Any business or individual who uses a consumer report for a business purpose is subject to the requirements of the FTC Disposal Rule. The Rule requires the proper disposal of information in consumer reports and records to protect against "unauthorized access to or use of the information." The Federal Trade Commission enforces the Disposal Rule.
According to the FTC, the standard for the proper disposal of information derived from a consumer report is flexible, and allows the organizations and individuals covered by the Rule to determine what measures are reasonable based on the sensitivity of the information, the costs and benefits of different disposal methods, and changes in technology.
Although the Disposal Rule applies to consumer reports and the information derived from consumer reports, the FTC encourages those who dispose of any records containing a consumer's personal or financial information to take similar protective measures.