The Toronto Star is carrying a story in today's edition that raises real concerns for those who entrust shredding companies to safeguard and securely destroy documents. The article refers to allegations that have arisen in a bitter lawsuit that document destruction company's subcontractor left sensitive documents unsecured and blowing in the winds.

Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act, places the obligation of security on the company that collects the information (in this case, the bank, insurance companies and the like); this is an obligation that carries over into secure destruction. While they may have relied on the contractors to do the job, there is a risk that liability may attach to the original custodians for the failures of the contractors. Legal liability may be secondary, however, to the damage that can occur to a company's reputation if its sensitive customer information is left vulnerable to indentity theft and other risks. From the article in the Star:

Confidentiality gets shredded: Businessman says documents were `just blowing around:

"Case highlights threat to privacy, writes Tyler Hamilton

A courtroom feud between two local paper-shredding companies has triggered allegations that confidential customer records from Canada's major banks were mishandled or lost on their road to destruction.

The allegations, which have not been proven in court, have focussed attention on the paper disposal practices of the country's largest corporations, and highlight the risk of placing sensitive financial documents in the hands of third-party contractors in an age when identity theft runs rampant...."

Labels: identity theft, information breaches