Data Destruction for Financial Institutions in California

Financial firms retire equipment on a steady cycle: teller and loan-officer workstations, branch servers, check scanners, ATMs, backup tapes, phones. Every one of those devices may hold account numbers, Social Security numbers, credit reports or loan files. Federal and California disposal rules put the burden on the institution to make that information unreadable before the equipment leaves its control, and to be able to show how.

Modern Waste Solutions has operated since 1999 from its Sacramento facility and provides hard drive wiping, shredding and IT equipment recycling for banks, credit unions and other financial businesses throughout California. This article covers the disposal rules that apply to financial institutions, the devices that hold customer data, how to choose between wiping and destruction, and the records that satisfy examiners and auditors.

Several overlapping rules apply, depending on the type of institution. All of them expect customer information to be made unreadable at disposal, and most expect you to supervise the vendor that does it.

The FACTA Disposal Rule describes vendor due diligence as reviewing audits, checking references, verifying certifications and evaluating the contractor's security policies. Examiners ask for the same evidence.

• Teller, platform and back-office workstations and laptops
• Branch and data center servers, storage arrays and backup tapes
• ATMs and interactive teller machines, which keep card and transaction data
• Check scanners, receipt printers and multifunction copiers with internal drives
• Phones, tablets and USB drives issued to staff
• Network equipment with saved configurations and credentials

Our financial institution IT asset disposal page lists the branch equipment we collect most often.

Your information security policy should decide, by data class and device type, and the vendor should follow it. A common split:

• Wipe to a NIST 800-88 method when equipment will be redeployed, resold or returned to a lessor, with a report listing each drive's serial number, method and verification result.
• Destroy drives that fail verification, are damaged, or came from systems your policy classifies as highest risk, such as core banking servers or backups.
• Shred backup tapes, optical discs and flash media, which are hard to verify after wiping.

Solid-state drives need a sanitize command or cryptographic erase; an overwrite may not reach every cell. Our NIST 800-88 data wiping service handles reuse cases, our hard drive destruction service shreds media with serial numbers captured first, and on-site hard drive shredding lets your security team watch the destruction at your branch or data center. Our guide to data destruction methods compares the options in more detail.

1. Write retention and disposal into the information security program, including the two-year disposal window under the Safeguards Rule where it applies.
2. Put the destruction vendor under a written contract that requires proper disposal and chain of custody.
3. Inventory data-bearing assets by serial number before they leave the branch or data center.
4. Keep retired devices in a locked area and release them only against that inventory.
5. Reconcile the vendor's erasure reports and certificates of destruction against your release list.
6. Keep the records with your vendor-management file and review the vendor periodically.

Branch closures and consolidations are when this breaks down most often, because equipment leaves in a hurry. Use the same method and record format at every site so results can be compared.

A branch cleanout usually turns up UPS batteries, office batteries, and fluorescent lamps and ballasts. All of them are regulated in California and can't go in the trash. We can collect them on the same visit through battery recycling and ballast disposal, so one pickup closes out the site.

Does GLBA require physical destruction of hard drives?

No specific method is mandated. The rules require customer information to be disposed of securely, and your policy decides whether a device is wiped to a verified standard or destroyed. Many institutions destroy their highest-risk media.

What records should a financial institution keep after data destruction?

A serial-level erasure report or certificate of destruction, a chain-of-custody record and a certificate of recycling, reconciled against the list of assets you released.

Do ATMs need data destruction before recycling?

Yes. ATMs and teller machines contain computers and storage that can hold card and transaction data. Their drives should be wiped or destroyed and recorded like any other device.

Can you destroy paper loan files and statements?

No. We destroy electronic media: hard drives, SSDs, tapes, discs, phones and other storage devices. Paper records need a document-shredding company.

Data destruction for financial institutions means making customer information unreadable on every retired device, following a written policy, and keeping serial-numbered proof. Choose a vendor you can supervise, reconcile their certificates against your inventory, and clear the branch's batteries and lamps at the same time. Request a quote for data destruction and IT asset disposal at your branches or data center.

• Federal Reserve: Interagency Guidelines Establishing Information Security Standards
• FTC: FTC Safeguards Rule: What Your Business Needs to Know
• 16 CFR 314.4: Elements of an information security program
• 16 CFR 682.3: Proper disposal of consumer information
• California Civil Code 1798.81: Disposal of customer records
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization