You must dispose of some employment documents that contain personal information by shredding or burning them. The Fair and Accurate Credit Transactions Act (FACTA), passed in 2003, imposed this requirement, effective in 2005, on all employers, regardless of size.

The purpose is to protect current, past and prospective employees’ personal information such as Social Security numbers, addresses, telephone numbers and any other information reported to an employer by a third party consumer reporting agency.

If you use an outside party to dispose of records, you must conduct due diligence in hiring a document destruction contractor. Due diligence could include:

Reviewing an independent audit of a disposal company’s operations and/or its compliance with this rule
Obtaining information on the disposal company from several references
Requiring that the disposal company be certified by a recognized trade association
Reviewing and evaluating the disposal company’s information security policies or procedures

If the information is stored on computer disks or other recordable media, it must be destroyed before discarding the media. If the data is stored on the hard drive of a computer that is being sold or donated to another party, the data must be removed in a way that makes it unrecoverable.

You must restrict access to personal information while it’s being stored. Failure to comply with the regulations could result in federal or state fines or civil liability in individual or class action lawsuits.

Disposing of Records

Recordkeeping