Old computers and mobile phones that people have thrown away to be re-used or recycled are often not thought of again by their owners, but in fact they still may have very sensitive personal data on them that can often be worth a lot more to criminals than the recyclable materials contained in the device. On Thursday, the European Data Protection Supervisor, Peter Hustinx, warned that the European Commission’s current proposal to recast an old directive on e-waste – the WEEE directive, for ‘waste electrical and electronic equipment’ – was focussing only on the environmental considerations of junking old equipment, and had entirely forgotten about the threat to data left on laptops and PCs by their original owners.

The commission’s proposal and the existing directive “focus solely on the environmental risks related to the disposal of e-waste,” said Mr Hustinx. “It does not take into account other additional risks to individuals or organisations that may arise from the operations of disposal, reuse or recycling of e-wast, in particular those related to the likelihood of improper acquisition, disclosure or dissemination of personal data.”

The supervisor went on to say that the amount of data storeable on such devices has accelerated rapidly in recent years, and so the threat of loss of such data at the point of recycling or re-using had also accelerated, reports LETA, referring to EUObserver.

“This may present a risk, greater than in the past, that those collecting the WEEE or selling and purchasing the used or recycled devices might become aware of any personal data stored within. Such data can often be sensitive or refer to large numbers of individuals,” Hustinx said.

The supervisor added that it was “urgent” that both stakeholders and the EU legislative process take into account this back-end risk to data privacy.

“[At] the final stage of the [electronic goods] life-cycle … while economically less valuable, they are likely to contain a large amount of personal data and therefore likely to have a high intrinsicvalue.”

“It would therefore be inconsistent to introduce the duty to put in place (sometimes costly) security measures in the ordinary course of processing operations of personal data and then simply omit to consider the introduction of adequate safeguards regarding the disposal of the e-waste,” the expert noted.

Hard drives can easily be salvaged and then sold on to organized criminals who then access the data held on the drives, the personal files left on the computers by the original owners, from information on their sex lives to credit card numbers, and account information.

“In view of such risks, the supervisor emphasises the importance of adopting appropriate security measures at every stage of the processing of personal data, including during the phase of disposal of devices,” the EU data protestion specialist pointed out.

via Data left on old computers is a boon for scam artists :: The Baltic Course | Baltic States news & analytics.

Related articles by Zemanta

• BAN to Certify and Audit E-Waste Recycling (nytimes.com)
• Businesses to use certified recyclers for e-waste (seattletimes.nwsource.com)
• EnviroCom opens UK’s largest eWaste recycling plant (businessgreen.com)