Data Destruction

Our class readings this week included an article that considered whether web sites that provide mugshots from local arrest records are an ethical way for newspapers to raise money to support traditional reporting (Grabowski and Yeng in Heider and Massanal, 2012).  One of the issues raised by the article was the question of the persistence of the records. Specifically, does the publisher of the mug shot web site have the responsibility, to the community at large and to the owners of the mugs, to update these records with follow-up information on the arrest? Were the charges dropped? Was there a conviction?  Was it a wrongful arrest?, etc.

Fingerprint
By Metrónomo (Own work) [CC BY-SA 4.0-3.0-2.5-2.0-1.0
(http://creativecommons.org/licenses/
by-sa/4.0-3.0-2.5-2.0-1.0)], via Wikimedia Commons

In another article this week (brought to my attention by Cathy’s Diigo post) I read about the extra-serious scenario where the holder of personal data (like an employer) suffers a data breach and what is lost are not passwords and credit card numbers, but VERY personal, permanently connected data like fingerprints or iris scans (Jaeger, 2015). For me, this was an eye opener. I’ve never thought of my credit card number as an integral part of myself or my identity.  Mine has been stolen multiple times. You change it and move on. But my fingerprints? Theft of data about my fingerprints would have very practical, very permanent and probably very psychological implications. 

Together these two articles made me wonder about what practices and policies surround the destruction of our personal data after it is collected, coded and used to identify us. We all know that our personal data can have a life of its own after it has been published, shared or reposted. And in these cases data destruction is not within our grasp. But what about what we don’t choose to share? What about information that is collected from us?

Protecting companies’ data is the focus of many of the data destruction services offered online and that is certainly an important link in the chain of my data’s life cycle. If businesses are clearing my old data carefully from their databases and hard drives, that protects me as well as them. But, as an individual, do I really have to monitor the dispersion of my information personally? Am I responsible for monitoring the reliability of every company that holds a password file for me or has my thumbprint?

As I looked for some reassurance in the form of guidelines for data destruction policies I was led to several “best practices” recommendations, but no actual policies. The U.S. Department of Education’s Privacy Technical Assistance Center (PTAC) has a detailed guidelines document that distinguishes among various levels of information sensitivity and recognizes the difficulty of identifying specific destruction techniques in an evolving, cloud-based, multi-backup system (PTAC 2014). The document focuses on the responsibility that schools have for caring for students’ personally identifiable information (PII) and includes recommendations for data destruction specifically as part of the lifecycle of collected data. There are also efforts by the U.S. Department of Commerce’s National Institute of Standards and Technology to set standards for the collection of PII (McCallister, Grance & Kent, 2010). This document recommends the use of strict standards of necessity in the collection of data, but offers less specific information about getting rid of collected data once it is no longer needed.

Heider, Don & Massanaal, Adreienne, L. (Eds.). (2012). Digital Ethics Research & Practice. New York, NY: Peter Lang Publishing Inc.

Jaeger, J. (2015). Managing Data Security and Privacy Risks 2.0. Compliance Week, 12(136), 56-59. 

McCallister, E., Grance, T., & Kent, K. (2010). Guide to protecting the confidentiality of Personally Identifiable Information (PII) [electronic resource] : recommendations of the National Institute of Standards and Technology / Erika McCallister, Tim Grance, Karen Scarfone. Gaithersburg, MD : U.S. Dept. of Commerce, National Institute of Standards and Technology, [2010].

Privacy Technical Assistance Center, U.S. Department of Education, Best Practices for Data Destruction. (2014). Retrieved from: http://ptac.ed.gov/sites/default/files/Best%20Practices%20for%20Data%20Destruction%20%282014-05-06%29%20%5BFinal%5D.pdf