Got a nanny?
You need a shredder

Bob Sullivan Technology correspondent • Profile • E-mail

Got a nanny? Or a tenant? Then you probably need a paper shredder. Or at least a wood-burning stove.

On Wednesday, a new federal law kicked in requiring those who handle other people's personal information to dispose of the data properly.  Recycling the paperwork isn't good enough -- it must be destroyed, the rule says, rendered useless to anyone who might stumble upon it.

The disposal rule, developed by the Federal Trade Commission, covers, all employers, large and small -- even those with only one employee. 

"You might be surprised," warned FTC attorney Catherine Armstrong.  "If you hire a contractor or a nanny, you are covered by this law."

Even if you ordered a background check on your kid's coach, or nanny, or -- as is the latest trend in online dating -- on a prospective blind date, the law applies to you.

Transgressions -- such as tossing paperwork containing personal information into a recycling bin, or leaving it on a discarded computer's hard drive  -- might be costly.  The FTC can sue and obtain fines of up to $2,500 for each instance of neglect.  State attorneys general can also enforce the law. Victim consumers can, too. People who spot their old medical forms in a dumpster outside a doctor's office can obtain damages of up to $1,000, the rule says, if a judge agrees the dumpee was willfully negligent.

Carelessly discarded consumer reports have swelled in recent years, as the use of such data has become much more widespread. Background checks involving credit reporting data and other information have become increasingly common -- even by home consumers -- as companies like ChoicePoint make accessing reporting data easier and cheaper.  For its part, ChoicePoint says it is now training its operators to warn consumers doing "nanny checks" that they'd better be careful how they throw out that data.

'Need to plug the gaps'
The disposal rule is part of the 2003 Fair and Accurate Transaction Act, which contains dozens of provisions designed to slow the growth of identity theft, a crime that affects about 10 million Americans each year.

Some financial institutions and medical offices were already covered by other laws mandating safe records disposal, but the new regulations cover a wide swath of industries that deal in consumer data: mortgage brokers, auto dealers, private investigators, to name a few.

"We needed to plug all those gaps," said Michigan State's Judith Collins, author of Preventing Identity Theft in Your Business.

What to look for in a shredder — Cross or confetti cut: Simple strip-cut shredders don't do the trick. — Strength: Can it cut through staples?  How about credit cards? Data CDs? Diskettes? — Durability: Many shredders must be turned off to cool after just a few pages. That's OK for most consumers.  But if you plan to destroy a lot of paperwork, a more durable model might be in order. — Capacity: The more pages you can shred at once, the less time you'll waste destroying those unwanted credit card applications. The credit card industry sends out about five billion each year. — Auto on/off: A nice have, not a must. But if it helps you maintain good shredding habits, it might be worth it.

The 2003 law instructed the FTC to come up with proper disposal rules, which it published in November. Data-gatherers had 6 months to get their acts together and get to the shredder store.

Alas, much like consumers who line up outside air conditioner retailers on the first hot day of summer, shredder sales didn't really begin to spike until this week, said John Fellowes, spokesman for Fellowes Inc., a shredder maker. Of course, the law is seen as a boon for the industry.  Fellowes said his business saw a double-digit percentage spike in recent days.

Privacy advocates said the rule will also be boon for consumers.

While the disposal rule only covers consumer credit reports and information derived from credit reports, experts say it's best to destroy anything that includes personal information because the definition is not crystal clear.

"I certainly think it's a good idea that we have some better business practices," said Tena Friery, research director at the Privacy Rights Clearinghouse. "It is a step in the right direction."

MORE FROM SECURITY

Security Section Front

Nearly 1 in 3 older teens gets ‘sexting’ messages Australia to block obscene, crime-linked sites After criticism, Facebook tweaks settings again Court reviews employer access to texts NYT: U.S., Russia open talks on cyberwar limits Red Tape: Holiday ‘cyberbegging’ grows on eBay Internet users lured to oppose health bills 5 things to know about Facebook’s new settings Facebook privacy revamp draws fire Facebook gives users more privacy controls Security Section Front   Add Security headlines to your news reader: