Disposal of Consumer Report Information and Records, 52846-52848 [2017-24728]

Download as PDF 52846 Federal Register / Vol. 82, No. 219 / Wednesday, November 15, 2017 / Rules and Regulations (5) You may view this service information that is incorporated by reference at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call 202–741–6030, or go to: http:// www.archives.gov/federal-register/cfr/ibrlocations.html. (j) Related Information (1) Refer to Mandatory Continuing Airworthiness Information (MCAI) Canadian Airworthiness Directive CF–2017–01, dated January 6, 2017, for related information for related information. This MCAI may be found in the AD docket on the Internet at http://www.regulations.gov by searching for and locating Docket No. FAA–2017–0528. (2) For more information about this AD, contact Assata Dessaline, Aerospace Engineer, Avionics and Administrative Services Section, FAA, New York ACO Branch, 1600 Stewart Avenue, Suite 410, Westbury, NY 11590; telephone: 516–228– 7301; fax: 516–794–5531. (3) Service information identified in this AD that is not incorporated by reference is available at the addresses specified in paragraphs (k)(3) and (k)(4) of this AD. sradovich on DSK3GMQ082PROD with RULES request to your principal inspector or local Flight Standards District Office, as appropriate. If sending information directly to the manager of the certification office, send it to ATTN: Program Manager, Continuing Operational Safety, FAA, New York ACO Branch, 1600 Stewart Avenue, Suite 410, Westbury, NY 11590; telephone: 516–228–7300; fax: 516–794–5531. Before using any approved AMOC, notify your appropriate principal inspector, or lacking a principal inspector, the manager of the local flight standards district office/certificate holding district office. (2) Contacting the Manufacturer: For any requirement in this AD to obtain corrective actions from a manufacturer, the action must be accomplished using a method approved by the Manager, New York ACO Branch, FAA; or Transport Canada Civil Aviation (TCCA); or Bombardier Inc.’s TCCA Design Approval Organization (DAO). If approved by the DAO, the approval must include the DAO-authorized signature. Disposal of Consumer Report Information and Records (k) Material Incorporated by Reference (1) The Director of the Federal Register approved the incorporation by reference (IBR) of the service information listed in this paragraph under 5 U.S.C. 552(a) and 1 CFR part 51. (2) You must use this service information as applicable to do the actions required by this AD, unless this AD specifies otherwise. (i) Bombardier Challenger 604 Airplane Flight Manual (AFM), Publication No. CH 604 AFM, Revision 103, dated November 28, 2016. (ii) Bombardier Challenger 605 AFM, Publication No. CH 605 AFM, Revision 41, dated November 28, 2016. (iii) Bombardier Challenger 650 AFM, Publication No. CH 650 AFM, Revision 6, dated November 28, 2016. (3) For service information identified in ˆ this AD, contact Bombardier, Inc., 400 Cote´ Vertu Road West, Dorval, Quebec H4S 1Y9, Canada; telephone: 514–855–5000; fax: 514– 855–7401; email: thd.crj@ aero.bombardier.com; Internet: http:// www.bombardier.com. (4) You may view this service information at the FAA, Transport Standards Branch, 1601 Lind Avenue SW., Renton, WA. For information on the availability of this material at the FAA, call 425–227–1221. VerDate Sep<11>2014 15:48 Nov 14, 2017 Jkt 244001 Issued in Renton, Washington, on October 20, 2017. Dionne Palermo, Acting Director, System Oversight Division, Aircraft Certification Service. [FR Doc. 2017–23996 Filed 11–14–17; 8:45 am] BILLING CODE 4910–13–P FEDERAL TRADE COMMISSION 16 CFR Part 314 [RIN 3084–AB41] Federal Trade Commission. Confirmation of rule. AGENCY: ACTION: The Federal Trade Commission has completed its regulatory review of its rule regarding Disposal of Consumer Report Information and Records as part of the Commission’s systematic review of all current Commission rules and guides, and has determined to retain the Rule in its current form. DATES: This action is effective on November 15, 2017. ADDRESSES: Relevant portions of the proceeding, including this document, are available at www.ftc.gov. FOR FURTHER INFORMATION CONTACT: Tiffany George, (202) 326–3040, Attorney, Division of Privacy and Identity Protection, Federal Trade Commission, Washington, DC 20580. SUPPLEMENTARY INFORMATION: SUMMARY: I. Introduction In September 2016, the Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) requested comments on its rule regarding Disposal of Consumer Report Information and Records (‘‘Disposal Rule’’ or ‘‘Rule’’), as part of its comprehensive regulatory review program. Specifically, the Commission sought comments on the Rule’s costs and benefits, and on whether it should modify the Rule to account for changes in technology or information destruction standards. After considering the comments, the Commission has determined to retain the Rule without amendment. Most of the commenters who addressed the issue supported the Rule’s current PO 00000 Frm 00024 Fmt 4700 Sfmt 4700 provisions. A few commenters recommended expanding the Rule’s provisions. Because the