Identity theft is one of the fastest growing crimes in the United States today, affecting approximately 10 million people each year. Criminals are engaging in everything from sophisticated computer hacking to dumpster diving to obtain private information on individuals, which can be later used to obtain credit, or access for emptying out bank accounts. A typical manager will be in possession of documents which would be highly valuable to an identity thief. The primary documents which have the most information useful to an identity thief are the Application for Residency and the Consumer Report. The application will have the name, date of birth, Social Security number and bank account information of the applicant, all of which can be used by a thief. The Consumer Report will contain a list of all the applicants’ credit cards and other valuable information. In response to the rapid increase in identity theft fraud, the Federal Government through the Federal Trade Commission (FTC) has enacted new laws which directly affect the manager.

The Disposal Rule

Effective June 1, 2005, if you are a business that uses a consumer report, more commonly known as a Credit Report, you must dispose of this information in a specific fashion. Since most managers ask for an Application and subsequently receive a Credit Report, it is apparent that the Disposal Rules apply to the manager. The Disposal Rule requires disposal practices which are “reasonable and appropriate” to prevent the unauthorized access to or use of information in a “consumer report”. You will note that the law says “consumer report” and not “Application”. Many Federal rules when initially introduced are vague and confusing. As time goes by, the courts and the FTC “interpret” the rule. Obviously the purpose of the rule is to prevent identity theft; thus we strongly recommend that you apply the rule to the application as well as the Credit Report, as this is consistent with the intent and legislative history of the rule.

How Long and Where Should We Keep Documents?

The statute of limitation regarding disputes arising out of a contract such as a lease is 5 years. We recommend that you do not dispose of any files for a minimum of 5.5 years from the time the resident vacates the premises. While this may seem a bit extreme and cumbersome, if you are sued and do not have your file, anything can and will happen in court, and it will not be pleasant. Some people intentionally wait until the Statute of Limitations is almost up; as they know that most people will not have kept the records for this length of time. Your documents need to be kept in a safe place in your office and subsequently in storage. Most managers do not keep these files locked up or have a written plan in place as to file security or destruction. This needs to change.

Paper Records

Files should always be kept in a locked room or locked filing cabinets with access limited to persons designated in writing as having permission. These should only be employees that are bonded. Most managers do not consider the value the paper files have to an identity thief and are not in any compliance whatsoever. If records are sent to storage, there needs to be a specific procedure in place to prove chain of custody and detailing exactly who has access to files and when they accessed the files.

Computer Records

Most people find it difficult to throw out old computers. They pile up in the back room and eventually get thrown out or donated years after they will not run current programs. Most managers do not have password protection in place on their computers, making them vulnerable to an identity thief. Finally, most managers who are careful about backing up their computer data do not have a specific procedure for storing these backups. Managers need to immediately evaluate the safety of the data and create a written procedure which needs to be followed. If information from the resident’s application and consumer report will not be stored on or transmitted through a computer, the danger is significantly lessened.

How Should Documents, Hard Drives and Backups be Destroyed?

Paper documents should be shredded or pulverized. There are different levels of paper document destruction available, and we recommend that the documents are pulverized to avoid any problems later. Many managers purchase store bought shredders and pulverizes, but if operating on any kind of a large scale, document destruction companies will need to be utilized to carry out the larger document destruction tasks. Many local garbage disposal companies are jumping into the business of document destruction, and it is prudent to check this in addition to the smaller private companies. As chain of custody is crucial, most of the document destruction companies provide an on-site service that can be observed by the manager to avoid someone taking the documents to another location and using them for illegal means. Hard drives and backups can be physically destroyed by a manager or destroyed by the document destruction companies who deal with this as well as paper documents. The key is to have a plan in place, and this should be part of your written procedures for document safekeeping and disposal.

Does Everything Have to be Disposed of Properly?

Fortunately only certain information has to be disposed of according to the FTC rules. An examination of your resident files will probably show that only a few sheets contain information which could be successfully used by an identity thief. Most likely only the application and the consumer report will contain the sensitive information; therefore your procedure may limit the disposal to the destruction of only those documents.

