FTC Hard Drive Destruction
GLBA & FCRA: FTC Security Rule
The FTC Watches Your Hard Drive Destruction and IT Disposal Practices
If one of your recycled computers shows up on eBay – with consumer information intact – your hard drive destruction and IT Asset Disposal practices may be audited. With the outbreak of data leaks in recent years, FTC hard drive destruction and data destruction procedures are in the spotlight – all the way down to how you dispose of computers. The photo shows an unsecured computer recycling staging area.
The Federal Trade Commission (FTC) is responsible for enforcing the “Disposal Rule”
The FTC Disposal Rule requires companies to properly dispose of personally identifiable information (PII) on computer hard drives or other digital media. The goal is to reduce the risk of data breaches and identity theft by holding companies accountable for their handling of consumer information. This rule sets the crosshairs of the FTC on the computer-recycling, IT Asset Disposal and digital media destruction process of an organization.
The price mishandling consumer data is about $1,000 for every affected consumer in the event of a breach. This doesn’t sound like much but consider that a hard drive may contain hundreds of thousands of client records, and suddenly a single infraction has bankrupted your business. This does not cover your Lost Business Costs such as: lost customers, legal costs and investigations.
The Fair Credit Reporting Act (FCRA) dictates that credit-reporting companies may not “furnish” consumer data to unauthorized third parties and prescribes penalties of as much as $1,000 for every affected consumer. A lawsuit under the FCRA does not require proof of identity theft or any out-of-pocket losses.
A Certificate of Destruction Does Not Transfer Liability
You may have received a Certificate of Destruction from your e-waste recycling or hard drive destruction vendor thinking the document transfers liability to them, but it does not. The original collector and holder of personally identifiable information retains 100% of the liability for protecting it – even if the recycler is contractually obligated to destroy the data. Allowing digital media such as hard drives and cell phones to leave your custody without first being physically destroyed breaks the chain of custody, and you have no proof that the third party destroyed the data. Certificate of Destruction.
How do you dispose of hard drives to comply with the Disposal Rule?
Physically shred your hard drives, memory modules, and mobile devices. NIST 800-88 Guidelines state that physically shredding media is more secure than erasing, wiping, and degaussing. Erasing media may allow you to recoup some residual value, but it takes time, is prone to mistakes, and most of all, is not compliant with FCRA or NIST most stringent requirements. Not to mention that the recovered value would pale in comparison to the fines associated with a data breach.
OnSite Hard Drive Destruction
Have your data destruction vendor come to your office. This allows multiple employees to witness and verify the data destruction results. Hire a certified vendor specializing in hard drive destruction. Data privacy laws require that companies have a written data destruction plan in place prior to destroying hard drives and other digital media. There is also a requirement that a company perform proper due diligence on the chosen data destruction vendor. Hiring a vendor certified by an internationally-recognized association such as NAID fulfills most due diligence obligation. NAID certified hard drive destruction.
In the past, companies focused their IT Asset Disposal efforts first on recouping residual value from retired IT assets, then on complying with environmental laws for e-waste assets, and then on disposing of confidential information by the easiest method possible, in that order. The constant recurrence of data breaches has thrown this thinking out the window and has placed the spotlight squarely on secure data disposal processes. The public is rightfully angry that their personal information is being exposed on a daily basis, and to garner support, politicians are rallying for more robust security regulations and putting pressure on governance bodies such as the FTC. To avoid becoming the next target of an FTC investigation and the resulting fines, your business would be well advised to overhaul its hard drive and data disposal processes and consider leveraging the services of a certified disposal partner.
