Today I read a report about an incident for which many other similar incidents have occurred lately, and throughout the years. The Calgary, Canada Privacy Commissioner started an investigation into a complaint that a Staples Business Depot store in Calgary sold a computer that contained a previous customer’s personal information. This would be a violation of Canada’s Personal Information Protection Act (PIPA) if the store really did leave the information on the computer without the customer’s knowledge and consent, and certainly if this is true, selling a computer containing personal information is not the way you want to demonstrate your company properly safeguards personal information. See http://www.gov.ab.ca/acn/200601/19333026FCE40-E94C-2475-198185B9A5012E05.html for more information on this particular incident.
I do not think this is an isolated event. In fact, it would be interesting to do a study of the used computers sold by companies in stores, through websites (yes, such as the Morgan Stanley Blackberry sold on eBay I wrote about also on this blog), and see how many of them still contain information. I would anticipate the numbers would be high. According to Gartner, U.S. homes and businesses combined discard 133,000 PCs EACH DAY (see http://msnbc.msn.com/id/10312478/site/newsweek/ for one story on this). Additionally, the U.S. Environmental Protection Agency reports U.S. residents throw way 2 million tons of tech trash each year (see http://www.tdn.com/articles/2006/01/23/area_news/news07.txt for one story on this). That’s a whole lot of computers!! How many of these devices still have sensitive information stored upon them when they are discarded, which includes being donated to other organizations, or sold to computer store or through auction sites? Does your organization completely remove sensitive information from retired computing devices? Do you have procedures in place to accomplish this? Identity theft and careless disposal of confidential information are posing increasing problems for individuals and businesses. Increasingly growing numbers of laws and regulations require businesses to take due care actions to prevent such incidents.