All across the United States, responsible, security-conscious people hand their confidential paper and electronics over to a packaging center or office supply store with the promise of secure destruction. Maybe the sensitive paper or electronics were handed over to a clerk at the counter. Other times those materials are placed in a not-so-secure container somewhere in the store.

The customer is trying to do the right thing. Often they are an individual using the service to keep their (and their family’s) private information from malevolent forces. Other times, they are doing it for a small business to protect their clients and to comply with data protection laws.

Either way, the logic is to be commended, though the option they are choosing is not.

To appreciate why over-the-counter data destruction is problematic, there are somethings you need to know, none of which would be common knowledge to the average person who is simply trying to do the right thing. Luckily, there are also equally convenient options for data destruction that are safer and more acceptable which will be discussed at the conclusion.

Over-the-Counter Data Destruction and Small Businesses

All organizations, including small businesses, have good reasons to protect the information they discard. In fact, they really have no choice. Customers flee (and often sue) when they learn that their privacy rights have been violated or that they have been put at risk of identity fraud. Regulators frown on it too, fining or even closing down businesses that ignore their data protection requirements.

The fact is, all businesses entrusted with personal information are responsible for the data security of the other entities – the retailer, in this case – with whom they entrust that information. They are, therefore, legally required to make sure those retailers have an appropriate level of security, for instance, that employees are screened and trained, that access is controlled and monitored, that there are written policies and procedures, and that the retailer also contractually accepts the fiduciary responsibility for data protection.

None of these legal requirements are met in the typical over-the-counter data destruction scenario.

Therefore, while the small business using over-the-counter data destruction may have the right intentions, they are technically violating their regulatory obligations.

Over-the-Counter Data Destruction and the Private Individual

Things are a little different for an individual, primarily because, unlike the small business, an individual is deciding the fate of their own information. There’s no regulation requiring a person to protect themselves from identity fraud or privacy violations. Their motivation is not a legal requirement but simply wanting to protect themselves.

To that end, it is up to the individual to decide whether things like employee screening and training, access control, fiduciary acceptance, audit trails, customer traffic, etc., are acceptable. It is also up to the individual to decipher the often ambiguous or even deceptive assurances of the retailer regarding the security measures and the degree to which they accept responsibility.

Do This Instead: Convenient Alternatives to Over-the-Counter Data Destruction

• Deal directly with a data destruction company that is certified by a recognized authority. Most of these firms, like Shred Vault®, accept drop offs of paper or electronics from individuals and small businesses. And, unlike the retail over-the-counter option, their certification is based on the fact that they have employee screening and training, access control, written policies and procedures, and that they fully accept the fiduciary responsibility for destroying the data.
• If you are lucky enough to be near one, use a Shred Vault® kiosk, where sensitive information is sealed by the owner in a tamper-resistant security bag, then deposited in a high security container where it is inaccessible to both retail employees and pedestrian traffic until finally destroyed by a Shred Vault® approved, NAID AAA Certified service provider. Equally important, the entire process provides a fully documented audit trail and all destroyed materials are recycled.

For more information, visit Shred Vault® online.

Related: The Secure Destruction Audit Trail Imperative

2023 Shred Vault, LLC  – All Rights Reserved.

This content may not be reproduced, linked or distributed, in whole or in part, without the expressed written permission of Shred Vault, LLC.