Proper Destruction of Records

When paper or electronic records have reached the end of their retention period, how do you appropriately destroy them?  Below is a summary of common records destruction methods.

Paper Records

Confidential Information

• Shredding: Paper is cut into thin vertical strips (straight-cut shredding) or into vertical and horizontal confetti-like pieces (cross-cut shredding). Most non-confidential records can be straight-cut shredded. Cross-cut shredding is more appropriate for sensitive and confidential records.
• Pulping: Paper is reduced to fibers (pulp) by being mixed with water and chemicals. The pulp can then, in many cases, be recycled into other paper products.
• Pulverizing: Paper is reduced to small, fine particles (such as powder or dust) by methods of crushing, grinding, etc.
• Incineration: Paper is burned to ensure complete destruction and non-retrievability of data. While effective, it is not considered the most environmentally-friendly option.

Non-confidential Information

• Recycling: Suitable for non-confidential records where possible. Paper is reused or reconstituted as other paper products. This method promotes good conservation of paper resources.
• Discard/disposal/landfill: Documents are tossed into a garbage container or dumpster, or are buried in a landfill. These methods are generally not recommended as suitable for effective record disposal.

Electronic Records

Confidential Information

• Physical Destruction: Includes crushing, incinerating, shredding, pulverizing, etc. The storage device is completely destroyed. This is an option for both hard drives and removable electronic media devices.
• Overwriting: Existing data is overwritten with other (often randomized or nonsensical) data or files, making the original data unreadable and/or irretrievable.
• Degaussing (or demagnetizing): Magnetic media is exposed to a strong magnetic field, which scrambles the data and effectively erases it.

Non-Confidential Information

• Erasure: Deleting data (such as hitting the “Delete” key). This should only be considered for non-confidential data, as “deleted” data can often be retrieved with the requisite know-how or special software.
• Discard/disposal: Electronic storage devices are thrown away. This method should only be considered for non-confidential data, and is generally not recommended as a suitable method of record disposal.

Proper records destruction helps protect confidential information and lowers the risk of privacy or security breaches, which can result in significant financial and legal consequences. Depending on the records being disposed of and the industry involved, you should be aware of and follow industry practices and any legal or regulatory destruction/disposal requirements involving such records.

* Note: If you outsource the destruction of your records to a third-party, be sure to obtain and keep any necessary certificate(s) of destruction from the service provider to show compliance with proper legal and industry standards.

 

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.