You can't just toss an old background check file in the trash, and you can't just hit delete on the digital copy either. Under FACTA's Disposal Rule, once you're done with a background check report, federal law says you have to destroy it so nobody can put the information back together. Shred the paper. Wipe the file for real. That's the rule in one sentence.
Now let's slow down and go through why this exists, and what "destroy it properly" actually means in practice.
FACTA stands for the Fair and Accurate Credit Transactions Act. It's not a separate law from the one you already know, FCRA (the Fair Credit Reporting Act). FACTA is an amendment to it, passed back in 2003, mostly aimed at identity theft protection.
One piece of FACTA is called the Disposal Rule. It covers what happens at the very end of a background check's life, after you've made your hiring decision and you no longer need the report sitting around. The report itself, and the personal information inside it, still counts as "consumer report information." That label doesn't expire just because you're done using it.
The rule doesn't hand you a single approved method. It says you have to take reasonable measures to prevent unauthorized access to, or use of, the information in connection with its disposal. In plain terms, whatever you do has to make the information unreadable and unable to be pieced back together.
For paper records, that generally means burning, pulverizing, or shredding, not just tearing a page in half and dropping it in a bin. For digital files, it means actually erasing the data, not just deleting it. Hitting delete on your computer usually just removes the file's label. The data itself can often still be recovered. That's exactly the loophole this rule was written to close.
So to say that a different way: "gone from the folder" and "gone for good" are two different things, and the rule only cares about the second one.
If you're using a company to handle disposal for you, a document shredding service or an IT vendor that wipes drives, doing some due diligence on that vendor before you hand them boxes of files also counts toward "reasonable measures." That part's not optional either.
Not just background check companies. If your business ordered a report from a CRA (a consumer reporting agency, the company that actually ran the background check) and used it anywhere in a hiring decision, this rule is about you too.
That covers a five-person shop that ran one background check last year just as much as it covers a company that screens thousands of candidates a month. Size doesn't get you out of it.
This is the part I'll be honest with you about instead of guessing. FACTA's Disposal Rule itself doesn't set your retention period, it only governs what you do once you're finished keeping the record. How long you're required or expected to hold onto hiring records before that point comes from other rules, and it can depend on your state, your industry, and whether the candidate was hired.
I've generally seen a year or so treated as a reasonable floor for basic hiring records, and longer in some cases. But I'm not going to hand you one clean number and tell you it's right for every employer, because it isn't. Check your specific retention obligations with an employment lawyer before you set a policy. That's not me dodging the question. Laws like this get revised, and getting it wrong in either direction, keeping records too long or destroying them too soon, causes real problems.
The FTC enforces the Disposal Rule, and it's backed by real penalties. I'm not going to throw out an exact dollar figure here, since those numbers get adjusted periodically and I'd rather not state a specific amount I can't fully stand behind. What I can tell you plainly is that "we forgot" isn't a defense regulators tend to find persuasive. Improper disposal isn't a paperwork technicality. It's how old background check data ends up in the wrong hands.
You don't need a compliance department to get this right. You need a habit. Here's the version I'd actually set up if I were doing this for a five-person HR team today:
None of that takes special software or a big budget. It takes someone actually doing it on a schedule instead of "getting to it eventually." That part's the whole game here. The rule is simple. The failure mode is always the same: records piling up because nobody assigned the job of throwing them away correctly.