Source: https://www.privacyrights.org/blog/comments-facta-disposal-rule-rin-3064-ac77-fair-and-accurate-credit-transaction-act-disposal
Timestamp: 2019-04-24 06:31:09+00:00

Document:
FACTA §216, which adds §628 (15 U.S.C 1681w) to the Fair Credit Reporting Act (FCRA), requires the federal banking agencies, the National Credit Union Administration (NCUA), and the Federal Trade Commission (FTC) to adopt regulations about proper disposal of consumer information. Congress directed that final regulations be implemented not later than one year after enactment of FACTA. As discussed below, organizations here representing consumer interests consider the Agencies' proposal to be weak and inadequate to meet Congress' intended purpose of preventing identity theft and other fraud.
Irresponsible handling of sensitive consumer data has long been cited as a contributing factor to identity theft. A practice known as "dumpster diving" is often claimed by thieves themselves as the source of the data that allowed them to commit the crime. Sensitive data discarded by a financial institution provides a prime opportunity for a crook to access another's personal data.
By enacting §216 requiring proper disposal of consumer information, Congress has given the public one of the strongest tools yet in combating the growing crime of identity theft. It is now up to the financial regulators and the FTC to carry out Congress' intent by adopting strong regulations to ensure identity theft is no longer fed by careless and irresponsible disposal of confidential consumer data.
For 12 years, the PRC has worked directly with identity theft victims. We along with other consumer organizations submitting these comments have seen the devastation from this crime. We have learned of the many instances where identity theft could have been prevented by strong disposal standards imposed on business for documents and electronic records. We are concerned that the Agencies' proposal to modify existing guidelines rather than issue strict requirements dictated by regulation will not have the preventive effect Congress intended by adopting §216.
Although the Guidelines, which include a guideline for proper disposal of "customer" data, have been in effect since February of 2001, this has obviously not had a deterrent effect on identity theft. The number of victims and financial losses continue to rise. Had Congress not intended a strong standard for disposal, it would not have adopted §216. We urge the Agencies to do more.
The Disposal Rule, as proposed, defines "consumer information" as any record about an individual, in any form, including information that is derived from a consumer report. To fully encompass the scope of information included in §216, the Agencies should revise this definition to say " any record containing personally identifying information about an individual.".
In adopting the final Rule, the Agencies must recognize that an individual's identity is not necessarily limited to just the individual's name. The Agencies should be clear, for example, that the Social Security number (SSN) is identifying information. A list of SSNs, with nothing more, is sufficient data to allow a thief to open a new credit account, or start the process of assembling a consumer's identity for any number of illegal activities.
Another example, would be a list of consumer telephone numbers. Although generally included in the category of publicly available information, a telephone number itself may be the key to identifying a consumer and opening a door to stalking and harassment. There are now many Internet sites where entering a telephone number will readily reveal an address and even a map to the consumer's door. With the telephone number and address in hand, it is a short step to tying that telephone number and address to property records or other databases that reveal the consumer's name and much more.
In adopting the final Rule, the Agencies must be ever mindful of the resourcefulness of criminals to combine bits and pieces of personal information from several sources to create a consumer profile adequate to assume that consumer's identity. This information may also be purchased provided the purchaser has a limited amount of identifying information. As the growing number of victims indicates, and as some identity thieves themselves often readily admit, assuming another's identity for fraudulent purposes is not a difficult task. The crime is made all the easier by the vast array of Internet databases that allow thieves to quickly assemble a consumer's profile. And, a telephone number may be the only bit of information a criminal needs to get started.
A further example is one's electronic mail address. More and more, an individual's e-mail address is being used as a key identifier linking identities across multiple points of information. As individuals are getting their own domain names and using e-mail addresses attached to their domains, anyone can look up the domain and obtain an individual's street address in many cases. Until the WhoIs registration data is no longer published, which is not likely, this will continue to be a persistent problem.