Commission has not seen any evidence of problematic acts or practices that any proposed modification would address, it has determined not to amend the Rule at this time. This document provides background, analyzes the comments, and further explains the Commission’s decision. II. Background The Fair and Accurate Credit Transactions Act (‘‘FACTA’’ or ‘‘Act’’) was enacted in 2003. In part, the Act amended the Fair Credit Reporting Act (‘‘FCRA’’) by requiring that any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose, properly dispose of any such information or compilation. The Act also required the Commission and other federal agencies to promulgate rules regarding the proper disposal of consumer report information and records. Pursuant to the Act’s directive, the Commission promulgated the Disposal Rule in 2004, which became effective on June 1, 2005.1 The Disposal Rule requires that persons over which the FTC has jurisdiction who maintain or otherwise possess consumer information for a business purpose properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. The Rule defines ‘‘consumer information’’ as ‘‘any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report. Consumer information also means a compilation of such records. Consumer information does not include information that does not identify individuals, such as aggregate information or blind data.’’ 2 The Rule includes several examples of what the Commission believes constitute reasonable measures to protect consumer information in connection with its disposal, including policies and procedures that require (1) the burning, pulverizing, or shredding of papers or (2) the destruction or erasure of electronic media containing consumer information so that the information cannot practicably be read or reconstructed. These examples are intended to provide covered entities with guidance on how to comply with 1 See 2 See E:\FR\FM\15NOR1.SGM 69 FR 68690 (Nov. 24, 2004); 16 CFR 682. 16 CFR 682.1(b). 15NOR1 Federal Register / Vol. 82, No. 219 / Wednesday, November 15, 2017 / Rules and Regulations the Rule, but are not intended to be safe harbors or exclusive methods for compliance. In promulgating the Rule, the FTC noted that there are few foolproof methods of record destruction and that entities covered by the Rule must consider their own unique circumstances when determining how to best comply with the Rule. In September 2016, the Commission published a Notice seeking comment on the Rule as part of the Commission’s ongoing comprehensive regulatory review program.3 The Notice sought comment on the Rule’s overall costs, benefits, necessity, and regulatory and economic impact. The Notice also asked for comment on whether the Commission should modify the Rule in light of changes in technology and industry standards and practices. III. Regulatory Review Comments and Analysis sradovich on DSK3GMQ082PROD with RULES The Commission received 11 comments in response to the Notice during the comment period.4 Comments were filed by individuals, trade associations, and research organizations. The Commission received comments from such diverse organizations as the National Automobile Dealers Association (‘‘NADA’’), Data & Marketing Association (‘‘DMA’’), National Association for Information Destruction (‘‘NAID’’), Consumer Data Industry Association (‘‘CDIA’’), Electronic Transactions Association (‘‘ETA’’), and Electronic Privacy Information Center (‘‘EPIC’’). All of the commenters addressing the issue supported the Rule overall. Indeed, none of the commenters advocated repealing the Rule or narrowing its scope. For example, NADA stated that ‘‘the Disposal Rule is well-established and working effectively and we do not believe it needs to be changed or amended in any significant way.’’ 5 In addition, ETA noted that ‘‘the Disposal Rule as currently written effectively promotes consumer information security.’’ 6 Commenters differed on whether the Commission should expand the Rule’s 3 Federal Trade Commission: Disposal of Consumer Report Information: Request for Comments, 81 FR 63435 (Sept. 15, 2016). 4 The comments are posted at: https:// www.ftc.gov/policy/public-comments/initiative-672. The Commission has assigned each comment a number appearing after the name of the commenter and the date of submission. This notice cites comments using the last name of the individual submitter or the name of the organization, followed by the number assigned by the Commission. 5 See National Automobile Dealers Association (Comment #00013). 6 See Electronic Transactions Association (Comment #00011). VerDate Sep<11>2014 15:48 Nov 14, 2017 Jkt 244001 scope. Two organizations supported expanding the Rule. For example, NAID recommended that the Commission ‘‘add provisions and clarity to provide direction (and enforcement) related to . . . emerging issues’’ caused by advances in technology, such as the applicability of the Rule to third-party hardware providers (e.g., digital copier manufacturers who might retain a copy of consumer information) or cloud providers that may maintain consumer information. NAID also recommended expanding the definition of consumer information ‘‘as broadly as possible’’ because most covered entities already have considerably broad policies in place.7 EPIC supported expanding the definition of consumer information ‘‘to include information that is linked or linkable to an individual’’ because it ‘‘represents a more flexible, technology neutral approach that is consistent with the reality of modern business practices.’’ 