IS YOUR PHOTOCOPIER STEALING CUSTOMER DATA?

In a story that has shocked businesses nationwide, CBS recently reported on a massive information security concern which has caught even the most sophisticated businesses off guard: modern scanners and photocopiers contain hard drives storing digital images of tens of thousands of recent copies. That's right: when you photocopy something, you aren't just creating two paper copies, but also a third electronic copy of the document.

Dealers regularly scan driver's licenses, credit applications, credit reports, conditional sales or lease agreements, and several other documents containing sensitive consumer information. When your copier or scanner lease expires and the lessor picks up the equipment, they may not expunge the copier records before selling or leasing the equipment to another party. When somebody takes possession of your former copier, they may also be acquiring a goldmine of data for potential use in identity thefts.

Under state and federal law, you have responsibilities to safeguard nonpublic customer data, including the requirement that you develop a comprehensive safeguards program to protect such data, and that this plan be updated regularly when you learn of additional risks. With copier and scanner security risks making national news, it may be a good idea to update your safeguards program to address copier and scanner-related data security. This is all-the-more important since California law triggers additional requirements when electronically-stored personal information is breached-including mandatory reporting of the breach to affected consumers. In any event, when turning in a leased copier, confirm with the lessor whether the hard drive will be cleared by the vendor; if so, seek confirmation of this commitment in writing. If you are selling old equipment, or your lessor will not clear the hard drive, be sure to take steps to either do so yourself, or hire a vendor to do so on your behalf.