Defunct Businesses, Abandoned Records Threat to Data Security

Location

With the faltering economy, many businesses are shutting their doors – and sometimes improperly disposing of their records, putting their former customers at risk for identity theft. Examples from just the past month include:

•In late May, two decades’ worth of customer records from a recently closed boat company in Portland, Oregon, were discovered in a dumpster. The records contained personal information, including Social Security numbers, according to Portland television station KGW, which had received a tip about the abandoned records.

When contacted, the former business owner said a shredding company was supposed to pick up the records and dispose of them. It later did, but only time will tell if any personal information had been compromised before the owner was alerted. According to KGW, the Oregon State Finance and Corporation Division is looking into the matter.

•In late April, hundreds of medical files containing patient Social Security numbers and other private information were found outside a former physical therapy clinic in Monticello, New York. The records had apparently been abandoned by the tenant, which had vacated the premises months earlier, according to the Times Herald-Record.

•Also in April, dozens of personal documents from a San Antonio tax preparation business that had closed its doors were found in a dumpster after it was set on fire. A former employee told a KENS 5 television station reporter that he knew nothing about the documents. KENS 5 staff observed that although tax season was over, the headaches could just be starting for those whose information had been improperly discarded.

“The trash is considered by business espionage professionals as the single most available source of competitive and private information from the average business,” according to the National Association for Information Destruction (NAID), a non-profit trade association of the secure information destruction industry. “Any establishment that discards private and proprietary data without the benefit of destruction exposes itself to the risk of criminal and civil prosecution, as well as the costly loss of business.”

To protect themselves, businesses that are closing should consult with legal counsel to determine what records it must maintain, what records should be returned to customers, and what records can safely be destroyed. For records that may be destroyed, NAID recommends using a method that ensures obliterating the information. If the volume is small, a business could follow the recommendation in a guideline available from ARMA International titled Contracted Destruction for Records and Information Media to securely destroy its records that contain confidential information: cross shred paper, degauss and shred zip drives, hard drives, and thumb drives, and shred audio/video tapes.

A business that is closing may have too large a volume of records to destroy them in-house, in which case it may consider using a third-party vendor of destruction services. Contracted Destruction for Records and Information Media identifies the critical components for selecting a vendor and ensuring records are not compromised through any part of the destruction process.

NAID’s Compliance Toolkit, which is available from NAID members, provides guidance to help businesses, including these recommendations for securing records once they are identified as being eligible for destruction:

•Records to be destroyed should be segregated, inventoried, and isolated in a manner that reasonably minimizes any chance of unauthorized access and diversion.

•All media designated for authorized destruction must be transported to the secure destruction in secure and/or locked containers.

•All vehicles transporting secure and/or locked containers must be locked when unattended. See www.arma.org and www.naidonline.org for more information about records security and destruction.

Bottom line, use a professional Records Management company like Offsite Data Depot to dispose of your records properly.

ARMA International IMN, May