8 Most trade associations argued against expansion of the Rule, asserting that laws and guidance currently in place sufficiently protect consumers. For instance, CDIA stated ‘‘[t]here is no net benefit in requiring consumer reporting agencies to incur the additional costs and burdens of applying the Disposal Rule to aggregate information, blind data, or otherwise de-identified data when such a change would not address any identified consumer harm or provide consumers with additional protection.’’ 9 DMA commented that ‘‘[e]xpanding the scope of the Disposal Rule could unnecessarily risk stifling an innovative sector that has created enormous job opportunities and provides consumers with robust benefits.’’ 10 The Commission agrees with the commenters who stated that the Rule should continue as it is and that it is not necessary to expand the Rule. No commenter who supported expansion of the Rule provided any evidence of problematic acts or practices that remain unaddressed with the scope of the current Rule. As to NAID’s comment requesting clarity on emerging issues relating to advances in technology including the applicability of the Rule to third-party service providers, the Commission notes that the Rule already applies to ‘‘[a]ny person who maintains or otherwise 7 See National Association for Information Destruction (Comment #00009). 8 See Electronic Privacy Information Center (Comment #00015). 9 See Consumer Data Industry Association (Comment #00010). 10 See Data & Marketing Association (Comment #00012). PO 00000 Frm 00025 Fmt 4700 Sfmt 4700 52847 possesses consumer information for a business purpose’’ and requires ‘‘reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.’’ 11 Thus, the Commission does not believe a Rule change is needed to address this issue. As to the commenters that were concerned that the definition of ‘‘consumer information’’ is too limiting, the Commission notes that the definition—which excludes ‘‘aggregate information’’ and ‘‘blind data’’—is not limited to information that identifies a consumer by name only. The Statement of Basis and Purpose to the final Rule noted that the terms ‘‘aggregate information’’ and ‘‘blind data’’ are intended to have the same meaning as in the Commission’s Gramm-LeachBliley Act Rule regarding the Privacy of Consumer Financial Information, 16 CFR part 313 (the ‘‘GLB Privacy Rule’’). The GLB Privacy Rule in turn defines aggregate information or blind data as information ‘‘that does not contain personal identifiers such as account numbers, names, or addresses.’’ 12 In addition, in the Statement of Basis and Purpose for the Disposal Rule, the Commission stated that there are ‘‘a variety of personal identifiers beyond simply a person’s name that would bring information within the scope of the Rule, including, but not limited to, a social security number, driver’s license number, phone number, physical address, and email address.’’ 13 The Commission did not include a rigid definition in the final Rule because it noted that, depending upon the circumstances, data elements that are not inherently identifying can, in combination, identify particular individuals.14 Thus, the rulemaking record makes clear that the definition of ‘‘consumer information’’ is not unduly limited. It may include other information that can be used to identify an individual. The Commission does not believe it is necessary to amend the Rule on this point. In light of the comments received, the Commission concludes that a continuing need exists for the Rule and that costs imposed on businesses are reasonable. The Commission has determined to retain the Rule without amendment at this time. The Commission will continue to monitor changes in technology and industry 11 See 16 CFR 682.3(a). 69 FR at 68692; 16 CFR 313.3(o)(2)(ii). 13 69 FR at 68692. 14 Id. 12 See E:\FR\FM\15NOR1.SGM 15NOR1 52848 Federal Register / Vol. 82, No. 219 / Wednesday, November 15, 2017 / Rules and Regulations standards and practices to determine if it should take action in the future. Paragraph 1. The authority citation for part 1 continues to read in part as follows: ■ By direction of the Commission. Donald S. Clark, Secretary. Authority: 26 U.S.C. 7805 * * * [FR Doc. 2017–24728 Filed 11–14–17; 8:45 am] Par. 2. Section 1.367(a)–1 is amended by adding paragraph (e) to read as follows: ■ BILLING CODE 6750–01–P § 1.367(a)–1 Transfers to foreign corporations subject to section 367(a): In general. DEPARTMENT OF THE TREASURY Internal Revenue Service * 26 CFR Part 1 [TD 9803] RIN 1545–BL87 Treatment of Certain Transfers of Property to Foreign Corporations; Correction Internal Revenue Service (IRS), Treasury. ACTION: Correcting amendment. AGENCY: This document contains corrections to final regulations (TD 9803) that were published in