Colorado business owners beware: If you haven’t started shredding, you had better start soon.
Starting June 1, a federal law provision requires business owners to destroy all employee or consumer information taken from credit reports before tossing those papers or computer disks in the trash.
If information is not “shredded, burned or pulverized,” the provision says, business owners could be held liable. That means possible fines of up to $2,500 per violation, or lawsuits if violations are discovered or the discarded information results in identity theft.
The new regulation could cost some Denver business owners cash and time.
“Some small businesses will have trouble with the costs,” said Zack Pool, owner of Denver’s Mile Hi Ceramics. “It would hurt for the city to come down on me because a criminal found a document.”
Pool said his company already shreds everything from credit- card numbers to vendor invoices, spending about $100 a month to hire it out.
Tom Hosea, owner of Littleton’s Proshred Security, said the provision will impact businesses from “pizza parlors to beauty shops.”
“The trash is a treasure trove for an identity thief,” Hosea said.
The Mountain States Employers Council, which educates businesses on employment-compliance issues, supports the provision and is educating businesses about it.
“Added obligations are always concerning, but it’s hard to argue with this,” said Allan Estroff, the council’s director of employment legal services.
Estroff said more companies, especially large firms, or those in security or child care, are running background and credit reports on prospective employees.
The shredding industry, meanwhile, sees the provision as a chance to tap new customers.
The U.S. market for shredders – ranging from battery-operated models for home use to commercial operations that chew through tons of paper with mobile trucks – is about $350 million annually, said Steven Jacober, president of the School, Home and Office Products Association, an Ohio-based trade group.
He said concerns about identity theft and state and federal regulations could fuel a 20 percent yearly increase in the shredding business in the next five years.
“The more factors that mandate the destruction of information, the more the shredding industry will grow,” Jacober said.
Bob Johnson, executive director of the National Association for Information Destruction, an Arizona-based paper-shredding industry trade group, said about 2,000 U.S. companies handle document destruction.
He said previous federal document-destruction rules, such as the Health Insurance Portability and Accountability Act and the Financial Modernization Act, spurred growth for the industry.
Those two regulations required hospitals and financial entities to develop safeguards to protect consumer information.
The new document-destruction requirement is one of 19 provisions included in 2003’s Fair and Accurate Credit Transaction Act, which allows people a free look at their credit reports each year. The Federal Trade Commission will oversee the provision’s enforcement.
States such as Georgia and Wisconsin already require businesses to destroy all personal information, regardless of source. In addition to credit reports, personal information such as that supplied on job applications or in criminal background checks is included.
Johnson said similar legislation could be forthcoming on the federal level.
Staff writer Will Shanley can be reached at 303-820-1473 or wshanley@denverpost.com.
