Specifications

Data Disposal

Consumer data isn’t just deleted at end of life — it’s destroyed by a verified method.

What it ensures

Consumer-report information discarded intact is a breach in waiting. This control permits disposal only by a method verified to render the data unreadable — shredding, burning, or secure erasure — and refuses the easy, insecure paths.

It treats destruction as a deliberate, recorded act rather than a trip to the recycling bin.

Watch it run

A batch of screening records has reached the end of its retention life — and someone needs to get rid of it.

Illustrative run — one case moving through the Data Disposal specification.

Disposal due Method verified Disposed Blocked
Permitted transition Forbidden move Start Terminal state
Consumer data isn’t just deleted — it’s destroyed by a verified method. Tossing or recycling records intact is in red.
✕ Toss intact 1 ✓ Records due 2 ✓ Secure method 3 ✓ Disposed
Ready

A batch of consumer-report records reaches the end of its retention life.

  1. Ready

    End of life

    The records are done. How they’re destroyed is its own legal duty.

  2. Blocked

    The wrong move

    The dumpster and the recycle bin are the easy paths, and the ones the Disposal Rule exists to stop. Insecure disposal is refused.

    Where it comes from

    The FACTA disposal provision directed regulators to require proper disposal of consumer-report information — recognizing that a discarded file is a breach waiting to happen.

    What it satisfies

    Refusing disposal except by a verified secure method enforces §1681w and the FTC’s Disposal Rule — shredding, burning, or erasure, not the trash.

    FCRA §1681w Statute 15 U.S.C. § 1681w(a)(1) — FACTA disposal …[the agencies shall] issue final regulations requiring any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation. U.S. Code · Cornell LII ↗ 16 CFR 682 Rule FTC Disposal Rule, 16 CFR Part 682 The FTC’s Disposal Rule, issued under the FACTA disposal provision, requires anyone who maintains consumer-report information to take reasonable measures to protect against unauthorized access in connection with its disposal — for paper, by burning, pulverizing, or shredding; for electronic media, by destruction or erasure. Disposal Rule · Cornell LII ↗
  3. Permitted

    Secure destruction

    The method actually renders the data unreadable, and it’s confirmed.

  4. Permitted

    Disposed

    What’s gone is genuinely gone.

  5. On the record

    The proof

    The file shows the records were destroyed securely, not discarded.

Why it holds

Why the whole holds

No single deletion is safe on its own. What holds is that records cannot be disposed of except by a method verified to destroy them. Reliability isn’t a careful employee at the shredder; it’s that insecure disposal has no path.

Why it matters

The FACTA Disposal Rule makes improper disposal of consumer-report data its own violation; a discarded file that resurfaces is both a legal failure and a breach.