Labor Employment Law Blog

Q. Are there any new rules governing employers regarding how they handle information from “consumer reports”?

A. Yes. Effective June 1, 2005, a new federal rule requires employers to take measures to dispose of sensitive information from consumer reports. The purpose of this new “Disposal Rule” is to reduce the risk of consumer fraud and identity theft.

The Disposal Rule broadly covers “any record about an individual,” including that in electronic form, that comes from a consumer report. The Rule requires employers to take reasonable measures to protect against unauthorized access to or use of such information. Examples of consumer reports include credit reports, credit scores, and reports relating to employment background, check-writing history, insurance claims, residential or tenant history, or medical history.

Liability for non-compliance with this rule can include actual damages or statutory damages up to $1,000; punitive damages; and attorneys’ fees and costs. If the Federal Trade Commission files an enforcement suit, the employer could be subject to additional civil penalties of up to $10,000 for each violation.

If they have not already done so, employers that obtain records that qualify as a consumer report should immediately implement a document destruction policy. They should also regularly monitor compliance with the requirements of the Rule, while also satisfying the law’s document retention requirements.