10 Common Myths about Shredding
1) Not all businesses have to shred.
In an effort to protect consumers' privacy and combat identity theft a number of data protection laws have been passed. These laws require businesses to properly maintain personal information and then to properly destroy it. There are not only state laws that require proper destruction of personal information but also federal laws.
One such law is the Health Insurance Portability and Accountability Act (HIPAA) which applies to a patient's medical information. The law was dramatically expanded with the passage of the American Recovery and Reinvestment Act (popularly known as the Stimulus Package). HIPAA requires all patient information to be properly destroyed. Unless you have an incinerator then shredding is the only acceptable option.
The law affecting every business is the Fair and Accurate Credit Transaction Act (FACTA) and the recent addition of the Red Flag Rule issued by the FTC. Any business that collects, handles or facilitates credit must have a procedure to destroy personally identifiable information. This law is more strict than HIPAA and requires additional due diligence into the destruction methods.
2) No one will look through your trash.
There are many people who routinely go through a businesses trash. The first is the cleaning staff who handles each waste basket and may be tempted to take private information. Once in the dumpster your trash is now considered public property by the Supreme Court. People regularly go through dumpsters looking for recyclables or boxes. When they find personal information they usually report it to the police and local media. You end up on the five o-clock news answering some difficult questions. Some news organizations skip the middleman and just dig through dumpsters to see if they have an easy story. Worse yet, corporate spies or people looking to publicly damage a company will always start with the dumpsters.
3) It is better to have too many records.
Businesses are required by law to maintain a variety of records. These may be needed for a range of reasons beyond just taxes. However, there is also a risk of keeping records past their usefulness. Employee records from decades ago provide no value but if stolen can put people at risk for identity theft. This is also an easy place to steal information and it is unlikely the thief would ever get connected to the crime. Expired documents can also be used against a company in lawsuits. Every business should have an established retention policy that includes the shredding of expired documents.
4) It is cheaper to buy a shredder.
It might appear that purchasing a shredder is the cheapest option for shredding but not when the true costs are considered. An office shredder requires maintenance and replacement on a regular basis. But that is actually the cheap part. Since employees like to be paid their wages must be included. A box of documents will take hours on the standard shredder. In comparison, a service has monster shredders that do the work in minutes. This allows them to charge only a few dollars a box. And you never end up with a broken shredder.
5) Your employees will shred if they have a shredder.
Employees already have a pile of work that needs to get done. They are measured on how well they get their tasks completed. Since shredding is not monitored and measured it becomes a very low priority. It is often left to pile up; only to be dumped into the trash when the job gets too daunting. Shredders are also loud and the work is often put off to prevent disturbing co-workers or customers.
Employees might also fail to shred intentionally. This may be in an effort to take company secrets to their next job, protect their current position, or to use the information against the company. A high profile example was when an employee of PG&E kept internal papers he was assigned to shred and instead handed them over to Erin Brockovich.
6) The law requires you to witness the shredding.
HIPAA and FACTA require businesses to properly destroy personal information but there is no specific requirement that an employee witness the shredding. The business must perform their due diligence and hire a reputable firm. However, once this is done the shredding can be done at the business or at a secure shredding plant.
7) Having a shredder proves compliance with the law.
As we know not every employee is going to shred. So simply owning a shredder is not enough to prove compliance with privacy laws. The only way to protect a business is to maintain a record of shredding that is monitored and certified by a manager. The alternative is using a shredding service that will provide a certificate of destruction. This provides the proof that the shredding was done in accordance with the law.
8) Company secrets are automatically protected.
The Economic Espionage Act helps companies recover damages when corporate secrets are stolen. However, they can only be considered secrets if the company treated them as such. Anything that the company doesn't require to be shredded was not treated as a secret. An example is customer lists that are routinely thrown in the trash. They would no longer be considered proprietary. So if you want to protect your company's private information both physically and legally you must require it to be shredded by company policy.
9) Using a recycling service provides legal compliance.
While you don't have to witness the shredding it still must be done. A recycling service does not comply with this requirement. Paper is sorted by hand at the recycling plant before it is shipped to a paper mill. It is impossible to protect privacy after it is sorted by hand. A shredding service will recycle all the paper but only after it is shredded.
10) Shredded paper can't be recycled.
There is a big difference between what can be recycled and what the trash company will let you place in the recycling bin. Since shredded paper is bulky and creates a mess; most trash haulers don't want it in their recycling bins. Their requirements stem from transportation costs, not from the ability to recycle the material.
At one time there was the misconception that shredded paper had shorter fibers and was wanted by paper mills. This is simply not true. There are dozens of paper mills in the North America alone that recycle thousands of tons of shredded paper every day. These mills produce both tissue paper and office paper. Shredding services send their shredded paper to these mills by the truckload.
Bonus Myth - Shredders are safe.
Assuming that people are smart enough to keep their ties and fingers out of the shredder there are still potential problems with shredders. Most office shredders are very slow and require repetitive actions to feed them. Over time this may cause repetitive stress injuries. If your office does large amounts of shredding there is also the problem of dust. The problems compounds for medical offices that treat respiratory illnesses. If you are using a large shredder it should be put in a separate room and outfitted with its own air system to vent the dust outside of the building.