Return to BTJ Online

Document disposal becomes business requirement

by Kathy Hagood
Brevard Technical Journal

Proper disposal of documents containing personal information - from employee records to credit applications - not only is a good idea, but is becoming a requirement for industries across the board.

June 1 is the effective date of the Fair and Accurate Credit Transactions Act of 2003 (FACTA), which requires all businesses the Federal Trade Commission regulates abide by proper disposal techniques. The medical and financial services industries already have had to address proper document destruction through previous FTC rules.

Space Coast document destruction companies, including Progressive Document Destruction in Cocoa, have seen some increase in business associated with the new rule. Greater demand is expected as the rule goes into effect.

"Many businesses don't realize they will have to comply with FACTA, but as the effective date nears, there will be more media coverage and increased awareness," said Tiffany O'Brien Johnston, director of operations and business development for Progressive Document Destruction.

The new document disposal rule is designed to help avoid identity theft, which has become a growing problem across the country.

The protective measures have become critical. An FTC study in 2004 showed more than 10 million consumers fell prey to identity theft in 2003.

And a more recent study by Javelin Inc. showed that most identity theft, 88 percent, comes from a paper trail, means such as "dumpster diving" and stolen wallets, rather than over the Internet.

"Many business owners don't think about someone diving in their dumpster for information, but it happens every day. It's just too easy for someone looking for identities to steal," O'Brien Johnston said.

The FACTA rule, which applies to all businesses the FTC regulates requires entities "take reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal."

The new rule gives direction as to what types of disposal are appropriate, including document destruction means such as paper shredding, noted Bob Johnson, spokesman for the National Association for Information Destruction Inc.

NAID represents about 2,000 document destruction companies across the country and helps educate those in the document destruction industry about best practices.

"Past rules didn't specify how to properly dispose of records. The new rule does," Johnson said.

That means small operations that generate few consumer records can simply use an office shredder to cover themselves.

But small to large operations that generate many records will need to obtain high-volume shredders and earmark staff time for proper destruction or outsource their document destruction.

"Document destruction can be time consuming without the proper equipment. We did a study for one of our clients and found they saved 45 percent by outsourcing their document destruction rather than assigning it to their staff, even though they had a fairly high volume shredder," O'Brien Johnson said.

Also, most businesses don't have the means to shred such data sources as floppy disks, CDs and computer tapes.

Although specific techniques such as paper shredding are specified in the new rule, businesses will still be held accountable for proper disposal. They will not simply be able to hire any document destruction company to cover themselves, NAID's Johnson said.

"If someone comes after them in a lawsuit businesses will have to show they properly researched the document destruction company they hired and that that company followed adequate security measures," Johnson said.

Document destruction companies should follow best practices such as conducting employee background checks and drug testing. Procedures for handling secure documents should also be specified.

NAID features a certification program for its members, which includes an annual audit. "A company can be following proper procedures without being certified, but certification offers businesses a level of assurance about the document destruction company they are considering," Johnson said.

Progressive Document Destruction is NAID certified, for example. The company, which seeks to follow the highest industry standards, believes certification is important.

"Otherwise how does your client really know if you're following proper procedures," O'Brien Johnson said.

Her company provides both on-site and off-site document destruction. Business managers can view on-site destruction with closed circuit TV. Secure dumpsters are used for off-site destruction.

"When a company has a Department of Defense contract, for example, they may want to see the destruction with their own eyes," O'Brien Johnson said.

For more information, visit the FTC's Web site at www.ftc.gov and the NAID Web site at www.naidonline.org