Data destruction is a legal obligation your business is responsible for managing appropriately. Legislation like PIPEDA requires your organization keep sensitive and private information of your clients, employees and partners from falling into the wrong hands. “Personal information that is no longer required to fulfill the identified purposes should be destroyed, erased, or made anonymous.” (PIPEDA, Principle 5.)
Business data has a life-cycle that needs to be managed from its initial creation and storage to when it is obsolete and can be destroyed or deleted. With increasing compliance regulations that vary from industry to industry your approach to data destruction should be as thorough as your approach to data preservation.
The Chief, Communications Security Establishment (CSEC) has issued guidelines intended to assist Government of Canada IT authorities in selection suitable methods to prepare storage devices for reuse or disposal. Small to medium sized businesses that don’t have industry regulated guidelines to adhere to can refer to the guidelines approved by the RCMP and followed by federal departments and agencies to ensure best practices are followed.
Data Clearing Methods
Blocking, erasing, clearing, sanitizing or wiping data are all varying degrees of removing data from your storage device in a manner that prevents data recovery, but ensures the hard drive remains usable.
There are several software erasers available for use (many of which are free to download). However, this can be a time intensive process and files may still be recovered through file recovery software. Encryption of the entire media (particularly for solid state or mechanical drives) or overwriting may better remove any existing intelligence.
A process called Triple Overwrite can be leveraged to meet overwrite criteria. Triple overwrite is a process involving three passes of the overwrite software: the first pass must write all 1’s or all 0’s to the media, the second pass must write the complement (or opposite) of the first pass, and the third pass must be a pseudo-random pattern that the human operator can read back to verify results.
It’s important to note, that triple overwrite is not a suitable method as a standalone destruction method on classified, higher than confidential level material. Issues may arise and unsuccessful overwriting may occur due to human error and/or the inability of software to overwrite bad sectors. Therefore using overwriting as the sole method for clearing highly secure information is not recommended.
While wiping data allows you to reuse the drives by creating more space, Data Destruction may be the best way to ensure your data is completely removed.
Physical Destruction
Hard drives stores data on its platter, the platter is centered on a spindle and an electric (or magnetic) current is used to read and write the data. The only sure way to make certain that the data is unrecoverable is by ensuring the drive’s platters are unspinnable.
There are several “do-it-yourself” approaches to physical destroying drives. Physically drilling, hammering the drive, setting on fire, microwaving the drive and opening the casing to manually scratch the platters are common suggestions found on the internet. But business owners who must adhere to compliance regulations are sure to want a more reliable way to ensure physical destruction.
Local data shredding, data management or data destruction services specialize in hard drive and media destruction. On-site or off-site destruction can be scheduled depending on the restrictions your business must abide by. Outsourcing to a vendor that specializes in data destruction may be the best option for data that contains highly sensitive information.
Most reputable vendors will be able to issue your organization a certificate of destruction, which outlines serial numbers of units destroyed. Their reports can also include data wipe certificates for inventory purposes, or donation certificates; any of which should satisfy your company’s audit requirements.
Degaussing can also be used as an effective method to destroying data held on magnetic storage devices. If used properly, degaussers will destroy all data stored on magnetic disks (or tapes) and damage the internal hard disk mechanisms beyond repair. Degaussing can be useful in erasing magnetic tapes, hard disks and other magnetic media. Of course, degausser products must be properly maintained and operated to be completely effective.
Things to Consider
Data preservation, protection and destruction have become an integral part of the data management life cycle. Whether choosing the do-it-yourself approach or outsourcing physical destruction to a third party vendor, your organization will still be bound to and responsible for adhering to PIPEDA privacy compliance. With PIPEDA violation fines reaching upwards of $100,000, being able to verify data destruction was handled in accordance to regulation will be worth investing in proper disposal upfront.