In August, news spread across portals worldwide that in one of the African countries, one could buy all the data concerning the proverbial Mr. Smith, a client of a respected bank in Great Britain, for just a few dollars. This is no joke, but a lack of data deletion procedures. As you can see, the problem does not necessarily have to concern small companies or individual computer users. And will you, dear reader, be able to buy back your data from a used computer dealer while on vacation, for example, in Egypt?
Such a scenario is not excluded. Wherever personal data is managed, such a possibility exists. This applies primarily to public trust institutions, such as banks or insurance companies, as well as government offices. The obligation to delete data is regulated by the Personal Data Protection Act of August 29, 1997, which states: Devices, disks, or other electronic information carriers containing personal data intended for:
1) liquidation – must be stripped of these data records beforehand, and in cases where this is not possible, damaged in a way that makes them impossible to read;
2) transfer to an entity not authorized to process data – must be stripped of these data records beforehand in a way that makes them impossible to recover.
Contrary to appearances, the source of the problems is not a lack of access to advanced technologies, but ignorance regarding the elementary principles of data deletion. The problem, to a greater or lesser extent, concerns almost all types of organizations and institutions. One
of the most banal and at the same time dangerous ways for all of us for important data to leak is the inability to delete it and, unfortunately, thoughtlessness.
I got a new computer!
An employee or official receiving a new computer and the lack of data deletion procedures is almost a guarantee that our data can get out. What happens to the old computer? There are two possibilities. Our machine passes into the hands of a colleague
or is sold to a second-hand shop, or possibly given to a scrapyard. In the case of getting rid of a computer from a company, the most commonly
used method of deleting data (ineffective, of course) is formatting. After this operation, all data is available to an amateur data recovery specialist who can use a good and widely available data recovery program, such as Easy-
Recovery.
The article comes from the magazine “e-Fakty” 5/2006.