This story appeared on Network World at

http://www.networkworld.com/columnists/2005/061305bradner.html

'Net Insider

A point solution in a broad space

By Scott Bradner, Network World, 06/13/05

Scott Bradner

On June 1, Part 682 of Title 16 of the U.S. Code of Federal Regulations went into effect. These rules concern the disposal of consumer report information and records.They eloquently demonstrate the inability of lawmakers to craft general solutions to general problems.

The rules require that anyone who has a consumer report about someone to properly dispose of the paper or electronic records when done with them. This means "burning, pulverizing or shredding of papers" and the "destruction or erasure of electronic media." The term "consumer report" used in the rules is defined in the Fair Credit Reporting Act and means "any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" to be used to determine credit or for employment background checks.

The disposal rules are part of the Fair and Accurate Transaction Act of 2003. This 61-page act covers a lot of good stuff, including your right to get free copies of your credit reports; the right to add a fraud alert in your record at the credit reporting agencies (to prevent credit being extended to you without your specific OK); truncating credit card and Social Security numbers on printed materials; and your rights when trying to correct information held by the credit reporting companies. It also spends a lot of pages trying to preempt ways that the credit reporting industry might try to get around obeying the law.

What the Fair Credit Reporting Act and the Fair and Accurate Transaction Act lack are any overarching principles. Such a principle might be that an individual could opt out of having any credit report-like information shared about themselves, unless the distribution is in conjunction with a legally constituted law enforcement or terrorism investigation. If I'm not trying to get additional credit cards or loans I should be able to just say "no." Instead the laws focus on particular details, missing many that will have to be patched later.

For example, the disposal rules only apply to "consumer information," which means "any record about an individual . . . that is a credit report or is derived from a credit report" and ignores any requirement to properly dispose of other information that a business may hold about individuals. It would have been easy for Congress to stop the definition of consumer information after "record about an individual" - but that would have been far too pro-consumer.

Disclaimer: I do not know if Harvard's Kennedy School of Government has classes on when to stop, but it's far from sure that politicians are likely to listen even if it does. In any case, the above lament is my own.