new accounts using stolen personal information.

A security freeze allows individuals to prevent anyone access to their credit report for the purpose of granting credit unless the individual approves. When an individual is applying for credit, they can temporary lift the freeze so the application can be processed.

With more legislation promised in the coming months, many businesses are reevaluating their information storage systems to protect against identity theft and other information crimes including corporate espionage and fraud.

Technology is changing how businesses protect and archive information. As computer and the Internet speed increases, the use of electronic images continues to become more popular. Whether in house or with the assistance of professional archival firm, the cost of creating electronic archived pages is only slightly more than the direct duplication of documents, but with many security benefits.

Electronic documents and files are easily and securely stored on floppy disks, CD ROMS or directly on a removable computer hard drive that is disconnected from the Internet and from hackers.

Each format can be secured and access can be encrypted or password protected. Electronically storing critical information provides another barrier between important information and unscrupulous individuals who seek to take advantage of anything readily available.

Storing documents electronically also allows for easy search and retrieval of information.

Thousands of pages can be stored on one CD ROM eliminating file cabinets and the potential risk of identity thieves finding information "goldmines" in those back room storage boxes. Disaster recovery is also made easy when information is archived electronically and stored in a secure off site location by a service provider.

There is little doubt the rising threat of identity theft, and the legislation implemented to prevent it will profoundly affect business practices.

These changes mark a new era, where the controlled and monitored removal and destruction of information plays an important role in protecting businesses from the liabilities associated with consumer identify theft and related crimes.

MATT SKIDELL, ESQ.

PRESIDENT, DOCUMENT DESTRUCTION