§ 717.83 - Disposal of consumer information.

§ 717.83 Disposal of consumer information.

(a) In general. You must properly dispose of any consumer information that you maintain or otherwise possess in a manner consistent with the Guidelines for Safeguarding Member Information, in appendix A to part 748 of this chapter.

(b) Examples. Appropriate measures to properly dispose of consumer information include the following examples. These examples are illustrative only and are not exclusive or exhaustive methods for complying with this section.

(1) Burning, pulverizing, or shredding papers containing consumer information so that the information cannot practicably be read or reconstructed.

(2) Destroying or erasing electronic media containing consumer information so that the information cannot practicably be read or reconstructed.

(c) Rule of construction. This section does not:

(1) Require you to maintain or destroy any record pertaining to a consumer that is not imposed under any other law; or

(2) Alter or affect any requirement imposed under any other provision of law to maintain or destroy such a record.

(d) Definitions. As used in this section:

(1) Consumer information means any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report and that is maintained or otherwise possessed by or on behalf of the credit union for a business purpose. Consumer information also means a compilation of such records. The term does not include any record that does not identify an individual.

(i) Consumer information includes:

(A) A consumer report that you obtain;

(B) Information from a consumer report that you obtain from your affiliate after the consumer has been given a notice and has elected not to opt out of that sharing;

(C) Information from a consumer report that you obtain about an individual who applies for but does not receive a loan, including any loan sought by an individual for a business purpose;

(D) Information from a consumer report that you obtain about an individual who guarantees a loan (including a loan to a business entity); or

(E) Information from a consumer report that you obtain about an employee or prospective employee.

(ii) Consumer information does not include:

(A) Aggregate information, such as the mean credit score, derived from a group of consumer reports; or

(B) Blind data, such as payment history on accounts that are not personally identifiable, you use for developing credit scoring models or for other purposes.

(2) Consumer report has the same meaning as set forth in the Fair Credit Reporting Act, 15 U.S.C. 1681a(d). The meaning of consumer report is broad and subject to various definitions, conditions and exceptions in the Fair Credit Reporting Act. It includes written or oral communications from a consumer reporting agency to a third party of information used or collected for use in establishing eligibility for credit or insurance used primarily for personal, family or household purposes, and eligibility for employment purposes. Examples include credit reports, bad check lists, and tenant screening reports.