GLBA data disposal

The short version

There is a deadline. The Safeguards Rule requires secure disposal of customer information no later than two years after you last used it for that customer — with named exceptions.

And the FTC tells you how to check a disposal vendor. The Disposal Rule lists due diligence measures by name. Most buyers have never read that list. It is the most useful paragraph on this page.

The two-year clock

16 CFR 314.4(c)(6), from the FTC Safeguards Rule:

"(i) Develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates, unless such information is necessary for business operations or for other legitimate business purposes, is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained; and (ii) Periodically review your data retention policy to minimize the unnecessary retention of data."

Three things worth pulling out:

The clock starts at last use, not at account closure. Those are frequently years apart.

"In any format" includes the device. Customer information on a retired laptop is customer information. The two-year obligation does not care that the data is inconvenient to reach.

The exceptions are real but they are not a shrug. "Necessary for business operations", "required to be retained by law", and "targeted disposal is not reasonably feasible due to the manner in which the information is maintained" are defensible positions — if you have decided them and written them down. The periodic-review requirement in (ii) exists precisely to stop the exception becoming the default.

The other rule, and the paragraph worth printing out

The Disposal Rule at 16 CFR Part 682 comes from FCRA and covers consumer information. Its standard, 682.3(a):

"Any person who maintains or otherwise possesses consumer information for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal."

Then it gives examples — explicitly "illustrative only and … not exclusive or exhaustive." Two concern method:

"(1) … policies and procedures that require the burning, pulverizing, or shredding of papers … so that the information cannot practicably be read or reconstructed. (2) … policies and procedures that require the destruction or erasure of electronic media … so that the information cannot practicably be read or reconstructed."

And then 682.3(b)(3), which is about choosing a vendor:

"After due diligence, entering into and monitoring compliance with a contract with another party engaged in the business of record destruction … In this context, due diligence could include reviewing an independent audit of the disposal company's operations and/or its compliance with this rule, obtaining information about the disposal company from several references or other reliable sources, requiring that the disposal company be certified by a recognized trade association or similar third party, reviewing and evaluating the disposal company's information security policies or procedures, or taking other appropriate measures to determine the competency and integrity of the potential disposal company."

That is a regulator telling you, in a rule, what to demand of a vendor. Read it as a checklist:

• an independent audit of their operations
• references from several sources
• certification by a recognised third party
• their information security policies, reviewed and evaluated
• and "other appropriate measures to determine the competency and integrity" of the company

Note the word "could." These are examples, not a mandatory list — so a vendor who fails one is not automatically disqualified. But a vendor who cannot help you work through them is telling you something.

And note that it says "monitoring compliance with a contract," not "obtaining a certificate." The obligation continues after signature.

Applying that list to us, since it would be cowardly not to

Independent audit of our operations: none exists. We are a new company.

Certification by a recognised third party: we hold none. Not NAID, not R2, not e-Stewards. There is no directory entry to check. How to verify anyone's certification claim sets out how to check the vendors who do hold one.

Information security policies: we will give you ours, and you should read them rather than take a summary.

References: ask. If we do not have ones relevant to your situation, we will say so rather than supplying a name that does not answer your question.

Competency and integrity: your call, on the evidence. What we would say is that the honest boundary below is itself evidence of how we answer questions.

If that reads as a poor showing against the FTC's list, that is the correct reading for a new company, and we would rather you weighed it now than discovered it during an examination.

Where we fit, and where we don't

We erase media in our own facility, to NIST SP 800-88 Revision 2, so on your project we are the party performing the disposal that 682.3(b)(1) and (2) describe. We hold no certification — not NAID, not R2, not e-Stewards — and our R2 certification audit is pending. 314.4(c)(6) is your obligation, not ours, and choosing us does not discharge it.

We produce the custody record and the disposal record. We count devices against your list at your site, record discrepancies as they arise, seal what leaves, hand you a signed manifest with seal numbers, and issue a certificate of sanitization per media item once the work is validated.

For GLBA those do two different jobs. If you are "monitoring compliance with a contract" as 682.3(b)(3) puts it, the manifest is how you know what was handed over and the certificate is how you know what was done to it. What to require on that certificate.

How collection and custody works ·

Common questions

Does GLBA require a certified destruction vendor?

No. 682.3(b)(3) lists third-party certification as one example of due diligence a firm "could" undertake, among several. It is not a mandate. Your own policy may impose one, which is a different question.

Is there a GLBA certification for vendors?

No. The FTC certifies nobody. A vendor advertising itself as "GLBA certified" is describing something that does not exist.

Does the two-year clock apply to backups?

"In any format" is broad, and the "not reasonably feasible due to the manner in which the information is maintained" exception exists partly for cases like this. Whether it covers your backups is a determination for your Qualified Individual and counsel.

We are not a bank. Does this apply to us?

The Safeguards Rule reaches non-bank financial institutions, which is a wider category than most firms assume — and the Disposal Rule reaches anyone who maintains consumer information for a business purpose. Check scope before you conclude you are outside it.

What if a device is broken and cannot be erased?

Then erasure is not available and destruction is the remaining path in 682.3(b)(2). That decision is worth making at collection, when the device is in front of somebody, rather than later.

Where to read it yourself

16 CFR Part 314 — Safeguards Rule · 16 CFR Part 682 — Disposal Rule · FTC guidance for businesses