15 USC 1681w - Disposal of records

(a) Regulations 

(1) In general 
Not later than 1 year after December 4, 2003, the Federal banking agencies, the National Credit Union Administration, and the Commission with respect to the entities that are subject to their respective enforcement authority under section 1681s of this title, and the Securities and Exchange Commission, and in coordination as described in paragraph (2), shall issue final regulations requiring any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation.
(2) Coordination 
Each agency required to prescribe regulations under paragraph (1) shall
(A) consult and coordinate with each other such agency so that, to the extent possible, the regulations prescribed by each such agency are consistent and comparable with the regulations by each such other agency; and

view counter
(B) ensure that such regulations are consistent with the requirements and regulations issued pursuant to Public Law 106102 and other provisions of Federal law.
(3) Exemption authority 
In issuing regulations under this section, the Federal banking agencies, the National Credit Union Administration, the Commission, and the Securities and Exchange Commission may exempt any person or class of persons from application of those regulations, as such agency deems appropriate to carry out the purpose of this section.
(b) Rule of construction 
Nothing in this section shall be construed
(1) to require a person to maintain or destroy any record pertaining to a consumer that is not imposed under other law; or
(2) to alter or affect any requirement imposed under any other provision of law to maintain or destroy such a record.