Fair Credit Reporting Act (FCRA)

§ 628. Disposal of records [15 U.S.C. §1681w]

(a) Regulations

(1) In general. Not later than 1 year after the date of enactment of this section, the
Federal banking agencies, the National Credit Union Administration, and the
Commission with respect to the entities that are subject to their respective
enforcement authority under section 621, and the Securities and Exchange
Commission, and in coordination as described in paragraph (2), shall issue final
regulations requiring any person that maintains or otherwise possesses consumer
information, or any compilation of consumer information, derived from consumer
reports for a business purpose to properly dispose of any such information or
compilation.
(2) Coordination. Each agency required to prescribe regulations under paragraph (1)
shall–

(A) consult and coordinate with each other such agency so that, to the extent
possible, the regulations prescribed by each such agency are consistent and
comparable with the regulations by each such other agency; and
(B) ensure that such regulations are consistent with the requirements and
regulations issued pursuant to Public Law 106-102 and other provisions of
Federal law.

(3) Exemption authority. In issuing regulations under this section, the Federal banking
agencies, the National Credit Union Administration, the Commission, and the
Securities and Exchange Commission may exempt any person or class of persons
from application of those regulations, as such agency deems appropriate to carry
out the purpose of this section.

(b) Rule of construction. Nothing in this section shall be construed--

(1) to require a person to maintain or destroy any record pertaining to a consumer
that is not imposed under other law; or
(2) to alter or affect any requirement imposed under any other provision of law to
maintain or destroy such a record.