When paper or electronic records have reached the end of their retention period, how do you appropriately destroy them?  Below is a summary of common records destruction methods.

Paper Records

Confidential Information

• Shredding: Paper is cut into thin vertical strips (straight-cut shredding) or into vertical and horizontal confetti-like pieces (cross-cut shredding). Most non-confidential records can be straight-cut shredded. Cross-cut shredding is more appropriate for sensitive and confidential records.
• Pulping: Paper is reduced to fibers (pulp) by being mixed with water and chemicals. The pulp can then, in many cases, be recycled into other paper products.
• Pulverizing: Paper is reduced to small, fine particles (such as powder or dust) by methods of crushing, grinding, etc.
• Incineration: Paper is burned to ensure complete destruction and non-retrievability of data. While effective, it is not considered the most environmentally-friendly option.

Non-confidential Information

• Recycling: Suitable for non-confidential records where possible. Paper is reused or reconstituted as other paper products. This method promotes good conservation of paper resources.
• Discard/disposal/landfill: Documents are tossed into a garbage container or dumpster, or are buried in a landfill. These methods are generally not recommended as suitable for effective record disposal.

Electronic Records

Confidential Information

• Physical Destruction: Includes crushing, incinerating, shredding, pulverizing, etc. The storage device is completely destroyed. This is an option for both hard drives and removable electronic media devices.
• Overwriting: Existing data is overwritten with other (often randomized or nonsensical) data or files, making the original data unreadable and/or irretrievable.
• Degaussing (or demagnetizing): Magnetic media is exposed to a strong magnetic field, which scrambles the data and effectively erases it.

Non-Confidential Information

• Erasure: Deleting data (such as hitting the “Delete” key). This should only be considered for non-confidential data, as “deleted” data can often be retrieved with the requisite know-how or special software.
• Discard/disposal: Electronic storage devices are thrown away. This method should only be considered for non-confidential data, and is generally not recommended as a suitable method of record disposal.

Proper records destruction helps protect confidential information and lowers the risk of privacy or security breaches, which can result in significant financial and legal consequences. Depending on the records being disposed of and the industry involved, you should be aware of and follow industry practices and any legal or regulatory destruction/disposal requirements involving such records.

* Note: If you outsource the destruction of your records to a third-party, be sure to obtain and keep any necessary certificate(s) of destruction from the service provider to show compliance with proper legal and industry standards.

 

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

Records managers often overlook laws that regulate record formats. Most companies store the bulk of their records electronically—or they’re moving in that direction. This makes it important to consider legal requirements about records formats.

Permissive Format Regulations

The good news is that most format regulations allow for electronic recordkeeping if you meet certain conditions. In the US, the Uniform Electronic Transactions Act, which is in effect in 47 states, is a good example of standard language found in many domestic and international permissive format requirements. The main components usually include 1) accurate and trustworthy information and 2) accessibility.

Accurate and Trustworthy Information

The electronic version must accurately reflect the finalized version of the record. This condition recognizes that it’s easy to alter and override many formats of electronic records. It also recognizes that original versions of electronic records don’t exist in the same context as paper records.

A crucial element for accuracy is information integrity, which includes ensuring that the record has not been altered. While evidentiary rules can also apply, we’ll only include a couple of general factors that impact accuracy:

• Authenticity: Someone with knowledge of the records that can authenticate the integrity of the information.
• Security: Security measures in place to protect the information from tempering.

 

Accessibility

The records must remain accessible. This condition recognizes that technology becomes obsolete and data can become corrupt over time. However, information must remain accessible throughout its required retention. A few steps to help meet this requirement include:

• Migrating records from legacy systems into new systems so they are readable.
• Using a format that can be reproduced into hard copy within a reasonable time.
• Backing up electronic records to prevent loss through degradation.

 

While many of the permissive format regulations use slightly different terminology and include other information, such as exceptions for contractual arrangements, specific evidentiary situations, and more, this provides a summary of the overall requirements for many of these regulations.

Mandatory Format Regulations

Mandatory format regulations require that a record be kept in a particular format. While rare, in many jurisdictions and industries, these regulations impact common records. Identifying and properly interpreting and applying these types of requirements is crucial to ensure compliance with the law. A few examples of mandatory format requirements include:

• China’s Implementation of the Methods for Management of Invoices Notice requires that invoices be kept in stub form.
• In the United States, 17 CFR 240.17a-4 requires that Members of National Securities Exchanges, Brokers, or Dealers must retain certain records related to their securities activities in micrographic or electronic storage media exclusively in a non-rewriteable, non-erasable format.
• Switzerland’s Code of Obligations requires that annual reports and audit reports be retained in a written form and signed.

 

Unfortunately, finding these requirements can be a bit like finding a needle in a haystack. Unlike the permissive requirements, which often have their own dedicated law, mandatory format regulations are usually found buried in the text of laws alongside requirements to retain records. Identifying them requires extensive research.

Zasio’s Versatile Retention software can help to make this process easier. Our Research Team of lawyers and paralegals conduct research and categorize relevant format requirements so they can easily be searched, reviewed, and applied. In addition, our Consulting Team offers customized reports detailing format requirements and how they impact our clients.