In December 2003, Congress passed the Fair and Accurate Credit Transactions Act (FACT Act), which, among other things, requires employers to protect consumer information that is being discarded or disposed of. Many states also have enacted laws specifying how businesses must properly dispose of consumer information and may include requirements and penalties not in the FACT Act.

State-by-state comparison of 50 employment laws in all 50 states, including credit reports

In general, the law requires anyone who has or maintains consumer information for a “business purpose” – such as getting a credit report as part of a background check to help decide whether to hire a job applicant – to use reasonable measures to dispose of the information in such a way that no one can gain unauthorized access to it.

To date, the FACT Act is the only federal law that specifically requires employers to take reasonable measures to reduce the risk of identity theft to their employees. The law – which is part of the Fair Credit Reporting Act – includes measures that are designed to prevent identity theft and other harm from a business’ improper disposal of confidential records.

Basically, businesses are required to take “reasonable measures” to protect against unauthorized access to or use of information that’s covered by the Act. That usually means shredding documents or making computerized data unusable before disposing of it.

The Federal Trade Commission has issued regulations that explain the law’s requirements. Specifically, the regulations clarify what types of information are covered by FACTA’s disposal requirements, what types of activities are considered “disposal” of that information, and what methods businesses can use to meet the law’s disposal requirements.