GLBA and FACTA Data Disposal: Hard Drive Destruction Rules for Financial Institutions

GLBA data disposal requirements affect most financial institutions more broadly than the PCI-DSS rules they already follow. Most banks focus on payment card data destruction but completely ignore two federal regulations that apply to nearly every hard drive they dispose of.

Key Takeaways:

• GLBA Safeguards Rule applies to all customer information — not just payment data — expanding disposal requirements beyond PCI scope to include loan applications, account statements, and investment records
• FACTA Disposal Rule covers any business that possesses consumer report information, including credit applications and background checks, with violations carrying up to $3,500 per incident
• Financial institutions must maintain disposal documentation for both regulations, with GLBA requiring reasonable measures evidence and FACTA mandating proper disposal method verification

What Financial Information Actually Falls Under GLBA and FACTA Disposal Rules?

GLBA Safeguards Rule covers customer information from any source. This means every piece of data you collect about customers — loan applications, account histories, transaction records, even marketing preferences — falls under disposal requirements. FACTA Disposal Rule operates differently, targeting consumer report information as defined by 15 USC 1681a(d).

The scope overlap creates confusion. PCI-DSS only covers payment card data. GLBA covers everything about customers. FACTA covers credit reports and background checks. You can’t assume PCI compliance handles your broader regulatory obligations.

Information Type	GLBA Coverage	FACTA Coverage	PCI-DSS Coverage
Credit card numbers	Yes	No	Yes
Credit reports	Yes	Yes	No
Bank statements	Yes	No	No
Loan applications	Yes	Sometimes*	No
Background checks	Yes	Yes	No
Investment records	Yes	No	No
Marketing lists	Yes	No	No

*Depends on whether consumer reporting agency data was used

Consumer report information includes credit scores, employment verification, tenant screening, and insurance underwriting data. If your institution uses third-party services to verify customer information, that data likely falls under FACTA when you dispose of it.

The practical difference matters for disposal planning. GLBA uses a “reasonable measures” standard. FACTA requires “proper disposal” that prevents unauthorized access. Both regulations extend beyond payment processing to cover the full customer relationship.

How Do FTC Safeguards Rule Disposal Provisions Actually Work?

FTC Safeguards Rule disposal provisions require a reasonable measures standard for customer information disposal. This means disposal methods must make customer information unreadable or undecipherable through reasonable means.

The reasonable measures standard provides interpretation flexibility but creates enforcement uncertainty. The FTC doesn’t specify exact technical methods. Instead, they evaluate whether your disposal approach would prevent typical data recovery attempts.

What constitutes reasonable varies by data sensitivity and disposal context. Overwriting a hard drive once might satisfy the standard for marketing lists. Financial records typically require more thorough destruction. The regulation focuses on outcomes — preventing unauthorized data access — rather than prescribing specific techniques.

FTC enforcement cases show they examine three factors: data sensitivity, disposal method documentation, and whether breaches occurred due to inadequate disposal. Institutions with documented policies using industry-standard methods face less scrutiny than those with ad-hoc approaches.

Actually, this creates a documentation burden many institutions underestimate. You need written policies describing your disposal methods, training records showing staff understand the procedures, and evidence that reasonable measures were actually implemented.

The reasonable measures standard maps to NIST SP 800-88 sanitization levels, but GLBA doesn’t require the highest security level for all data types. You can justify different approaches based on data sensitivity and business context.

What Does 16 CFR Part 682 Require for Consumer Report Information Disposal?

16 CFR Part 682 FACTA requirements mandate proper disposal procedures for consumer report information. The regulation requires disposal methods that ensure consumer information cannot be read or reconstructed by unauthorized individuals.

FACTA requires disposal methods that prevent unauthorized access through reasonable reconstruction attempts. Here’s how to comply:

1. Identify consumer report information in your systems, including credit reports, background checks, and any data derived from consumer reporting agencies.

2. Apply proper disposal methods that render information unreadable, including burning, pulverizing, or shredding physical documents and using data destruction software for electronic media.

3. Verify disposal completion through certificates of destruction, witnessed destruction, or other documented evidence that proper methods were used.

4. Document disposal procedures in written policies that specify which methods apply to different media types and information categories.

5. Train disposal personnel on proper procedures and maintain records showing they understand FACTA requirements and your institutional policies.

6. Conduct due diligence on third-party disposal vendors to ensure they use appropriate methods and provide adequate documentation.

The regulation covers both paper and electronic media. For electronic media, FACTA accepts destruction methods that make data unrecoverable through commercially available recovery tools. This typically means physical destruction or cryptographic erasure for storage devices.

Actually, FACTA’s “proper disposal” standard is stricter than GLBA’s “reasonable measures” approach. Where both regulations apply to the same data, you must meet the higher FACTA standard.

