By Will Shanley The Denver Post
Federal law – document destruction required even small businesses to adopt practice to fight identity theft.
• Possible penalties for violating new federal document-destruction provisions:
• Federal fines: Up to $2,500 for each violation.
• Civil lawsuits: Consumers may recover actual and punitive damages, as well as legal fees.
By the numbers:
• 10.1 million: number of identity-theft victims in 2003.
• 28 hours: the average time spent by victims to recover identities.
• $15,000: average amount spent by victims to recover identities.
• 25 to 34: age range most likely to be victims of ID theft.
Sources: National Association for Information Destruction; Federal Trade Commission and Javelin Strategy & Research
By Will Shanley
The Denver Post
Business owners beware: If you haven’t started shredding, you had better start soon.
Beginning June 1, a federal law will require business owners across the country to destroy all employee or consumer information taken from credit reports before tossing those papers or computer disks in the trash.
If information is not “shredded, burned or pulverized,” the provision says, business owners could be held liable. That means possible fines of up to $2,500 per violation, or lawsuits if violations are discovered or the discarded information results in identity theft.
The new regulation could cost some business owners cash and time.
Zack Pool, owner of Denver’s Mile Hi Ceramics, said his company already shreds everything from credit card numbers to vendor invoices, spending about $100 a month to hire it out.
Tom Hosea, owner of Proshred Security in Littleton, Colo., said the provision will affect businesses from “pizza parlors to beauty shops.”
“The trash is a treasure trove for an identity thief,” Hosea said.
The Mountain States Employers Council in Denver, which educates businesses on employment-compliance issues, supports the provision and is educating businesses about it.
“Added obligations are always concerning, but it’s hard to argue with this,” said Allan Estroff, the council’s director of employment legal services.
Estroff said more companies, especially large firms, or those in security or child care, are running background and credit reports on prospective employees.
The shredding industry, meanwhile, sees the provision as a chance to tap new customers.
The U.S. market for shredders — ranging from battery-operated models for home use to commercial operations that chew through tons of paper with mobile trucks — is about $350 million annually, said Steven Jacober, president of the School, Home and Office Products Association, an Ohio-based trade group.
He said concerns about identity theft and new state and federal regulations could fuel a 20 percent yearly increase in the shredding business in the next five years.
“The more factors that mandate the destruction of information, the more the shredding industry will grow,” Jacober said.
Bob Johnson, executive director of the National Association for Information Destruction, an Arizona-based paper-shredding industry trade group, said about 2,000 U.S. companies handle document destruction.
He said previous federal document-destruction rules, such as the Health Insurance Portability and Accountability Act and the Financial Modernization Act, spurred growth for the industry.
Those two regulations required hospitals and financial entities to develop safeguards to protect consumer information.
The new document-destruction requirement is one of 19 provisions included in 2003’s Fair and Accurate Credit Transaction Act, which allows people a free look at their credit report each year.
The Federal Trade Commission will oversee the provision’s enforcement.
States such as Georgia and Wisconsin already require businesses to destroy all personal information, regardless of source. In addition to credit reports, personal information such as that supplied on job applications or in criminal background checks is included.
Johnson said similar legislation could be forthcoming at the federal level.