Which obligation is part of the disposal rule under FACT Act?

• A. Require retention of records indefinitely.
• B. Mandate encryption of all stored data.
• C. Requires proper disposal of consumer information to prevent unauthorized access.
• D. Requires annual credit report access.

Answer: (C)

The main idea here is that the disposal rule is about how to get rid of consumer information safely. It requires proper disposal of consumer information to prevent unauthorized access. This means destroying or erasing data in a way that it cannot be read or reconstructed, whether it’s on paper, on a computer, or in backups. The goal is to reduce the risk of identity theft or data breach from discarded records.

It doesn’t mandate keeping records forever, and while encrypting stored data is good practice, that’s not what the disposal rule specifically requires. It also isn’t about consumer access to credit reports—that requirement lives in another part of the law.