Does the rule establish when an employer must destroy records or set any minimum retention time periods?
The FTC is clear that nothing in the rule is intended to create a requirement that records be maintained for a certain period of time or that records must be destroyed within a specific time period. However, all federal or state laws regarding records retention remain in place. Given the increased attention on identity theft, fraud and other privacy issues, employers need to review or develop policies to ensure actual destruction of discarded records, particularly when those records contain sensitive information. Failure to ensure destruction could give rise to claims both under the Fair Credit Reporting Act or even to novel negligence claims. If you have any questions about this new rule, please contact Michael Aldana at 414-277-5151/ ma2@quarles.com or your Quarles & Brady attorney.
