Every Company Has Information That Requires Destruction.All businesses have occasion to discard confidential data. Customer lists, price lists, sales statistics, drafts of bids and correspondence, and even memos contain information about business activity which would interest any competitor. Every business is also entrusted with information that must be kept private. Employees and customers have the legal right to have this data protected. Do you know what your employees are doing with customer’s confidential information? Do you have a system in place?
Without the proper safeguards, information ends up in the dumpster where it is readily, and legally, available to anybody. The trash is considered by business espionage professionals as the single most available source of competitive and private information from the average business. Any establishment that discards private and proprietary data without the benefit of destruction, exposes itself to the risk of criminal and civil prosecution, as well as the costly loss of business. A recent court decision sided on the side of “dumpster divers” saying the information in the dumpster was accessible to the public.
Stored Records Should Be Destroyed On A Regular Schedule.
The period of time that business records are stored should be determined by a retention schedule that takes into consideration their useful value to the business and the governing legal requirements. No record should be kept longer than this retention period.
By not adhering to a program of routinely destroying stored records, a company exhibits suspicious disposal practices that could be negatively construed in the event of litigation or audit. Also, the new (Federal Rule 26) requires that, in the event of a law suit, each party provide all relevant records to the opposing counsel within 85 days of the defendants initial response. If either of the litigants does not fulfill this obligation, it will result in a summary finding against them. By destroying records according to a set schedule, a company appropriately limits the amount of materials it must search through to comply with this law. If you have ever been sued, we cannot tell you have valuable this destruction could be.
From a risk management perspective, the only acceptable method of discarding stored records is to destroy them by a method that ensures that the information is obliterated. Documenting the exact date that a record is destroyed is a prudent and recommended legal precaution.
Incidental Business Records Discarded On A Daily Basis Should Be Protected.
Do you have a program to control your discarded data? Without a program to control it, the daily trash of every business contains information that could be harmful. This information is especially useful to competitors because it contains the details of current activities. Discarded daily records include phone messages, memos, misprinted forms, drafts of bids and drafts of correspondence. Don’t let your hard work get into your competitors hands.
All businesses suffer potential exposure due to the need to discard these incidental business records. The only means of minimizing this exposure is to make sure such information is securely collected and destroyed.
Recycling Is Not An Adequate Alternative For Information Destruction.
To extract the scrap value from office paper, recycling companies use unscreened, minimum wage workers, to extensively sort the paper under unsecured conditions. The acceptable paper is stored for indefinite periods of time until there is enough of a particular type to sell.
There is no fiduciary responsibility inherent in the recycling scenario. Paper is given away or sold and, by doing so, a company gives up the right to have a say in how it is handled. There is, also, no practical means of establishing the exact date that a record is destroyed. In the event of an audit or litigation, this could be a legal necessity. And, further, if something of a private nature does surface, the selection of this unsecured process could be interpreted as negligent. For all these reasons, the choice of recycling as a means of information destruction is undesirable from a risk management perspective. There are many documented cases where this information gets into the wrong hands. Lawsuits and fraud are often the outcome.
If environmental responsibility is a concern, materials may be recycled after they are destroyed or a firm can contract a service that will destroy the materials under secure conditions before recycling them. Any recycling company that minimizes the need for security has its own interests in mind and should be avoided.
A Certificate Of Destruction Does Not Relieve A Company From Its Obligation To Keep Information Confidential.
Any company contracting an information destruction service should require that it provide them with a signed testimonial, documenting the date that the materials were destroyed. The "certificate of destruction", as it is commonly referred, is an important legal record of compliance with a retention schedule. It does not, however, effectively transfer the responsibility to maintain the confidentiality of the materials to the contractor.
If private information surfaces after the vendor accepts it, the court is bound to question the process by which the particular contractor was selected. Any company not showing due diligence in their selection of a contractor that is capable of providing the necessary security could be found negligent.
And, from a practical standpoint, if proprietary or private information is lost or leaked by the fraud or negligence of a vendor, the obligations of that vendor are irrelevant. The firm whose information falls into the wrong hands stands to lose the most, either from loss of business, prosecution or unfavorable publicity. Let Shred King assist you in setting up a process that protects you from these types of things from happening.