FEDERAL TRADE COMMISSION INFORMATION

Disposing of Consumer Report Information?
New Rule Tells How

In an effort to protect the privacy of consumer information and reduce the risk of fraud and identity theft, a new federal rule is requiring businesses to take appropriate measures to dispose of sensitive information derived from consumer reports.

Any business or individual who uses a consumer report for a business purpose is subject to the requirements of the Disposal Rule. The Rule requires the proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.” The Federal Trade Commission, the nation’s consumer protection agency, enforces the Disposal Rule.

According to the FTC, the standard for the proper disposal of information derived from a consumer report is flexible, and allows the organizations and individuals covered by the Rule to determine what measures are reasonable based on the sensitivity of the information, the costs and benefits of different disposal methods, and changes in technology.

Although the Disposal Rule applies to consumer reports and the information derived from consumer reports, the FTC encourages those who dispose of any records containing a consumer’s personal or financial information to take similar protective measures.

Who Must Comply?

The Disposal Rule applies to people and both large and small organizations that use consumer reports. Among those who must comply with the Rule are:

Consumer reporting companies
Lenders
Insurers
Employers
Managers
Government agencies
Mortgage brokers
Automobile dealers
Attorneys or private investigators
Debt collectors

Individuals who obtain a credit report on prospective nannies, contractors, or residents Entities that maintain information in consumer reports as part of their role as service providers to other organizations covered by the Rule

What Information Does the Disposal Rule Cover?

The Disposal Rule applies to consumer reports or information derived from consumer reports. The Fair Credit Reporting Act defines the term consumer report to include information obtained from a consumer reporting company that is used – or expected to be used – in establishing a consumer’s eligibility for credit, employment, or insurance, among other purposes. Credit reports and credit scores are consumer reports. So are reports businesses or individuals receive with information relating to employment background, check writing history, insurance claims, residential or resident history, or medical history.

What is ‘Proper’ Disposal?

The Disposal Rule requires disposal practices that are reasonable and appropriate to prevent the unauthorized access to – or use of – information in a consumer report. For example, reasonable measures for disposing of consumer report information could include establishing and complying with policies to:

burn, pulverize, or shred papers containing consumer report information so that the information cannot be read or reconstructed;

destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed;

conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule. Due diligence could include:

reviewing an independent audit of a disposal company’s operations and/or its compliance with the Rule;

obtaining information about the disposal company from several references;

requiring that the disposal company be certified by a recognized trade association;

reviewing and evaluating the disposal company’s information security policies or procedures.

The FTC says that financial institutions that are subject to both the Disposal Rule and the Gramm-Leach-Bliley (GLB) Safeguards Rule should incorporate practices dealing with the proper disposal of consumer information into the information security program that the Safeguards Rule requires ( ftc.gov/privacy/privacyinitiatives/safeguards.html).

The Fair and Accurate Credit Transactions Act, which was enacted in 2003, directed the FTC, the Federal Reserve Board, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, the National Credit Union Administration, and the Securities and Exchange Commission to adopt comparable and consistent rules regarding the disposal of sensitive consumer report information. The FTC’s Disposal Rule became effective June 1, 2005. It was published in the Federal Register on November 24, 2004 69 Fed. Reg. 68,690, and is available at http://www.ftc.gov/os/2004/11/041118disposalfrn.pdf

The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint or to get free information on consumer issues, visit FTC.GOV or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

Your Opportunity to Comment The National Small Business Ombudsman and 10 Regional Fairness Boards collect comments from small businesses about federal compliance and enforcement activities. Each year, the Ombudsman evaluates the conduct of these activities and rates each agency’s responsiveness to small businesses. Small businesses can comment to the Ombudsman without fear of reprisal. To comment, call toll-free 1-888-REGFAIR (1-888-734-3247) or go to www.sba.gov/ombudsman.

“Serving the Property Management Professional”

www.evict.com      www.evicttv.com      www.evictforms.com      info@evict.com