Data protection in VAR hands

Resellers and distributors that recycle obsolete hardware could be responsible for ensuring that sensitive corporate data does not end up in the wrong hands.

Under the Waste Electrical and Electronic Equipment (WEEE) Directive, which comes into effect this summer, companies have to recycle more of their computer hardware and will look to the channel for help.

Although the responsibility always falls on the original company to destroy data under the Data Protection Act 2000 (DPA), according to the Information Commissioner, clients may look to insert clauses in contracts with VARs that may obligate the reseller to wipe the data. If the reseller fails to do this, it could be liable.

"Should a reseller fail to do this, it could potentially be sued by the company and any third party that may have suffered loss," said Shelagh Gaskill, partner of information law at solicitor Mason.

Jon Godfrey, managing director of recycling company Life Cycle Services, predicted that the WEEE Directive will see many companies expecting the channel to take over responsibility for wiping data.

"Channel firms are touching residual data more and more. Their customers expect end-of-life equipment to be managed at the same time as the new replacement units are supplied," he said.

Clive Longbottom, service director at analyst Quocirca, said the DPA is a minefield, so even careful resellers may be affected.

"A reseller may take what it thinks are reasonable precautions, but won't know because the DPA is a complete and utter mess," he said.

"The government has to take a lead on educating companies and teaching them the right tools to use. But until a precedent is set, it may be that smashing the hard drive with a hammer is the only way to comply."

dinah_greek@vnu.co.uk