Protecting Against Identity Theft
If you don't have a shredder, it's time to get one. With identity theft on the rise, most of us have become more aware of how we dispose of our personal documents – bank and credit card statements, credit card solicitations received in the mail, medical information, receipts, etc. For many of us, shredding these documents is already a way of life. For businesses, it's the law. A provision of the Fair and Accurate Credit Transactions Act (FACTA) now requires that businesses destroy personal information obtained from or about employees and customers before it is thrown away.
To whom does this apply? Everyone. Whether you own a multi-million dollar business, or are just hiring a nanny (or anything in between), if you obtain personal information about an employee or customer, this applies to you.
What is considered "personal information?" Social Security numbers, financial account information, driver's license information, and other information that the Federal Trade Commission determines can be used for identity theft.
- You have your customers' credit card information.
- You checked someone's credit report before giving him or her a loan
- Your medical practice has patient records with personal information
- You have employees' bank information for payroll direct deposit
- You have social security and/or credit info about former, current, or potential employees
- You checked your nanny's credit report prior to employment or have her social security number for tax purposes
Before you throw away any of this information, you are required to destroy it first.
What are the appropriate destruction methods? Shredding, burning, pulverizing, or wiping of all paper or computer disks containing the personal information.
Why is this so important? According to USA Today, 7 million people were victims of identity theft in 2003, making it the fastest-growing crime in the USA. The average dollar amount charged in thefts was $92, 893, and victims spent and average of 600 hours and $1,495 (not including lawyers' fees) getting things straightened out. Since going through the trash, or "dumpster diving" is an extremely easy and effective way to get the personal information necessary to steal someone's identity, it's important that we all take better care in disposing of such information.
What are the penalties for not complying? If you don't comply and someone's personal information falls into the wrong hands, there are penalties:
- Civil liability. The victim could be entitled to recover actual damages sustained if his or her identity is stolen as a result of your inaction. Or you could have to pay statutory damages of up to $1,000 per violation.
- Class-action lawsuits. If large numbers of people are affected, they may be able to bring class-action suits and get punitive damages.
- Federal fines. The federal government could fine you up to $2,500 for each violation.
- State fines. States can fine up to $1,000 for each violation.
The good news is: Shredders now come in all sizes and price ranges, from large industrial shredders costing thousands of dollars to small battery operated shredders for under $20. For most small business needs, a heavy-duty personal shredder should be adequate. Look for a crosscut shredder that will shred credit cards and CDs in addition to paper. These range from about $50-$300 – an investment that could save you, your employees, and your customers the time, money, aggravation, and credit problems associated with identity theft.