the Federal Register on Friday, December 16, 2016. The final regulations are related to certain transfers of property by United States persons to foreign corporations. SUMMARY: This correction is effective on November 15, 2017 and is applicable on or after December 16, 2016. FOR FURTHER INFORMATION CONTACT: Lynlee Baker at (202) 317–6937 (not a toll-free number). SUPPLEMENTARY INFORMATION: DATES: Background The final regulations (TD 9803) that are the subject of this correction are issued under section 367 of the Internal Revenue Code. Need for Correction sradovich on DSK3GMQ082PROD with RULES List of Subjects in 26 CFR Part 1 Income taxes, Reporting and recordkeeping requirements. Correction of Publication Accordingly, 26 CFR part 1 is corrected by making the following correcting amendment: 15:48 Nov 14, 2017 * * * * (e) Close of taxable year in certain section 368(a)(1)(F) reorganizations. If a domestic corporation is the transferor corporation in a reorganization described in section 368(a)(1)(F) after March 30, 1987, in which the acquiring corporation is a foreign corporation, then the taxable year of the transferor corporation shall end with the close of the date of the transfer and the taxable year of the acquiring corporation shall end with the close of the date on which the transferor’s taxable year would have ended but for the occurrence of the transfer. With regard to the consequences of the closing of the taxable year, see section 381 and the regulations thereunder. * * * * * Martin V. Franks, Chief, Publications and Regulations Branch, Legal Processing Division, Associate Chief Counsel (Procedure and Administration). [FR Doc. 2017–24687 Filed 11–14–17; 8:45 am] BILLING CODE 4830–01–P PENSION BENEFIT GUARANTY CORPORATION 29 CFR Part 4022 Benefits Payable in Terminated SingleEmployer Plans; Interest Assumptions for Paying Benefits Pension Benefit Guaranty Corporation. ACTION: Final rule. AGENCY: As published, the final regulations published in the Federal Register on Friday, December 16, 2016 (81 FR 91012) (TD 9803) contain an error that needs to be corrected. Specifically, paragraph (e) was inadvertently omitted from the final regulations. VerDate Sep<11>2014 FOR FURTHER INFORMATION CONTACT: PART 1—INCOME TAXES Jkt 244001 This final rule amends the Pension Benefit Guaranty Corporation’s regulation on Benefits Payable in Terminated Single-Employer Plans to prescribe interest assumptions under the regulation for valuation dates in December 2017. The interest assumptions are used for paying benefits under terminating singleemployer plans covered by the pension insurance system administered by PBGC. SUMMARY: DATES: PO 00000 Effective December 1, 2017. Frm 00026 Fmt 4700 Sfmt 4700 Daniel S. Liebman (liebman.daniel@ pbgc.gov), Acting Assistant General Counsel for Regulatory Affairs, Pension Benefit Guaranty Corporation, 1200 K Street NW., Washington, DC 20005, 202–326–4400 ext. 6510. (TTY/TDD users may call the Federal relay service toll-free at 1–800–877–8339 and ask to be connected to 202–326–4400, ext. 6510.) PBGC’s regulation on Benefits Payable in Terminated Single-Employer Plans (29 CFR part 4022) prescribes actuarial assumptions—including interest assumptions—for paying plan benefits under terminated single-employer plans covered by title IV of the Employee Retirement Income Security Act of 1974. The interest assumptions in the regulation are also published on PBGC’s Web site (http://www.pbgc.gov). PBGC uses the interest assumptions in appendix B to part 4022 to determine whether a benefit is payable as a lump sum and to determine the amount to pay. Appendix C to part 4022 contains interest assumptions for private-sector pension practitioners to refer to if they wish to use lump-sum interest rates determined using PBGC’s historical methodology. Currently, the rates in appendices B and C of the benefit payment regulation are the same. The interest assumptions are intended to reflect current conditions in the financial and annuity markets. Assumptions under the benefit payments regulation are updated monthly. This final rule updates the benefit payments interest assumptions for December 2017.1 The December 2017 interest assumptions under the benefit payments regulation will be 0.75 percent for the period during which a benefit is in pay status and 4.00 percent during any years preceding the benefit’s placement in pay status. In comparison with the interest assumptions in effect for November 2017, these assumptions are unchanged. PBGC has determined that notice and public comment on this amendment are impracticable and contrary to the public interest. This finding is based on the need to determine and issue new interest assumptions promptly so that the assumptions can reflect current market conditions as accurately as possible. SUPPLEMENTARY INFORMATION: 1 Appendix B to PBGC’s regulation on Allocation of Assets in Single-Employer Plans (29 CFR part 4044) prescribes interest assumptions for valuing benefits under terminating covered single-employer plans for purposes of allocation of assets under ERISA section 4044. Those assumptions are updated quarterly. E:\FR\FM\15NOR1.SGM 15NOR1

