CUNA Comment Letter

The FACT Act Disposal Rule, R-411007

June 15, 2004

Federal Trade Commission
Office of the Secretary
Room 159-H (Annex H)
600 Pennsylvania Avenue, NW
Washington, DC 20580

Dear Sir or Madam:

The Credit Union National Association (CUNA) is pleased to respond to the Federal Trade Commission’s (FTC’s) proposed rule regarding the disposal of consumer report information and records, as required under the Fair and Accurate Credit Transactions (FACT) Act. By way of background, CUNA is the largest credit union trade association, representing more than 90% of our nation’s nearly 9,800 state and federal credit unions. The following comments were developed by CUNA with input from credit unions, credit union leagues, and CUNA’s Consumer Protection Subcommittee, chaired by Kris Mecham, CEO of Deseret First Credit Union, Salt Lake City, Utah.

The FACT Act requires the FTC and the federal financial institution regulators to issue comparable rules regarding the proper disposal of consumer report information that is also consistent with the Gramm-Leach-Bliley Act provisions on information security, as well as other similar provisions of federal law. The FTC rule will apply to state-chartered and privately insured credit unions, and the National Credit Union Administration has recently issued comparable rules for federal credit unions.

Summary of CUNA’s Position

Discussion

CUNA generally supports the proposed rule regarding the disposal of consumer information, and we commend the FTC’s efforts in drafting the proposed rule. We believe, overall, that the proposal adequately balances the concerns of consumers and the industry.

Although the FTC’s rule, which will apply to state-chartered and privately insured credit unions, is similar to the rule issued by NCUA, which will apply to federally-chartered credit unions, CUNA urges the FTC to consider compliance with NCUA’s rule sufficient for state-chartered and privately insured credit unions because all credit unions should be treated equally with regard to this rule. Unlike the FTC’s rule, the rule issued by NCUA applies only to credit unions and, therefore, focuses on their unique structure and organization. Also, we believe that allowing all credit unions to rely on the same language may improve compliance because all credit unions will have the opportunity to receive consistent training. Alternatively, CUNA urges the FTC to include a required compliance date that will be three months after the final rule is issued, consistent with the rule issued by NCUA.

The FTC has specifically requested comment on a number of issues, including whether the definitions of "consumer information" and "disposal" are clear. The proposed rule defines "consumer information" as any record of an individual in any form, paper or electronic, that is a consumer report or derived from a consumer report. The definition of "consumer report" is the same as currently used under the Fair Credit Reporting Act (FCRA), which generally means credit, reputation, personal, or mode of living information used to establish eligibility for credit, employment, and for certain other purposes. Information that is derived from consumer reports, but does not identify any specific consumers, would not be covered under the proposed rule.

We believe the definition of "consumer information" is sufficiently clear as it references the long-standing definition under the FCRA that credit unions are already familiar with, although credit unions would certainly welcome any further guidance that the FTC would want to provide. Since the definition of "consumer report" is already incorporated within the FCRA, perhaps the proposed rule could incorporate references to any guidance that may already exist.

The term "disposal" means the discarding or abandonment of consumer information, as well as the sale, donation, or transfer of any medium, including computers, upon which consumer information is stored. By itself, the sale, donation, or transfer of consumer information would not be considered "disposal" for purposes of this rule. Again, we believe the definition is reasonably clear, but would welcome additional guidance. The rule should be amended to include additional guidance or examples over time, as technology evolves and as the industry develops additional experience in this area.

The FTC has also specifically requested comment as to whether the standards for disposal are flexible enough and whether they minimize burdens for smaller entities, such as credit unions. We believe the standards are flexible in that they clearly contemplate that complete destruction may not be obtainable in every situation. The standards also contemplate that reasonable measures to protect the information against unauthorized access or use depend on a number of factors, including the sensitivity of the information, the size of the entity, the costs and benefits of different disposal methods, and that technology will change, which may dictate different disposal methods. This should provide credit unions with the flexibility to choose appropriate disposal methods.

We also believe that the examples of reasonable record disposal measures included in the proposed rule are appropriate as they contemplate methods already used by credit unions, including shredding of paper documents and destroying or erasing electronic media containing consumer information to the extent it cannot be read or reconstructed. Credit unions using electronic media also understand that residual data often remains on the media after erasure, which can be recovered, and additional disposal efforts may be necessary in these situations.

Thank you for the opportunity to comment on the proposed rule regarding the disposal of consumer report information and records. If you have questions about our comments, please contact Associate General Counsel Mary Dunn or me at (202) 638-5777.

Sincerely,

Jeffrey Bloch
Assistant General Counsel