FACTA added a new section to the FCRA that requires any person who maintains or otherwise
possesses consumer information, or any compilation of consumer information, derived from
consumer reports for a business purpose, to properly dispose of any such information or
compilation. The purpose of this provision is to reduce the risk of identity theft and other consumer
harm resulting from improper disposal of consumer information. The FTC and other federal agencies
have issued rules implementing this provision, which specify the reasonable measures that covered
entities must take to ensure secure disposal of consumer information, such as burning, pulverizing,
shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable
(16 CFR § 682.3). Reference: 1, 2, 3
