16 CFR Part 682 — Disposal of Consumer Report Information and Records

PART 682—DISPOSAL OF CONSUMER REPORT INFORMATION AND RECORDS Authority: Pub. L. 108-159, sec. 216. Source: 69 FR 68697, Nov. 24, 2004, unless otherwise noted. § 682.1 Definitions. (a) In general. et seq. (b) “ Consumer information (c) “ Dispose, disposing, disposal (1) The discarding or abandonment of consumer information, or (2) The sale, donation, or transfer of any medium, including computer equipment, upon which consumer information is stored. § 682.2 Purpose and scope. (a) Purpose. (b) Scope. § 682.3 Proper disposal of consumer information. (a) Standard. (b) Examples. (1) Implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, or shredding of papers containing consumer information so that the information cannot practicably be read or reconstructed. (2) Implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media containing consumer information so that the information cannot practicably be read or reconstructed. (3) After due diligence, entering into and monitoring compliance with a contract with another party engaged in the business of record destruction to dispose of material, specifically identified as consumer information, in a manner consistent with this rule. In this context, due diligence could include reviewing an independent audit of the disposal company's operations and/or its compliance with this rule, obtaining information about the disposal company from several references or other reliable sources, requiring that the disposal company be certified by a recognized trade association or similar third party, reviewing and evaluating the disposal company's information security policies or procedures, or taking other appropriate measures to determine the competency and integrity of the potential disposal company. (4) For persons or entities who maintain or otherwise possess consumer information through their provision of services directly to a person subject to this part, implementing and monitoring compliance with policies and procedures that protect against unauthorized or unintentional disposal of consumer information, and disposing of such information in accordance with examples (b)(1) and (2) of this section. (5) For persons subject to the Gramm-Leach-Bliley Act, 15 U.S.C. 6081 et seq., § 682.4 Relation to other laws. Nothing in the rule in this part shall be construed: (a) To require a person to maintain or destroy any record pertaining to a consumer that is not imposed under other law; or (b) To alter or affect any requirement imposed under any other provision of law to maintain or destroy such a record. § 682.5 Effective date. The rule in this part is effective on June 1, 2005.

Related documents

• 36 CFR Part 703 — Disclosure or Production of Records or Information#509049
• 12 CFR Part 1070 — Disclosure of Records and Information#505527
• 16 CFR Part 314 — Standards for Safeguarding Customer Information#506044
• 49 CFR Part 801 — Public Availability of Information#511939
• 25 CFR Part 43 — Maintenance and Control of Student Records in Bureau Schools#507418