As organizations examine their alternatives to meet information destruction compliance requirements, they sometimes happen across firms that lead them to believe that paper recycling is adequate.  Vendors that represent paper recycling as providing the requisite security assure the client that all materials will end up at a paper mill and thereby will be destroyed.

 Since paper recycling is often more economical than acceptable secure disposal options, organizations with compliance requirements are naturally tempted to believe that it is sufficient to meet them.  That is a mistake!  Any organization that selects recycling as an alternative for secure information destruction should reconsider that process, the risks and their obligation.  They are putting protected client information and their organization’s reputation at risk.

Here are items to consider:

•  Most scrap paper companies do not screen employees or restrict employment of known criminals.
• Access to scrap paper facilities is generally not restricted.
• There is no documented or duly acknowledged acceptance of fiduciary responsibility between the organization and the scrap paper company, between the scrap paper company and their unscreened employees, or between the scrap paper company and the paper mill that accepts the unshredded documents.  These various acknowledgements are crucial to establish due diligence, a chain of custody, and ultimate liability.
• There is no documented or duly acknowledged acceptance of fiduciary responsibility between the scrap paper company and the transport companies that haul it to the paper mill.
• There is rarely, if ever, a documented or duly acknowledged acceptance of fiduciary responsibility between the paper mill and their employees.
• Bales often break at the paper mill.  If those materials become contaminated, the paper mill may discard the paper intact.
• Confidential information may be recorded on paper that is unacceptable to the paper mill.  In that case it is the recycling company’s responsibility to arrange for it to be unloaded elsewhere, usually at a nearby sorting operation.
• It is very important to be able to document the “who, what, where and when” of every destruction event.  Because paper mills keep baled wastepaper inventoried for long periods, it is impossible to say exactly when the record ceased to exist, or who oversaw the destruction.
• If any information is ever released, an auditor, regulators, courts and the media will look at the care given in selecting the process for destruction to determine culpability.  If it is determined that a less secure method is selected in favor of short term economic considerations, it reflects poorly on the regulated company.  Recycling will fail every test in that regard.
• It is not reasonable to believe that a scrap paper processor, which sells its paper through a broker, can effectively control the ultimate destination of the waste paper.  Any program that assumes they can, does not understand brokering procedures in the scrap paper industry.

These are some of the reasons that general recycling does not meet the test for reasonableness as established in the ever increasing number of regulations regarding information disposal.  For more information, please contact us!