Agencies

[Federal Register Volume 82, Number 219 (Wednesday, November 15, 2017)]
[Rules and Regulations]
[Pages 52846-52848]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-24728]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 314

[RIN 3084-AB41]


Disposal of Consumer Report Information and Records

AGENCY: Federal Trade Commission.

ACTION: Confirmation of rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission has completed its regulatory 
review of its rule regarding Disposal of Consumer Report Information 
and Records as part of the Commission's systematic review of all 
current Commission rules and guides, and has determined to retain the 
Rule in its current form.

DATES: This action is effective on November 15, 2017.

ADDRESSES: Relevant portions of the proceeding, including this 
document, are available at www.ftc.gov.

FOR FURTHER INFORMATION CONTACT: Tiffany George, (202) 326-3040, 
Attorney, Division of Privacy and Identity Protection, Federal Trade 
Commission, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: 

I. Introduction

    In September 2016, the Federal Trade Commission (``FTC'' or 
``Commission'') requested comments on its rule regarding Disposal of 
Consumer Report Information and Records (``Disposal Rule'' or 
``Rule''), as part of its comprehensive regulatory review program. 
Specifically, the Commission sought comments on the Rule's costs and 
benefits, and on whether it should modify the Rule to account for 
changes in technology or information destruction standards.
    After considering the comments, the Commission has determined to 
retain the Rule without amendment. Most of the commenters who addressed 
the issue supported the Rule's current provisions. A few commenters 
recommended expanding the Rule's provisions. Because the Commission has 
not seen any evidence of problematic acts or practices that any 
proposed modification would address, it has determined not to amend the 
Rule at this time.
    This document provides background, analyzes the comments, and 
further explains the Commission's decision.

