Data Destruction Compliance

The information on this page is not meant to provide legal advice, but rather create general awareness of compliance issues that may apply to data destruction.

Virtually every organization has a requirement to properly dispose of electronic data and many organizations do not even realize that they fall under one or more international, national, or state laws. For example, the US Fair Credit Reporting Act (“FCRA”), despite its name, applies to employment background checks as well. Another example is a website privacy statement -- failure to properly dispose of personal information collected from the website may constitute deceptive acts or practices, in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act.

The regulatory landscape is complex regarding data security and privacy requirements. Some Federal laws preempt state laws, while others do not; some Federal laws carve out exceptions if an entity is covered by another statute, while others do not. Most regulations are not explicit as to the specific data destruction requirements, but rather imply them due to the requirement to prevent unauthorized access to protected information.

However, the common thread for data destruction requirements in the United States, as well as many other countries, is one of “reasonableness.” The generally accepted approach to data destruction is to use reasonable efforts to render media practicably unreadable or unreconstructible. “Reasonable” may depend on many factors, but the general trend by regulatory agencies is to raise the reasonableness threshold for data security and the due diligence requirements for organizations to evaluate their service providers.

For example, the Federal Trade Commission's Disposal Rule (“Disposal Rule”) requires proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.” The rule applies to consumer reports or information derived from consumer reports. The Disposal Rule requires disposal practices that are “reasonable and appropriate to prevent the unauthorized access to – or use of – information in a consumer report.”

The FTC provides guidance as to the reasonable measures for the destruction of electronic consumer report information that include establishing and complying with specific policies to:

• destroy or erase electronic files or media containing consumer report information so that the information cannot be read or reconstructed;
• conduct due diligence and hire a document destruction contractor to dispose of material specifically identified as consumer report information consistent with the Rule. Due diligence could include:
  • reviewing an independent audit of a disposal company’s operations and/or its compliance with the Rule;
  • obtaining information about the disposal company from several references;
  • requiring that the disposal company be certified by a recognized trade association;
  • reviewing and evaluating the disposal company’s information security policies or procedures.

Note that no method of data destruction is specified. The National Institute of Standards and Technology (NIST) published NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization (NIST SP 800-88 R1) to provide guidance as to data destruction methods and media sanitization, certainly one of the key elements in assuring unauthorized access to data.

However, as explained by NIST:

“In order for organizations to have appropriate controls of the information they are responsible for safeguarding, they must properly secure used media. SP 800-88 Revision 1 recommends processes to guide media sanitization decision making regardless of the type of media in use. To effectively use this guide, organizations and individuals should focus on the information that may have been stored on the media, rather than focusing on the media itself. The document also includes guidelines and recommendations on methods for sanitizing different types of media...”

The method of data destruction is one key element required for compliance with applicable regulations, but it is the processes related to risk assessment, planning, security, control, chain of custody, and reporting that an organization and its service provider follow that achieve compliance to applicable regulations. Most data security and privacy frameworks go beyond being just compliance tools and take a risk-based approach. The European Union General Data Privacy Regulation (GDPR) even imposes a duty to carry out a data privacy impact assessment (DPIA) in the case that data processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk. Accordingly, any service provider that relies solely on the data destruction method to claim compliance with major regulations is in error.

For example, IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies and Entities, outlines the requirements and guidelines for external agencies and other authorized recipients of Federal Tax Information (FTI) material to establish procedures to ensure the adequate protection of the FTI data they receive. Additionally, the IRS follows the guidance set forth in NIST SP 800-88 R1 for media sanitization and destruction.

However, when a service provider is used for compliance with the IRS for protection of FTI, the emphasis is on the security and controls, including auditing of the service provider. The IRS has accepted the National Association for Information Destruction (NAID) certification as demonstrating the necessary processes and procedures with respect to data disposal of FTI:

“If the agency has legal authority to disclose FTI to a disposal contractor and chooses one that is National Association for Information Destruction (NAID) certified, the agency will not be required to complete an internal inspection every 18 months of that facility. However, it must maintain a copy of, and periodically validate the NAID certification.”