By Lesley Fair

Trash — like beauty — is in the eye of the beholder. What looks like a wastepaper basket to you may be a gold mine to an identity thief. Savvy business executives know that an important step in the fight against ID theft is scaling back on sensitive data in their offices and on their computers. But once you’ve winnowed things down, it defeats the purpose unless you make sure your trash can’t be “recycled” by a scam artist. That’s why the Federal Trade Commission’s new handbook, Protecting Personal Information: A Guide for Business, advises companies to Pitch It — Properly dispose of what you no longer need.

• Defeat the dumpster diver. Breaching computer networks requires some technical know-how, but dumpster diving — rooting through garbage for account statements, Social Security numbers, and other personal information — just takes patience and a strong stomach. Encourage your staff to separate the stuff that’s safe to trash from sensitive data that needs to be discarded with care.
• Full speed a-shred. Effectively dispose of paper records containing sensitive data by shredding, burning, or pulverizing them before throwing them away. Have shredders available throughout the workplace, including next to the photocopier. Make sure discarded documents can’t be read — or reconstructed — by people with time on their hands and crime on their minds.
• Nothing to write home about. Whether working from home or on the road, make sure telecommuters and business travelers maintain your company’s high security standards. Remind them to be as careful when disposing of sensitive documents off-site as they are when creating them.
• Disclose how to dispose. If you use consumer credit reports in your business, you may be subject to the FTC’s Disposal Rule. The Rule requires companies to adopt reasonable and appropriate disposal practices to prevent the unauthorized access to — or use of — information in credit reports. Find out more by reading Disposing of Consumer Report Information? New Rule Tells How.
• Is your DELETE complete? Deleting files using the keyboard or mouse commands usually isn’t sufficient because the files may continue to exist on the computer’s hard drive and could be retrieved easily. So when getting rid of old computers, laptops, hard drives, portable storage devices, cell phones, etc., use wipe utility programs. They’re inexpensive and can provide better results by overwriting the contents so that the files are no longer recoverable.

Protecting Personal Information: A Guide for Business is available at business.ftc.gov.

Lesley Fair is an attorney in the FTC’s Bureau of Consumer Protection who specializes in business compliance.
 

July 2007