II. Background

    The Fair and Accurate Credit Transactions Act (``FACTA'' or 
``Act'') was enacted in 2003. In part, the Act amended the Fair Credit 
Reporting Act (``FCRA'') by requiring that any person that maintains or 
otherwise possesses consumer information, or any compilation of 
consumer information, derived from consumer reports for a business 
purpose, properly dispose of any such information or compilation. The 
Act also required the Commission and other federal agencies to 
promulgate rules regarding the proper disposal of consumer report 
information and records.
    Pursuant to the Act's directive, the Commission promulgated the 
Disposal Rule in 2004, which became effective on June 1, 2005.\1\ The 
Disposal Rule requires that persons over which the FTC has jurisdiction 
who maintain or otherwise possess consumer information for a business 
purpose properly dispose of such information by taking reasonable 
measures to protect against unauthorized access to or use of the 
information in connection with its disposal. The Rule defines 
``consumer information'' as ``any record about an individual, whether 
in paper, electronic, or other form, that is a consumer report or is 
derived from a consumer report. Consumer information also means a 
compilation of such records. Consumer information does not include 
information that does not identify individuals, such as aggregate 
information or blind data.'' \2\
---------------------------------------------------------------------------

    \1\ See 69 FR 68690 (Nov. 24, 2004); 16 CFR 682.
    \2\ See 16 CFR 682.1(b).
---------------------------------------------------------------------------

    The Rule includes several examples of what the Commission believes 
constitute reasonable measures to protect consumer information in 
connection with its disposal, including policies and procedures that 
require (1) the burning, pulverizing, or shredding of papers or (2) the 
destruction or erasure of electronic media containing consumer 
information so that the information cannot practicably be read or 
reconstructed. These examples are intended to provide covered entities 
with guidance on how to comply with

[[Page 52847]]

the Rule, but are not intended to be safe harbors or exclusive methods 
for compliance. In promulgating the Rule, the FTC noted that there are 
few foolproof methods of record destruction and that entities covered 
by the Rule must consider their own unique circumstances when 
determining how to best comply with the Rule.
    In September 2016, the Commission published a Notice seeking 
comment on the Rule as part of the Commission's ongoing comprehensive 
regulatory review program.\3\ The Notice sought comment on the Rule's 
overall costs, benefits, necessity, and regulatory and economic impact. 
The Notice also asked for comment on whether the Commission should 
modify the Rule in light of changes in technology and industry 
standards and practices.
---------------------------------------------------------------------------

    \3\ Federal Trade Commission: Disposal of Consumer Report 
Information: Request for Comments, 81 FR 63435 (Sept. 15, 2016).
---------------------------------------------------------------------------

III. Regulatory Review Comments and Analysis

    The Commission received 11 comments in response to the Notice 
during the comment period.\4\ Comments were filed by individuals, trade 
associations, and research organizations. The Commission received 
comments from such diverse organizations as the National Automobile 
Dealers Association (``NADA''), Data & Marketing Association (``DMA''), 
National Association for Information Destruction (``NAID''), Consumer 
Data Industry Association (``CDIA''), Electronic Transactions 
Association (``ETA''), and Electronic Privacy Information Center 
(``EPIC'').
---------------------------------------------------------------------------

    \4\ The comments are posted at: https://www.ftc.gov/policy/public-comments/initiative-672. The Commission has assigned each 
comment a number appearing after the name of the commenter and the 
date of submission. This notice cites comments using the last name 
of the individual submitter or the name of the organization, 
followed by the number assigned by the Commission.
---------------------------------------------------------------------------

    All of the commenters addressing the issue supported the Rule 
overall. Indeed, none of the commenters advocated repealing the Rule or 
narrowing its scope. For example, NADA stated that ``the Disposal Rule 
is well-established and working effectively and we do not believe it 
needs to be changed or amended in any significant way.'' \5\ In 
addition, ETA noted that ``the Disposal Rule as currently written 
effectively promotes consumer information security.'' \6\
---------------------------------------------------------------------------

    \5\ See National Automobile Dealers Association (Comment 
#00013).
    \6\ See Electronic Transactions Association (Comment #00011).
---------------------------------------------------------------------------

    Commenters differed on whether the Commission should expand the 
Rule's scope. Two organizations supported expanding the Rule. For 
example, NAID recommended that the Commission ``add provisions and 
clarity to provide direction (and enforcement) related to . . . 
emerging issues'' caused by advances in technology, such as the 
applicability of the Rule to third-party hardware providers (e.g., 
digital copier manufacturers who might retain a copy of consumer 
information) or cloud providers that may maintain consumer information. 
NAID also recommended expanding the definition of consumer information 
``as broadly as possible'' because most covered entities already have 
considerably broad policies in place.\7\ EPIC supported expanding the 
definition of consumer information ``to include information that is 
linked or linkable to an individual'' because it ``represents a more 
flexible, technology neutral approach that is consistent with the 
reality of modern business practices.'' \8\
---------------------------------------------------------------------------

