I've finally been able to get down on paper a glossary of terms related to identity theft, privacy, and document destruction. For the most part, the terms below relate to various federal laws passed within the last 20 years.
It's kind of long and not extremely interesting unless you're looking for exactly this sort of thing. I tried to include links to the various government websites relating to the laws. With that said, it could be useful as a good starting point for more research into the subject.
This is also posted on the
Total Secure Shredding website.
California vs. GreenwoodThe U.S. Supreme Court ruled that the "expectation of privacy in trash left for collection in an area accessible to the public... is unreasonable." Consequently, when you throw something in the trash, anyone that happens to come across your documents is able to take whatever they like.
Health Insurance Portability and Accountability Act of 1996 (HIPAA)Privacy Rule: Entities covered by
HIPAA much have policies and procedures in place to safeguard patient medical information and to minimize its disclosure.
Who this Covers:- Health Plans: This includes such entities as Insurance companies, HMO’s, and Corporate Health Plans.
- Most Health Care Providers: Doctors, Dentists, Chiropractors, Nursing Homes and the like.
- Health Care Clearinghouses: Entities that transcribe patient medical data.
What is protected:
- Information that is put into your medical records.
- Conversations your doctor has regarding your medical care and treatment.
- Electronic medical records.
- Billing information.
For more information see the U.S. Department of Health & Human Services website: www.hhs.gov/ocr/privacy/index
Economic Espionage Act of 1996
This act makes commercial trade secret theft a federal crime. One aspect defining a trade secret is that there must be reasonable measures in place to preserve its secrecy. Consequently, items found in the trash or recycling bin may not be considered secret and may hinder effective prosecution.
Graham-Leach-Bliley Act of 1999
Also know as the Financial Modernization Act of 1999, this act acts "to protect consumers' personal financial information held by financial institutions."
- Financial Privacy Rule: This rule requires financial institutions to provide their customers "privacy notices" on how thier personal financial information will be collected and shared. Also, customers are provided the opportunity to limit how some of their information will be shared.
- Safeguards Rule: Financial Institutions are required "have a security plan to protect the confidentiality and integrity of personal consumer information."
- Pretexting: Prohibits using "false pretenses" to acquire personal consumer information.
Some examples of financial institutions that are covered includes tax preparers, lenders, mortgage brokers, credit counselors, and those institutions that transfer or safeguard money.
For more information see the FTC website
Fair and Accurate Credit Transactions Act (FACT Act or FACTA) of 2003
This act amends Fair Credit Reporting Act that was passed in 1970. This amendment promotes accuracy in consumer reports and is meant to ensure the privacy of the information in them.
FACTA Disposal Rule
"The FACTA Disposal Rule requires disposal practices that are reasonable and appropriate to prevent the unauthorized access to, or use of, information in a consumer report." (http://www.ftc.gov/opa/2005/06/disposal.shtm)
Reasonable measures for disposing of consumer report information could include the use of a third party shredding company to destroy any consumer report information.
FACTA Red Flag Rules
These regulations require development and implementation of written identity theft programs. These new rules apply to financial institutions and creditors with covered accounts.
- Financial Institutions: "Defined as a state or national bank, a state or federal savings and loan association, a mutual savings bank, a state or federal credit union, or any other entity that holds a 'transaction account' belonging to a consumer."
- Transaction Account: "A deposit or other account from which the owner makes payments or transfers. Transaction accounts include checking accounts, negotiable order of withdrawal accounts, savings deposits subject to automatic transfers, and share draft accounts."
- Creditor: "Any entity that regularly extends, renews, or continues credit; any entity that regularly arranges for the extension, renewal, or continuation of credit, or any assignee of an original creditor who is involved in the decision to extend, renew, or continue credit. Accepting credit cards as a form of payment does not in and of itself make an entity a creditor. Creditors include finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies. Where non-profit and government entities defer payment for goods or services, they, too, are to be considered creditors."
- Covered Account: "An account used mostly for personal, family, or household purposes, and that involves multiple payments or transactions. Covered accounts include credit card accounts, mortgage loans, automobile loans, margin accounts, cell phone accounts, utility accounts, checking accounts, and savings accounts. A covered account is also an account for which there is a foreseeable risk of identity theft – for example, small business or sole proprietorship accounts.”
Originally, these rules were intended to be put into enforcement on November 1, 2008. Consequently, the FTC has postponed mandatory compliance to May 1, 2009. (http://www.ftc.qov/bcp/edu/pubs/business/alerts/alt050.shtm)
Sarbanes-Oxley Act of 2002
This act was initiated in response to a number of corporate accounting scandals which included such companies as Enron, WorldCom, and Tyco International. It established new standards for internal financial controls to eliminate accounting fraud. These internal controls could be construed to include standardized and routine document disposal so as to avoid the appearance of impropriety of non-routine document destruction.
Prudent-Man Rule: Finance Definition
A legal securities standard that asks the question, "What would a prudent man do" in order to determine whether an action was reasonable or whether it violated fiduciary duties. The legal standard originated in 1830 when Judge Samuel Putnum wrote, "Those with responsibility to invest money for others should act with prudence, discretion, intelligence and regard for the safety of capital as well as income." (http://www.yourdictionary.com/finance/prudent-man-rule)
California Civil Code Section 1798.80-1798.84
"A business shall take all reasonable steps to destroy, or arrange for the destruction of a customer's records within is custody containing personal information which is no longer to be retained by the business by (1) shredding, (2) erasing, or (3) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any measure." Injured customers may file "a civil action to recover damages." "In addition... a customer may recover a civil penalty not to exceed three thousand dollars ($3,000) per violation."