For the sake of financial institutions covered by the Agencies' proposal, we suggest the Agencies' final Rule give financial institutions examples of information from a consumer report or derived from a consumer report that does not identify a consumer and thus would not be subject to the Guidelines.
The Agencies also seek comment on the proposed definition of "consumer information" that includes the qualification that the information is "for a business purpose." The Agencies interpret the phrase "for a business purpose" to encompass any commercial purpose for which a financial institution might maintain or possess "consumer information."
The Agencies should clarify that a "business purpose" is not limited to consumer report information received solely to obtain credit or assess a consumer's continuing eligibility to meet the terms of an existing account. The Agencies should recognize that consumer report information may be obtained through an employment background check for a current or prospective employee.
Financial institutions may also receive consumer report information from a consumer reporting agency that tracks consumers' use of checking accounts. Thus, the Agencies should be clear that "consumer information" includes information included in or derived from any "consumer report," not just a credit report obtained from a credit reporting agency.
It is clear from §216 that Congress recognized the role proper document disposal plays in preventing identity theft. Congress recognized, in addition, that the sensitive information included in consumer reports and information derived from consumer reports provides the only information a thief needs to access existing accounts or set up new accounts in the victim's name. To fully implement the preventive measures adopted by Congress, consumer report data as well as data derived from a consumer report must be flagged for proper disposal in the records of the financial institution.
The need to properly flag and track information subject to this rule is crucial in ensuring compliance. Information obtained in a consumer report originally obtained by a financial institution in response to a consumer's loan application may subsequently flow to other entities and be used in any number of ways. As the Agencies recognize, information may be manipulated and combined with other information or may be shared among affiliates.
Information may also be sent to a records storage facility and later on to an information disposal facility, either directly from the financial institution or through a storage facility. Information may also be shared with any number of service providers that perform billing, auditing, customer service, check printing and a range of other support activities.
To effect the disposal requirements of FACTA §216, the Agencies propose to amend the Guidelines to require financial institutions to modify existing security measures. The Agencies have declined to adopt a prescriptive rule to describe proper methods of disposal or to define what is meant by "proper disposal." The Agencies seek comment on whether the use of the phrase "proper disposal" is sufficiently clear.
The Agencies' proposal to implement FACTA §216 by amending the existing Guidelines falls far short of standards needed to have an impact on identity theft. The Guidelines, now in effect for a number of years, already require financial institutions to properly dispose of customer data. This vague standard has apparently had no effect on the crime of identity theft as the numbers of victims continue to rise.
The Agencies should define the term "proper disposal" with examples of procedures that would meet the definition of "proper disposal" for data maintained in paper as well as electronic form. The Agencies should also adopt strict standards so that financial institutions are not left to speculate about what the Agencies consider "proper disposal." As a minimum, the Agencies should be clear that "proper disposal" means a method of disposal that would render the information unreadable and incapable of being reconstructed. For paper records, the Agencies should clearly state that use of a cross-cut shredder or burning of documents are acceptable methods of disposal.
In addition, the interagency guidance issued through the Federal Financial Institutions Examination Council (FFIEC) should be adopted as requirements rather than guidelines. The guidelines for disposal included in the FFIEC IT Examination Handbook are fundamental to carrying out Congress' intent in adopting §216. For example, employees should always be prohibited from discarding sensitive media along with regular garbage. We also encourage the Agencies to adopt the FFIEC Handbook guideline that adequate employee background checks be required. This requirement should apply not just to employees of vendors, as the Handbook suggests, but rather to all individuals whose work entails handling sensitive personal information.
Given the staggering amount in economic loss that has resulted from identity theft in recent years, it makes good sense, for business and for consumers, for the Agencies to adopt strong standards for proper disposal of sensitive data. Great emphasis has been placed on giving consumers tips on steps to protect personal information against identity theft and other fraud. However, no matter how cautious a consumer is about guarding personal information, these efforts will be of little use if consumers cannot have confidence that personal information will be properly handled by institutions.
