The Disposal Rule “requires the proper disposal of information in consumer reports and records to protect against ‘unauthorized access to or use of the information.’” [1]] “Reasonable measures for disposing of consumer report information could include establishing and complying with policies to: burn, pulverize, or shred papers containing consumer report information so that the information cannot be read or reconstructed; destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed; or conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule.” [2]
Penalties for non-compliance: “In some cases, consumers may be entitled to recover their actual damages sustained … which, in the case of identity theft, could be very large. In other cases, consumers may be able to recover statutory damages of up to $1,000 for each consumer affected by a violation of the rule. … Where large numbers of consumers are affected, they may be able to bring class actions seeking potentially massive statutory damages … Courts are also authorized to award punitive damages in either an individual suit or a class action. Finally, a successful plaintiff, or class of plaintiffs, may recover reasonable attorneys' fees. … In some cases, the government may bring an action in federal district court for up to $2,500 in penalties for each independent violation of the rule … The states are also authorized to bring actions on behalf of their residents and, in appropriate cases, may recover up to $1,000 for each willful or negligent violation of the rule … As with private lawsuits, moreover, the state may recover its attorneys' fees if successful in such an action.” [3]
