How does FACTA address the retention and disposal of consumer records?

• A. Records containing consumer information must be disposed properly when no longer needed, with safeguards to prevent unauthorized access.
• B. Records must be kept indefinitely.
• C. Records may be disposed without safeguards.
• D. Only physical records require disposal; digital can be kept.

Answer: (A)

FACTA requires that records containing consumer information be disposed of securely when they are no longer needed, with safeguards to prevent unauthorized access. The goal is to protect sensitive data even after it’s discarded, so measures must make the information unrecoverable. This applies to both paper records and electronic data, including backups and storage media, and it covers not only the entity but any contractors or service providers handling the information. Indefinite retention isn’t required or appropriate under this rule, and disposal without safeguards would fail the standard of “reasonable measures.” It’s also not true that only physical records need disposal—electronic records must be disposed of securely too, using methods like secure deletion or wiping to prevent future access.