The risks in recycling compliance

Not all recycling and kit disposal strategies are created equal

Bird: Look deeper when organising disposal of used kit

Any equipment holding data must be adequately sanitised prior to being consigned to a third party for disposal. Failure to take reasonable steps to do this could result in significant penalties.

In-house data erasure at the point of decommissioning a PC also reduces the risk of data compromise while kit is awaiting collection.

Much data erasure freeware is available, but many fail to overwrite every partition of the disk, while others overwrite it a limited number of times.

Products endorsed by the Communications Engineering Security Group let organisations achieve full accountability.

One of the key principles of the WEEE directive is recovery or reuse. Yet many CPUs, power supplies, optical drives or RAM modules are removed at the point of disposal. Secondary IT markets are low value, and such cannibalisation inevitably renders equipment commercially unfit for reuse.

Authorised treatment facilities are subject to Environment Agency checks and must ensure recycling kit is comprehensively segregated and reduced in volume before being returned in constituent form to remanufacturers.

Many organisations looking to exploit this fast-developing market opportunity do not have full operating permits. For a few hundred pounds, any organisation can obtain a "paragraph 40" exemption and set up as an IT recycler. These organisations will simply collect and appraise goods before forwarding them, in theory, to fully qualified recyclers.

Beware glorified eBayers. Too many organisations are willing to hand over this equipment to organisations that merely strip off the best and dump the rest.

These companies will recover anything usable, sell it online and probably dump the rest in landfill. There is no data erasure, no control and no accountability. Drives may still contain data, yet be sold online.

We think the recycling process should be managed from start to finish using only directly employed staff who have all been screened to a standard such as CRB-enhanced status or Baseline Personnel Security Standard.

Vehicles should not be left unattended or overnight loaded with kit.

Companies should be able to guarantee zero landfill. Some companies send kit to the developing world for reuse, but in reality much of it never reaches the intended beneficiaries. Even if it does, the buck for environmentally responsible IT recycling is merely being passed on, perhaps to a country without the motive or the resources to process it correctly.

Don’t be fooled by asset value recovery programmes. The company also charges for the collection, processing and data erasure. The business never knows whether a disposal will result in a net surplus or deficit.

James Bird is chief executive of Stone Group