Interview with Leslie molin

September 2007

Interviewee: Leslie Molin, Marketing Manager, Cintas

Subject: Large-Scale Document Destruction

Nymity: Why is improper document destruction the cause of many privacy breaches?

Molin:  Privacy breaches occur when confidential information gets into the wrong hands. It can easily start with what employees are placing in their personal waste baskets on a daily basis.

Document destruction appears to be a very industry specific process. Some industries, particularly healthcare have legislation and guidelines to follow; others need to adopt a procedure on document destruction as part of the overall privacy policy.

Unless there is a proper policy in place, employees may not know how long they need to keep certain documentation. They may not be aware of what type of employee or customer information needs to be properly protected particularly at the time of disposal.

With policies lacking, companies will tend to shred document in-house or use a recycling company.

Both of these alternatives do not conform to industry best practices suggested by NAID, the National Association of Information Destruction. Additionally they will not provide a proof of destruction certificate which is standard protocol for certified service providers.

Nymity: What steps are required to implement an effective document destruction program?

Molin:

1. Make document destruction a key part of your overall privacy policy. Assign a privacy champion. Set up a committee, gather information upfront from each department in terms of what types of documents need to be destroyed and the frequency of the destruction.
2. Set clear and concise guidelines. The company should adopt an integrated retention policy. When documents go beyond their useful life they are destroyed at specific times by a certified provider.
3. Execution. Once a company has guidelines in place in terms of what needs to be destroyed and the frequency of destruction, a certified service provider should then be brought in to handle the destruction of the documents. This will enable the company to establish a chain of custody and proof of destruction at the end of the process.
4. Training. This by far is the most critical step in the document destruction program. The first three steps can be meticulously thought out however, if training is not properly handled the program will fail. Management needs to follow up and periodically check what is going into waste baskets and determine if the documents should be redirected to the secure shredding console.

Nymity: Why is employee training the most challenging step and what are some best-practices?

Molin:  Successful implementation of the program needs to come from the top down. Upper management need to be able to set the standards and ensure that they are followed. Some best practices include:

• Set expectations early in the process. Make sure the employees understand that under Canada’s privacy legislation companies now have a duty to protect personal information of their customers as well as their employees.
• Write down by department what are the mandatory items that need to be destroyed. Keep this document on a company intranet for easy access for all employees and ensure it is reviewed and updated on a regular basis.
• Implement a shred all policy – even the blue bin at the end of the day is emptied into the shredding console – all will be recycled.
• Periodically review training, ensure that new employees are trained as part of the welcome to the company introduction on policies and procedures.

Nymity: What options are available to organization in regards to data destruction?

Molin:  Four options are available, onsite, off-site, one-time purges and in-house shredders:

• With an onsite service, a service provider’s vehicle will come to your place of business, on a scheduled date and time, retrieve the documents from strategically placed secure document consoles and take them to the truck to be shredded on-site. After the job is completed you will receive a document stating that the documents have been destroyed.
• Off-site is similar to on-site, the provider will pick up the documents and deposit them into a secure vehicle. Back at the plant the vehicle will unload the documents to be shredded. Plant based systems have high security to ensure only authorized personnel are on premises.
• Purges – If documents have not previously followed an integrated retention policy, companies find themselves with a substantial amount that will need to be destroyed all at once, for these larger clean up jobs they might do a purge. Purges can be scheduled as needed with a service provider.
• The least recommended option due to the high risk associated with identity theft and security breach is in-house personal shredders. Not only does this method cost the company hours of lost time and productivity, it also carries the additional risk of not knowing what has been shredded and what has simply been thrown in waste paper baskets which may leave the company open to liability.

Nymity: What are the key considerations when outsourcing document destruction?

Molin:  The key consideration when outsourcing would first and foremost be to use an AAA NAID certified service. NAID is the industry organization that monitors and certifies companies and ensure key guidelines are followed including that all service providers carry liability protection insurance.

Additionally consider the frequency of service that will meet your business needs.

Nymity: What are the advantages of onsite destruction? Disadvantages?

Molin:  The top advantage of onsite destruction is that you have the assurance that your documents are destroyed before leaving your property. Many service vehicles today are equipped with a camera to supervise and verify the shredding process. After the destruction is completed you will receive the certificate of destruction. On-site is a very quick and efficient way to destroy confidential documentation. In term of disadvantages, if there are facility and or parking space constraints, a plant based or off-site service may be a better alternative.

Nymity: What are the top overlooked items to be shredded?

Molin:  Some of the top overlooked items that are important to shred include:

• Cancelled cheques
• Basic invoices, internal memos and emails that might have confidential information
• R & D information and market research.
• CD and DVD’s
• Annual reports and business literature.
• Old marketing materials and outdated price lists.
• Personnel files past their useful life.

Nymity: What is Cintas’ approach to document destruction?

Molin: We are an AAA NAID certified supplier with the utmost focus on insuring that we hire the best people and deliver the highest quality service. All employees have security clearance and are bonded. Our vehicles are automated providing the most secure and hands free service available, eliminating the human contact with confidential material at the point of destruction.

Cintas’s shredding service performs both onsite and offsite document destruction, providing our clients flexible options to destroy sensitive information. Our program starts with an initial information security assessment and strategic placement of security containers. We will then determine based on customer needs the frequency of pickup and destruction. Our service offers a complete chain of custody from pickup to disposal – we recycle the paper we shred and deliver it to a recycling centre to be turned into future products. Our ultimate goal is to keep our customers compliant and reduce their corporate risk.

For More Information

To learn more about Cintas visit www.cintas.ca

Leslie Molin

molinl@cintas.com

905.565.4841