Which Hard Drive Destruction Methods Satisfy Both GLBA and FACTA Standards?

NIST SP 800-88 provides acceptable destruction methods that satisfy both regulations’ disposal standards. The Destroy level methods offer the clearest compliance path because they physically eliminate data recovery possibilities.

Destruction Method	GLBA Compliance	FACTA Compliance	Technical Standard
Physical shredding	Yes	Yes	NIST Destroy level
Degaussing (magnetic)	Yes	Yes	NIST Destroy level
Incineration	Yes	Yes	NIST Destroy level
Cryptographic erasure	Yes*	Yes*	NIST Clear/Purge level
Single overwrite	Maybe	No	Below NIST standards
Multi-pass overwrite	Yes	Yes	NIST Purge level

*Requires proper key management and verification

Physical destruction methods provide the strongest compliance position. Shredding hard drives to particles smaller than 2mm eliminates any data recovery possibility. Degaussing magnetic media with properly calibrated equipment achieves similar results.

Cryptographic erasure works when implemented correctly. You must verify that encryption covered all data areas, use strong encryption algorithms, and properly destroy or randomize the encryption keys. Many institutions struggle with verification requirements.

Multi-pass overwriting satisfies both standards but requires careful implementation. You need documented verification that overwriting completed successfully across all addressable areas, including bad sectors and hidden areas.

One thing I should mention: FACTA’s proper disposal standard typically requires methods that prevent recovery using commercially available tools. Single-pass overwriting might not meet this threshold depending on the specific implementation and verification procedures.

The safest approach combines physical destruction with documented chain of custody. This eliminates technical debates about sanitization effectiveness while providing clear audit evidence.

How Do You Document Chain of Custody for GLBA and FACTA Compliance?

Chain of Custody provides compliance documentation for both GLBA and FACTA disposal requirements. Both regulations require documented disposal procedures, but GLBA focuses on reasonableness while FACTA emphasizes proper disposal method verification.

Documentation requirements for dual compliance include:

• Asset inventory records showing what devices contained covered information, including serial numbers, data types, and disposal dates

• Transport documentation with signatures from authorized personnel at each custody transfer point and tamper-evident seals or containers

• Destruction method verification specifying the exact procedures used, equipment calibration records, and completion certificates from destruction facilities

• Personnel authorization records showing who was authorized to handle covered information during disposal and their training documentation

• Third-party vendor agreements requiring GLBA/FACTA-compliant disposal methods and indemnification for regulatory violations

• Audit trail maintenance preserving all disposal records for regulatory examination periods, typically 3-5 years depending on information types

GLBA chain of custody differs from PCI requirements by covering broader information categories and focusing on reasonable measures documentation. You need evidence that disposal methods were appropriate for the data sensitivity, not just that you followed prescribed procedures.

FACTA chain of custody emphasizes proper disposal method verification. Audit evidence should demonstrate that consumer report information was actually rendered unreadable, not just processed through disposal procedures.

Actually, the biggest documentation gap I see is verification evidence. Having a certificate saying “data destroyed” isn’t sufficient. You need documentation showing the destruction method was appropriate for your data types and actually prevented unauthorized access.

Maintain separate documentation tracks for each regulation while ensuring your procedures satisfy both standards simultaneously.

What Are the Real Enforcement Risks and Violation Costs for Financial Institutions?

FTC enforcement results in financial penalties up to $3,500 per FACTA violation with no safe harbor for good faith compliance attempts. GLBA violations typically result in consent orders requiring compliance programs rather than direct fines, but state attorneys general can impose additional penalties.

FACTA disposal violations carry civil penalties that multiply quickly. Each improperly disposed record constitutes a separate violation. A single hard drive containing 1,000 consumer reports could generate $3.5 million in potential penalties.

Enforcement patterns show violations typically get discovered through data breach investigations, consumer complaints, or regulatory examinations. The FTC investigates disposal practices when breached information should have been previously destroyed.

Actual enforcement cases reveal common violation patterns. Institutions face scrutiny for using disposal vendors without verifying their methods, failing to identify all consumer report information in their systems, and lacking documented policies for disposal procedures.

GLBA Safeguards Rule enforcement focuses on institutional compliance programs rather than individual violations. The FTC examines whether you have reasonable disposal policies, train staff appropriately, and monitor compliance effectiveness.

One thing I should mention: enforcement risk increases significantly for institutions that experience breaches involving improperly disposed information. The FTC treats disposal violations as aggravating factors that increase overall penalty calculations.

State regulators often pile additional violations on top of federal enforcement. Banking regulators can impose consent orders requiring expensive compliance consulting and ongoing monitoring.

The real cost extends beyond direct penalties. Enforcement actions trigger customer notification requirements, regulatory examination intensity increases, and compliance insurance premiums typically rise substantially.