More businesses budget for file shredding and removal by outside contractors
Individuals are having increasing difficulty keeping personal information private, as witnessed by continual reports of the damaging effects of identity theft. Businesses are targets as well, particularly those compiling large amounts of customers’ personal information.
The theft of a businesses’ identity can be damaging, but allowing clients’ information to be leaked can result in lost business and tarnished reputations.
As of June 2005, businesses of all sizes are required to destroy documents and consumer reports containing personal information of employees and customers to reduce the risk of consumer fraud and identity theft.
The “Disposal Rule,” enforced by the Federal Trade Commission, requires the proper disposal of documents to protect against “unauthorized access to or use of the information.” The rule suggests burning, pulverizing or shredding the papers, or contracting with an outside agency for record destruction. Those covered by the rule must determine the most appropriate and secure destruction of the documents “based on the sensitivity of the information, the costs and benefits of different disposal methods and changes in technology.”
Noncompliance could result in government enforcement and suits from victims, including class actions, for actual damages and statutory damages of up to $1,000 per violation.
Many local companies have had policies in place for some time.
Financial institutions can be a source of information before they become a source for cash for identity thieves. Banks are held to high standards by the government and within their own industry when it comes to protecting privacy. Dan Clark, vice president and branch manager of Banner Bank’s 164th Ave. location, said the bank has a strict privacy policy that goes beyond federal requirements, including document destruction.
Clark said 90 percent of the bank’s garbage is required to be recycled. Banner Bank pays a service to manage destruction of its documents.
The company provides Banner Bank with locked bins for secure collection of documents. In the bank’s case, standard wastepaper baskets at each employee’s desk and anywhere else in the office documents may be discarded are dedicated to documents requiring destruction. At the end of each day, one employee is responsible for collecting all the paper and securing it in the locked bin. Every other week, the document destruction company arrives and shreds the documents with high-powered onboard shredders on-site, a practice that is becoming industry standard, said Clark.
Awareness of the danger of fraud and identity theft ebbs and flows, he said, and having a document destruction policy can be a constant reminder.
“Once (identity thieves) have it, they can do quite a bit of damage,” said Clark.
Dick Templeman, director of operations for law firm Schwabe, Williamson and Wyatt, said the company tried at one time to manage document destruction in house. Turns out, papers that once stacked neatly take up a lot more room shredded.
The ability to free up valuable space is one of several reasons paper shredding has become a big business.
Matt Aller, general manager of Ohio-based Cintas Document Management’s Portland office, said the industry has doubled in the past five years. Cintas entered the Vancouver/Portland area at the first of the year when it acquired local company A M Document Destruction, which, until this month, operated an office in Vancouver. Cintas will now serve its Washington clients from the Portland office.
Several other national companies provide destruction services in this market, including Iron Mountain, Shred-It and Weyerhaeuser.
Aller said public awareness and legislation are driving demand for the company’s services.
“Awareness of identity theft is heightened,” said Aller. “And legislation puts the onus on businesses. Anytime that you put something into the garbage, it is fair game to sift through.”
Paper shredding has become more efficient and safer. Many firms become certified by the National Association of Information Destruction, ensuring background checks of employees and the proper handling of documents. And technology, including large-scale machinery and cameras, has improved security.
Once the collection container is no longer in the possession of the business, the liability is on the document destruction firm. Most clients prefer on-site shredding, but some companies have documents trucked or dropped off to be shredded at Cintas’ plant.
Clients receive a certificate of destruction once the job is complete.
Clients don’t have to choose between recycling and destroying, said Aller. Some have relied on recycling services as a form of destruction. The paper shredding industry warns recycling services do not ensure proper handling of sensitive documents.
Southwest Washington Medical Center is a Cintas client. Sandy O’Rourke, privacy officer and director of health information services for the hospital, said it has had shredding done on-site for two years. Prior to that, the documents were recycled and destroyed elsewhere.
“We feel shredding on-site is the securest and easiest to ensure everything is done correctly,” said O’Rourke.
Cintas visits the hospital three times each week and spends a full day destroying documents filling the more than 100 bins throughout the hospital. O’Rourke said hospital employees are required to destroy everything from messages to records that may contain patient, employee or proprietary information. Spot audits are performed, which means digging through the garbage, to ensure private information is not accessible to dumpster-diving thieves, she said.
Aside from keeping information private, the costs and resources it takes to manage the shredding makes employing a document destruction company necessary.
Schwabe uses Iron Mountain for off-site storage of documents it must retain and on-site shredding when the retention period has passed. Iron Mountain visits Schwabe’s office once each week. Templeman said destruction likely costs more than $10,000 annually.
“Cost is a perceived barrier,” said Cintas’ Aller. “Like any business service, you look at cost.”
Depending on the type of paper and volume, Aller estimates the average visit costs anywhere from $40 to $100. Aller said there are many prospective clients who don’t shred at all and those who do it themselves. He said the company will grow as more businesses find a need for destruction services.
