Who Must Comply
Section 216: “any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation,” must achieve FACT Act compliance.

What You Must Do
Examples provided: implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media containing consumer information so that the information cannot “practicably be read or reconstructed.”

Vendor Selection
“After due diligence, entering into and monitoring FACT Act compliance with a written contract with another party engaged in the business of record destruction to dispose of consumer information in a manner consistent with this rule. In this context, due diligence could include reviewing an independent audit of the disposal company's operations and/or its compliance with this rule, obtaining information about the disposal company from several references or other reliable sources, requiring that the disposal company be certified by a recognized trade association or similar third party.”