Existing versions of the Guidelines, adopted pursuant to GLBA, included disposal as a subordinate factor in a financial institution's overall security program. Now, with the passage of FACTA §216, proper disposal has become a major, independent factor in preventing identity theft and other fraud. We believe this change in focus on proper disposal requires the Agencies to adopt strong prescriptive measures for financial institutions.
The Agencies propose to require each financial institution to implement proper disposal for "consumer information" within three months after the final regulation is published. In proposing the three-month compliance date, the Agencies state that any changes to an institution's existing information security program to accommodate "consumer information" will likely be minimal.
Given the scope of the Agencies' proposal, we agree that changes to the financial institution's program will be minimal. We do not agree, however, that three months is needed to effect these changes. Financial institutions have been on notice for over six months, since FACTA was signed by the President in December 2003, that proper disposal will be required for consumer report data.
The Agencies' proposed changes to the Guidelines, as far as we can determine, place no additional burdens on financial institutions to adopt new programs, hire new staff, or engage more thorough service providers. The thrust of the Agencies' proposal seems to be business as usual for financial institutions with only the requirement that information identified as "consumer information" be included in existing disposal plans already established for "customer information."
Assuming the final Disposal Rules is effective one year after enactment of FACTA, as required by the statute, financial institutions will have, under the Agencies' proposal, three additional months to carry out the minimum changes required by the Agencies' proposal. This means that measures would not even be in effect until March of 2005. This is an unnecessary delay in implementation, while the number of identity theft victims continues to mount.
We have even greater concerns about the Agencies' proposal to allow financial institutions one year after publication of the financial Disposal Rule to modify existing contracts with service providers. This means -- assuming again that the final regulations will be effective in December, 2004 - that financial institutions will have until the end of 2005 to modify service provider contracts.
More likely than not, disposal will be accomplished by a service provider and not the financial institution itself. Disposal may also be accomplished by a disposal company retained by a service provider of the financial institution. As consumer information travels outside the institution's own files and from one service provider to another, the risk of inappropriate or fraudulent use of that information increases. It is thus crucial that financial institutions amend service provider contracts, where needed, within a more reasonable period of time. If the Agencies continue to allow financial institutions three months to implement proper disposal for "consumer information," it should also require that the institution's service provider contracts are modified by this time.
Given the minimum changes the Agencies have imposed on financial institutions for disposal, there seems to be nothing substantial, under this proposal, that would have to be modified in a service provider agreement. Disposal is already a part of the Guidelines for that category of information defined as "customer" data. A delay of two years for effective implementation of §216 is an excessive amount of time for consumers to expect reasonable disposal of their personal information.
The Agencies have proposed to add a new section of the Guidelines to require service providers by contract to implement appropriate measures designed to meet the objectives of the Guidelines. The Agencies further state that this requirement applies to both domestic and foreign-based service providers. We believe the Agencies are correct in requiring proper disposal to be included in service provider contracts.
A financial institution will be responsible under the final Guidelines for overseeing its service provider arrangements only when the service is provided directly to the financial institution. The Agencies clarified this point by amending the definition of ``service provider'' in the final Guidelines to state that it applies only to a person or entity that maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to the financial institution [emphasis added].
This exclusion does not provide adequate assurance that consumer information will receive "proper disposal" as required by §216. If a financial institution contracts some of its functions out, the financial institution should also be responsible to ensure that further disclosure to yet another service provider will be also subject to strict disposal standards. Such requirements should be included in contracts entered into between the financial institution and its first-line service provider.
We appreciate the opportunity to comment on the Agencies' proposal to implement the FACTA Disposal Rule. We again urge the Agencies to adopt stronger standards for the proper disposal of all data that includes sensitive personal information. These standards should apply to the financial institution and any service providers that possess information through the disposal process.
Calegislation is a resource center that provides consumer privacy information with a focus on public safety. Based in San Diego, the center provides educational information to consumers, legislators, and governmental agencies and is part of a national information sharing network of domestic violence advocates.

References: §216
 §628
 §216
 §216
 §216
 §216
 §216
 §216
 §216
 §216
 §216
 §216
 §216