Disposing of stored customer data: The wrong way

In one of the earliest examples of how not to dispose of such data, in April 2007, Texas Attorney General Greg Abbott filed a suit against CVS Pharmacy for failing to protect sensitive customer data. According to the suit, CVS in Liberty, Texas, exposed hundreds of its customers to identity theft because they had disposed of bulk customer records by tossing them in a dumpster behind the store.

Contained in the records were customers’ names, addresses, dates of birth, and prescription information. Additionally, credit and debit card numbers, along with expiration dates were also found. The lawsuit charged CVS with violating Chapter 35 of the Business and Commerce Code, which is a law passed in 2005 requiring businesses to protect sensitive customer data and provides for a fine of up to $500 for each compromised record (Staff, 2007).

For more information on notable data breaches since 2007 please see the table available in the downloads section below.

Data disposal legislation

Currently, at least 35 states and Puerto Rico have enacted laws that require either private or governmental entities or both to destroy, dispose of, or otherwise make personal information unreadable or undecipherable. The Federal Trade Commission’s Disposal Rule, which can be accessed through the National Conference of State Legislators (NCSL) website, also requires proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.”

In this course, we also explore several safe methods for data disposal depending on the type of data that needs to be destroyed.