Staples and Jill Vickers and the hard drive - why is Staples being singled out?
Recently in the news there have been stories about how a Staples Business Depot in Ottawa sold a returned hard drive containing hundreds of personal files on it. See the original article here, and here.
No doubt Staples should have some procedure in place to ensure that returned equipment is in “like new” condition when it’s resold. And in this case - meaning free of any data.
But I fail to see why Staples is being singled out here. Everyone - including individuals and companies - is responsible for protecting personal information under Canadian privacy legislation. And that includes Professor Jill Vickers and her son. The law doesn’t differentiate between companies and regular people. Prof. Vickers and her son had a responsibility to ensure that the data was wiped clean - completely clean - from the hard disk prior to returning it to Staples. That’s the law. Simply deleting the files is not sufficient. And that’s assuming they were in fact deleted.
Here’s how most responsible companies deal with hard drives: They’re destroyed. Not returned to the manufacturer. Simply destroyed. Taken apart by IT staff and the platters smashed. At the very least, the drive is completely wiped clean with specialized software.
It’s not rocket science, people. I own a data processing company, and we’ve had our share of flaky hard drives. Never once have we returned one. Under warranty or not, if they’re pulled from service, they’re physically destroyed. It’s the cost of doing business when you deal with confidential information.