Before June 1, 2005, each case of identity theft had one victim: the person unlucky enough to have to his or her identity stolen. Times and laws have changed. Under the Fair and Accurate Credit Transactions Act — FACTA — your company could become a second victim of identity theft if either employee or customer information is compromised.

The provision of FACTA related to disposal of information went into effect June 1, taking aim at “any person who maintains or otherwise possesses consumer information for a business purpose.” This provision could leave your business open to civil liability, possible class-action suits, and significant state and federal fines if your employees’ or customers’ personal information is breached. It could have a greater financial impact on businesses than any other law signed in recent years.

Here’s what you need to know about identity theft:

• Approximately 7 million people were victims of identity theft in the 12 months prior to July 2003. (Gartner Research and Harris Interactive)

  • Nearly 18 percent of identity thefts in which the breach was known occurred at work. (Identity Theft Resource Center)

  • The average individual loss as a result of identity theft is $92,893. (USA Today, Jan. 14, 2005)

  • The time spent, per incident, to clear up related issues is 600 work hours. (USA Today Jan. 14, 2005)

  Now here are the facts about FACTA:

• It is designed to reduce the risk of consumer fraud and identity theft and applies to every business in America.  

• It requires businesses to destroy all personal information about employees and customers before discarding it. Access to this personal information is strictly limited under other federal laws.

  • It states that every person and/or business must protect against unauthorized access to or use of the information in connection with its disposal.  

• It allows for civil liability should an employee’s identity be stolen due to an employer’s failure to act.

  • Consumers may be entitled to recover actual damages sustained as a result of a FACTA violation.

  • Courts are authorized to award punitive damages and attorney’s fees in an individual or class-action suit.

  • State and federal fines may be imposed on the business for each compromise of personal information. The maximums for those fines are $1,000 and $2,500 respectively.

  Imagine the consequences for your business if just 10 employee records were compromised.

How can you protect your company from identity theft? Start with your employees. Offer a proactive identity theft protection program as an employee benefit. Hold a brief mandatory employee meeting to help workers understand identity theft and the protection that is available to them. Employees can either elect or decline identity theft coverage.

If employees with coverage become a victim, they will spend less time and money, and will experience less frustration while having their identity restored. As a result, they will be back on the job and focused on work more quickly.

If an employee without coverage becomes a victim and later claims that the information was stolen as a result of your company’s actions, you have a defense. Require employees who decline coverage to sign a document stating such. Doing so passes the liability from your company to the employee should he or she become a victim of identity theft.

Travis Acheson works with companies to provide education and protection against identity theft. He can be reached at tacheson@mchsi.com or at 778-8728.