Eye on the Market

A recent survey reveals that while corporations are spending more money in an effort to safeguard personal information, many corporate leaders say they are unfamiliar with key federal and state laws governing information privacy.

The survey, conducted on behalf of Boston-based Iron Mountain, targeted companies with annual revenue of at least $750 million. The survey polled 115 business professionals involved in or responsible for information privacy at publicly held companies.

According to the survey’s findings, companies believe they’re more familiar with federal requirements for information destruction than they actually are. While nearly three in four respondents (74 percent) express familiarity with federal requirements, fewer than one in three (30 percent) are aware of the Federal Trade Commission’s Fair and Accurate Credit Transactions Act (FACTA) Disposal Rule. The FACTA Disposal Rule mandates that organizations properly dispose of documents containing consumer information through methods such as burning, pulverizing or shredding so that the "information cannot practically be read or reconstructed."

The survey also reveals that nine in 10 companies outsource their shredding, while more than half (57 percent) also rely on on-site commercial-grade shredding or incineration equipment. But fewer than one in four report compliant destruction of consumer information (24 percent) or audit-compliant policies and procedures (23 percent) based on best industry practices.

Two in three companies (66 percent) say it has become more important to formalize policies and procedures for destroying sensitive information. Those companies cited new laws (63 percent), negative press of data losses (43 percent), customer demand for information security (29 percent) and pressure from industry groups (28 percent) as the top reasons why.