LEGAL COMPLIANCE:
• Georgia Law SB 475… Fines up to $10,000 for discarding
personal information without first shredding, erasing or modifying it
NAID Article on GA LawGA Enforcement Article Attorney General of Georgia remarks
• Health Information Portability And Accountability Act
(HIPAA) … Civil penalties up to $25,000 per person per year and criminal penalties up tp $250,000 and ten years in prison for failure to protect all medical records and other individually identifiable health information.
•
Gramm-Leach-Bliley Act (GLBA)… Civil penalties up to $1,000,000 for an individual and the lesser of $1,000,000 or 1% of the total assets of the financial institution for failure to insure the security
and confidentiality of consumer customer records and information provided to obtain a financial product or service, in addition to protecting against anticipated threats or unauthorized use.
•
Fair And Accurate Credit Transactions Act Of 2003, Section 216…
Effective June 1, 2005. All owners of consumer
information records will be required to “take reasonable
steps to select and retain a service provider that is capable of
properly disposing of the consumer information at issue; notify
the service provider that such information is consumer information;
and enter into a contract that requires the service provider to
dispose of such information in accordance with this rule”.
INDUSTRIAL ESPIONAGE… Dumpster diving for competitive information
is legal and is a more common practice than most realize. Stored records should be destroyed on a regular schedule…erratic
records disposal practices can be viewed with suspicion in the
event of litigation or audit.
RECYCLING IS NOT AN ADEQUATE ALTERNATIVE FOR INFORMATION DESTRUCTION…
Recycling companies use low wage, unscreened workers to sort intact (non-shredded) paper by
type, then store until there is a sufficient amount to bale. Intact paper can then
be sold to a paper mill for a higher price than shredded paper, leaving many opportunities and much time for documents to get
into the wrong hands
OFF-SITE SHREDDING CAN BE A RISKY ALTERNATIVE TO ON-SITE SHREDDING…
Accidents have happened in the transport of records to off-site shredding
facilities, exposing sensitive records to the public domain. Moreover,
off-site shredders can sell their paper to a recycler for a higher
price if they sell it intact rather than shredded.
MOST RECORD STORAGE FIRMS DO NOT HAVE SHREDDING EQUIPMENT…
Since the owner of records has ultimate responsibility for their security,
selection of a vendor for destruction of stored records should
be the owner’s prerogative.
|
