Reducing Risk Through Better Data Destruction Governance
We live in the “Information Age” where unprecedented amounts of digital data are created at the root of information, and this deluge isn’t slowing down.
According to the International Data Corporation (IDC), the digital universe is growing at 40% a year. Companies are responsible for generating, storing, and securing a large amount of this created data. In fact, IDC found that companies’ employees and consumers created two-thirds of data points.
Data can help a business fine-tune its day-to-day operations, better serve customers, and forecast future trends. But with great data comes great responsibility. The more data that companies create, the more they must properly manage and destroy it in order to protect the privacy of their employees and consumers.
Data breach statistics continue to grow, and compliance regulations continue to get tighter and tighter. While fines and legal fees associated with non-compliance vary widely, companies should prepare to pay more as both courts and class-action lawyers zero in on data misuse.
Now more than ever, a secure data destruction policy is critical.
Data destruction is the process of ‘properly’ destroying information, whether paper or digital, according to industry set compliance and best practice standards.
Secure data destruction overwrites sensitive information with random data, rendering the original material unreadable.
When individuals fail to implement secure data destruction methods, they’re vulnerable to identity theft. A 2015 study found that 48% of second-hand hard drives and smartphones had residual data containing sensitive personal information, photos, and videos.
The stakes are much higher for companies and larger organizations. When Affinity Health Plan, Inc. forgot to sanitize leased computer hardware, the health records of more than 340,000 people were compromised. The oversight cost the company a $1.2M settlement with the U.S. Department of Health and Human Services.
As the information landscape has evolved, so have government regulations concerning data. Several state and federal laws now mandate that companies properly store and destroy data to protect consumers and employees.
The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996 as the healthcare industry began to rely on digital systems in both clinical and administrative settings. This federal legislation protects medical records and prevents their disclosure.
HIPAA data destruction protocols are stringent and include the following:
Enacted in 1984, the Computer Fraud and Abuse Act has been updated six times to reflect changes in data collection and technology. Essentially, the law prohibits accessing a computer without authorization, and was designed to penalize hackers. Punishments can be severe and result in criminal convictions.
The Gramm-Leach-Bliley Act mandates that financial institutions—such as banks, mortgage lenders, and credit unions—carry out data destruction in a manner consistent with the Federal Trade Commission’s strict disposal regulations. These include protocols similar to HIPAA’s requirements: burning, pulverizing, or shredding consumer information, erasure of electronic media in a way that prevents data from being read or reconstructed, and due diligence on partnerships with contractors that carry out destruction.
Enacted in response to corporate financial scandals, including Enron and WorldCom, the Sarbanes-Oxley Act of 2002 (SOX) protects investors from corporate fraud. Record management is central to SOX, which sets special guidelines for retaining, auditing, and destroying financial data.
The Fair and Accurate Credit Transactions Act (FACTA) is an amendment to the better-known Fair Credit Reporting Act. Enacted in 2003, FACTA protects consumers from identity theft and stipulates that all businesses—regardless of size or industry—must protect customer data. Specialized data disposal guidelines were added in 2005.
Visit AccessCorp.com/records-management/regulatory-compliance/ to see how Access works directly with clients to ensure compliance amongst a wide array of industry standards.
When pressure for legal compliance increases, it may be time to partner with a vendor like Access that offers information management lifecycle programs focused on security and defensibility.
Data is a double-edged sword. As valuable as it can be in helping companies understand consumer trends, it can also be costly when mismanaged. Failure to maintain data destruction compliance can result in hefty fines and lawsuits, as well as devastating reputation damage.
Fortunately, there are clear steps companies can take to ensure secure data destruction:
A data destruction policy guides the process by which data is cleaned and destroyed within an organization and covers all data, whether in print or digital. When crafting this policy, organizations need to ensure it is in compliance with all industry, state, and federal regulations.
Maintaining data destruction compliance begins with creating formalized policies surrounding the process.
First, a company must clearly define the data it wants to protect. Not all data is created equal, and it’s important to identify which documents will be included in the destruction procedures. When drafting policies, companies should involve representatives from a variety of departments, ensuring all weak points and improvement opportunities are taken into consideration.
And, remember: Enforcing secure data destruction policies is just as important as creating policies. Audits of data destruction policies should be performed periodically to ensure that all requirements are being met.
By law, some companies must keep hard copies of certain records for specific amounts of time. In these cases, there are methods and retention schedules for securely destroying paper documents.
However, in most circumstances, paper is an unnecessary liability. It’s impossible to determine who read a piece of paper or who made a photocopy. Even the most meticulous filing system can’t alert a manager when paperwork goes missing, or when an audit wasn’t performed.
By digitizing records and using smart data destruction software, such as CartaHR, which can be configured to automatically delete documents on retention schedules, companies can take an important step in ensuring that sensitive data is properly stored and permanently destroyed.
Records management software is a one-stop shop for protecting data over the course of its entire lifecycle. By automating processes and performing autonomous audits, these systems can alert users when documents have expired and should be destroyed. Retaining certain documents, such as I-9 forms, longer than required by law can result in fines, so it’s important to not only destroy documents but to do so in a timely manner.
Laws for data retention and destruction vary by industry and by state. To ensure your company is in compliance, consider working with a records management consultant. These experts can determine if your organization is properly storing and destroying data, protecting you from costly lawsuits and fines.
Whether you’re destroying paper documents or digital files, a data destruction vendor can ensure that your information is gone for good. Before hiring a vendor, do your research to make sure they meet your company’s individual data needs and are qualified to protect your employees and clients.
When searching for a secure data destruction company, ask the following:
As more and more data becomes available, companies have a unique opportunity to improve operations, better serve customers, and improve the bottom line. However, it’s crucial that businesses understand how to protect themselves from costly data breaches and information mismanagement. By creating secure data destruction policies and working with certified data destruction vendors, companies can remain compliant while reaping the benefits of the Information Age.
Brian Quinn is an expert on records and information management, scanning operations and systems, digital transformation, and secure destruction of information. Brian is a Certified Records Manager (CRM), Certified Information Professional (CIP) and has an MBA from Xavier University’s Williams College of Business.
Share