Effective June 1, 2005, the Disposal Rule requires any person or entity who maintains or otherwise possesses consumer information for a business purpose that the consumer information be properly disposed of to protect against unauthorized access to or use of the information that could lead to identity theft and other forms of consumer fraud. This rule implements section 216 of the Fair and Accurate Credit Transactions Act of 2003, which is designed to reduce the risk of consumer fraud and related harms, including identity theft, created by improper disposal of consumer information.

In 2016, the Commission plans to request comments on the rule as part of the Commission's systematic review of all current Commission rules and guides.