Regulators Adopt Rule for Disposal of Consumer Credit Information

The federal bank and thrift regulatory agencies on Dec. 21 announced interagency final rules to require financial institutions to adopt measures for properly disposing of consumer information derived from credit reports.

Current law requires financial institutions to protect customer information

Like the proposal, the final rule defines "consumer information" to mean "any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by or on behalf of the [institution] for a business purpose."

In addition, the Agencies have continued to define "consumer information" to mean "a compilation of such records," as proposed.

The Agencies have modified the term "consumer information," however, to expressly exclude from the definition "any record that does not identify an individual." The Agencies believe that qualifying the term "consumer information" to cover only personally identifiable information appropriately focuses on the information derived from a consumer report that, if improperly disposed, could be used to commit fraud or identity theft against a consumer.

The agencies' final rules implement section 216 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) and include this new statutory requirement in the Interagency Guidelines Establishing Standards for Safeguarding Customer Information (retitled the Interagency Guidelines Establishing Standards for Information Security), which were adopted in 2001.

The final rules takes effect on July 1, 2005.

The Federal Register notice can be found at www.occ.treas.gov.