The Federal Trade Commission issued the Fair and Accurate Credit Transactions Act in 2003, a law aimed at minimizing the risk of identity theft and consumer fraud. In November 2004, the FTC added the FACTA Disposal Rule to enforce the protection and disposal of sensitive consumer data.
The FACTA Disposal Rule says that "any person who maintains or otherwise possesses consumer information for a business purpose" must destroy discarded consumer information, whether in paper or electronic form.
Who must comply? Simply put, virtually everyone. Any business (whether employing one or thousands) using consumer information in its everyday operations or storing personal data as a business, such as banks, lenders, insurers, auto dealers, real estate agents, employers and record management companies, must safeguard consumer information. The law also applies to service providers that destroy information, from shredders, recyclers, waste management or technology disposal companies.