    \7\ See National Association for Information Destruction 
(Comment #00009).
    \8\ See Electronic Privacy Information Center (Comment #00015).
---------------------------------------------------------------------------

    Most trade associations argued against expansion of the Rule, 
asserting that laws and guidance currently in place sufficiently 
protect consumers. For instance, CDIA stated ``[t]here is no net 
benefit in requiring consumer reporting agencies to incur the 
additional costs and burdens of applying the Disposal Rule to aggregate 
information, blind data, or otherwise de-identified data when such a 
change would not address any identified consumer harm or provide 
consumers with additional protection.'' \9\ DMA commented that 
``[e]xpanding the scope of the Disposal Rule could unnecessarily risk 
stifling an innovative sector that has created enormous job 
opportunities and provides consumers with robust benefits.'' \10\
---------------------------------------------------------------------------

    \9\ See Consumer Data Industry Association (Comment #00010).
    \10\ See Data & Marketing Association (Comment #00012).
---------------------------------------------------------------------------

    The Commission agrees with the commenters who stated that the Rule 
should continue as it is and that it is not necessary to expand the 
Rule. No commenter who supported expansion of the Rule provided any 
evidence of problematic acts or practices that remain unaddressed with 
the scope of the current Rule.
    As to NAID's comment requesting clarity on emerging issues relating 
to advances in technology including the applicability of the Rule to 
third-party service providers, the Commission notes that the Rule 
already applies to ``[a]ny person who maintains or otherwise possesses 
consumer information for a business purpose'' and requires ``reasonable 
measures to protect against unauthorized access to or use of the 
information in connection with its disposal.'' \11\ Thus, the 
Commission does not believe a Rule change is needed to address this 
issue.
---------------------------------------------------------------------------

    \11\ See 16 CFR 682.3(a).
---------------------------------------------------------------------------

    As to the commenters that were concerned that the definition of 
``consumer information'' is too limiting, the Commission notes that the 
definition--which excludes ``aggregate information'' and ``blind 
data''--is not limited to information that identifies a consumer by 
name only. The Statement of Basis and Purpose to the final Rule noted 
that the terms ``aggregate information'' and ``blind data'' are 
intended to have the same meaning as in the Commission's Gramm-Leach-
Bliley Act Rule regarding the Privacy of Consumer Financial 
Information, 16 CFR part 313 (the ``GLB Privacy Rule''). The GLB 
Privacy Rule in turn defines aggregate information or blind data as 
information ``that does not contain personal identifiers such as 
account numbers, names, or addresses.'' \12\ In addition, in the 
Statement of Basis and Purpose for the Disposal Rule, the Commission 
stated that there are ``a variety of personal identifiers beyond simply 
a person's name that would bring information within the scope of the 
Rule, including, but not limited to, a social security number, driver's 
license number, phone number, physical address, and email address.'' 
\13\ The Commission did not include a rigid definition in the final 
Rule because it noted that, depending upon the circumstances, data 
elements that are not inherently identifying can, in combination, 
identify particular individuals.\14\
---------------------------------------------------------------------------

    \12\ See 69 FR at 68692; 16 CFR 313.3(o)(2)(ii).
    \13\ 69 FR at 68692.
    \14\ Id.
---------------------------------------------------------------------------

    Thus, the rulemaking record makes clear that the definition of 
``consumer information'' is not unduly limited. It may include other 
information that can be used to identify an individual. The Commission 
does not believe it is necessary to amend the Rule on this point.
    In light of the comments received, the Commission concludes that a 
continuing need exists for the Rule and that costs imposed on 
businesses are reasonable. The Commission has determined to retain the 
Rule without amendment at this time. The Commission will continue to 
monitor changes in technology and industry

[[Page 52848]]

standards and practices to determine if it should take action in the 
future.

    By direction of the Commission.
Donald S. Clark,
Secretary.
[FR Doc. 2017-24728 Filed 11-14-17; 8:45 am]
BILLING CODE 6750-01-P