Question

I work for a financial company, and when I was hired, I agreed that the company could conduct a background check. I am worried about identity theft, and I know my employer has this private information about me in my personnel file. Are there laws about protecting my information so it can’t be discovered or used by someone else?

Answer:

California law requires employers to protect confidential information about their employees. New rules under the Fair and Accurate Credit Transactions Act (FACT Act) require that employers properly dispose of documents and other records that contain consumer information. The Act applies to disposal of consumer information that occurs during the term of employment, or after leaving employment. The Act is aimed at reducing identity theft, it was signed into law on December 4, 2003, and it became effective June 1, 2005.

This Act applies to employers and businesses that maintain or otherwise possess consumer information for business purposes. Consumer information is broadly defined in the Act. It includes any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report. The Act applies to employers like yours who obtain consumer reports for employment screening purposes and conducting background checks.

Therefore, if your employer maintains information about you, including credit information, criminal background, or other information obtained through a background check, either on paper or on electronic media, the Act requires your employer to institute reasonable measures to properly dispose of the information. What is considered reasonable will vary depending on the employer’s nature and size, the cost and benefits of available disposal methods, and the sensitivity of the information involved.

The Act explains some of the reasonable measures that an employer may take to protect this information against unauthorized access or use. The examples include:

  • Implementing and ensuring compliance with policies and procedures that require the burning, pulverizing, or shredding of papers containing consumer information so that the information cannot be read or reconstructed.
  • Implementing and ensuring compliance with policies and procedures that require destruction or erasure of electronic media containing consumer information so the information cannot be read or reconstructed.
  • Entering into and monitoring compliance with a contract with another party engaged in the business of record destruction to dispose of consumer information. The rule requires that the employer exercise due diligence in hiring an information disposal company.

Some additional suggestions for employers include:

  • Implementing disposal methods and office-wide procedures for separating print and other media that contain consumer information from regular office refuse.
  • Consulting with a computer specialist about how best to dispose of the electronic information.
  • Informing all employees that have access to consumer information about the new law and the importance of compliance.
  • Coordinating the proper disposal of confidential information with procedures regarding record retention.

Each employer can make its own decisions about how to properly dispose of the consumer information. The goal is to make sure that no one can read or gain access to the information after it is disposed of by the employer. While employers have become accustomed to protecting confidential information, employers now need to take the next step to make sure their disposal methods for sensitive information continue that protection through destruction of confidential information. This may include traditional methods like shredding documents, erasing disks, and permanent email deletion.

There are severe penalties for failure to follow this new law. An employee can recover actual damages for all damages incurred from identity theft. An employer may be liable for statutory damages of up to $1000 per employee, and the federal government can fine the employer up to $2,500 for each violation.
– – – – – – – – – – – – – – – – – – – – – – – – – –
Back to Menu- Work Place Law 2005 Articles